1. Prof. Aiken CS 294 Lecture 41 Constraint-Based Analysis Lecture 4

2. Prof. Aiken CS 294 Lecture 42 Outline Review –Dataflow –Type inference A generalization: Set constraints –Intractable/tractable problems –Solving constraints Examples Optimizations Summary

3. Prof. Aiken CS 294 Lecture 43 Dataflow Problems Classical dataflow equations are described as: v is a variable, a is an atom System of inclusion constraints Only variables on lhs Domain is atoms

4. Prof. Aiken CS 294 Lecture 44 Type Inference Problems Type inference problems are described as: Æ i  i1 =  i2  = c( ,...,  ) |  c is a constructor (may be 0-ary) System of equations Arbitrary expressions on lhs and rhs Domain is terms

5. Prof. Aiken CS 294 Lecture 45 Summary Dataflow analysis –Inclusion constraints over atoms Type inference –Equations over terms Two very different theories –With different applications –Developed over decades But are they really independent?

6. Prof. Aiken CS 294 Lecture 46 Set Constraints The set expressions are: E ::= 0 |  | E [ E | E Å E | : E | c(E,…,E) | c i -1 (E) A system of set constraints is Æ i E i1 µ E i2 Constructors c Set variables 

7. Prof. Aiken CS 294 Lecture 47 Semantics of Set Expressions E ::= 0 |  | E [ E | E Å E | : E | c(E,…,E) | c i -1 (E) One interpretation: Set expressions denote subsets of the Herbrand Universe H An assignment maps variables to sets of terms:  : Vars ! 2 H

8. Prof. Aiken CS 294 Lecture 48 Semantics of Set Expressions (Cont.) E ::= 0 |  | E [ E | E Å E | : E | c(E,…,E) | c i -1 (E) Extend  to all set expressions:  (0) = ;  (E 1 [ E 2 ) =  (E 1 ) [  (E 2 )  (E 1 Å E 2 ) =  (E 1 ) Å  (E 2 )  ( : E) = H -  (E)  (c(E 1,…,E n )) = {c(t 1,…,t n ) | t i 2  (E i )}  (c i -1 (E)) = { t i | c(t 1,…,t n ) 2  (E) }

9. Prof. Aiken CS 294 Lecture 49 Solutions An assignment  is a solution of the constraints if Æ i  (E i1 ) µ  (E i2 )

10. Prof. Aiken CS 294 Lecture 410 Set Constraints Set constraints generalize –Dataflow equations (add terms) –Type equations (add inclusion constraints) –And more (add projections) Dataflow Equations Type Equations Set Constraints

11. Prof. Aiken CS 294 Lecture 411 Notes on Projection Projection can model data selectors –Car, cdr, hd, tl, etc. But projections have another interesting property:

12. Prof. Aiken CS 294 Lecture 412 Conditional Projections can be used to encode conditional constraints: B  0 ) A µ C ´ c -1 (c(A,B)) µ C

13. Prof. Aiken CS 294 Lecture 413 Complexity Thm Deciding whether a system of set constraints has any solutions is NEXPTIME- complete Remains NEXPTIME complete even if we drop projections So, focus on tractable sub-theories

14. Prof. Aiken CS 294 Lecture 414 Sources of Complexity For equality constraints with no Å, [, : –Use union-find; near-linear time A = B = C ) A = C For (restricted) inclusion constraints –Use transitive closure; PTIME A µ B µ C ) A µ C

15. Prof. Aiken CS 294 Lecture 415 Sources of Complexity (Cont.) For EXPTIME algorithms, general Å, [, : For NEXPTIME algorithms, the choice C(A, B) = 0, A = 0 Ç B = 0

16. Prof. Aiken CS 294 Lecture 416 Connections Set constraints are related to –Tree automata –Logic (the monadic class) Also, implementation techniques are based on graphs & graph algorithms

17. Prof. Aiken CS 294 Lecture 417 A Tractable Fragment L ::= L [ L | c(L,…,L) |  | 0 R ::= R Å R | c(R,…,R) |  | 1 Let C be constraints of the form: L µ R   0 ) L µ R

18. Prof. Aiken CS 294 Lecture 418 Solving Set Constraints The usual strategy: –Rewrite constraints, preserving solutions –When all possible rewrites have been done, the system is in “solved form” Solutions are manifest Note: there are different notions of “solve” –Has at least one solution (yes/no) –Describe one solution (e.g., the least) –Describe all solutions

19. Prof. Aiken CS 294 Lecture 419 Resolution Rules 1 Trivial constraints: S Æ L µ 1, S S Æ 0 µ R, S S Æ x µ x, S

20. Prof. Aiken CS 294 Lecture 420 Resolution Rules 2 More interesting constraints: L µ R 1 Å R 2, L µ R 1 Æ L µ R 2 L 1 [ L 2 µ R, L 1 µ R Æ L 2 µ R c(…) µ  Æ  µ R, c(…) µ  Æ  µ R Æ c(…) µ R

21. Prof. Aiken CS 294 Lecture 421 Resolution Rules 3 And more interesting constraints: c(L 1,L 2 ) µ c(R 1,R 2 ) ( L 1 µ R 1 Æ L 2 µ R 2 c(…) µ  Æ   0 ! L µ R ( L µ R These rules preserve all solutions for non- strict constructors –c(…,0,…)  0

22. Prof. Aiken CS 294 Lecture 422 Resolution Rules 4 Note how the rules preserve R and L: c(L 1,L 2 ) µ c(R 1,R 2 ) ( L 1 µ R 1 Æ L 2 µ R 2 We can also have constructors with contravariant arguments; e.g., ! L ::= … | R ! L R ::= … | L ! R R 1 ! L 1 µ L 2 ! R 2, L 2 µ R 1 Æ L 1 µ R 2

23. Prof. Aiken CS 294 Lecture 423 An Observation Note the resolution rules do not create new expressions –Only subexpressions are used –E.g., L µ R 1 Å R 2, L µ R 1 Æ L µ R 2 L 1 [ L 2 µ R, L 1 µ R Æ L 2 µ R c(…) µ  Æ  µ R, c(…) µ  Æ  µ R Æ c(…) µ R

24. Prof. Aiken CS 294 Lecture 424 A Graph Interpretation Treat each subexpression as a node in a graph Constraints L µ R are directed edges L ! R Recast resolution rules as graph transformations

25. Prof. Aiken CS 294 Lecture 425 Resolution on Graphs 1 c(…) µ  Æ  µ R, c(…) µ  Æ  µ R Æ c(…) µ R  Rc(…)

26. Prof. Aiken CS 294 Lecture 426 Resolution on Graphs 2 c(…) µ  Æ   0 ! L µ R ( L µ R c(…)  LR

27. Prof. Aiken CS 294 Lecture 427 Resolution on Graphs 3 c(L 1,L 2 ) µ c(R 1,R 2 ) ( L 1 µ R 1 Æ L 2 µ R 2 L1L1 c(L 1,L 2 ) L2L2 R1R1 c(R 1,R 2 ) R2R2

28. Prof. Aiken CS 294 Lecture 428 The Other Constraints Skip presentation of rules for other constraints –Trivial constraints –Intersection/union constraints Easily handled –In practice, edges from these constraints are not explicitly represented anyway –Tend to keep only constraints on variables

29. Prof. Aiken CS 294 Lecture 429 Notes The process of adding edges according to a set of rules is called closing the graph The closed graph gives the solution of the constraints

30. Prof. Aiken CS 294 Lecture 430 Algorithmics This algorithm is a dynamic transitive closure New edges other than transitive edges are added during the closure procedure Can’t use standard transitive closure tricks –E.g., Boolean matrix multiplication

31. Prof. Aiken CS 294 Lecture 431 Dynamic Transitive Closure The best known algorithms for dynamic transitive closure are O(n 3 ) –Has not been improved in 30 years Sketch: In the worst case, a graph of n nodes –May have n 2 edges –Each edge may be added O(n) times

32. Prof. Aiken CS 294 Lecture 432 Applications

33. Prof. Aiken CS 294 Lecture 433 Four Applications Closure analysis for lambda calculus Receiver class analysis for OO languages Alias analysis for C

34. Prof. Aiken CS 294 Lecture 434 Closure Analysis: The Problem A call graph is a graph where –The nodes are function (method) names –There is a directed edge (f,g) if f may call g Call graphs can be overestimates –If f may call g at run time, there must be an edge (f,g) in the call graph –If f cannot call g at run time, there is no requirement on the graph

35. Prof. Aiken CS 294 Lecture 435 Call Graphs in Functional Languages Recall the untyped lambda calculus: e = x | x.e | e e Examples: –(( x.x) ( y.y)) ( z.z) –(( x. y.y) ( z.z)) ( w.w) –( x.x x) ( y.y y)

36. Prof. Aiken CS 294 Lecture 436 A Definition Assume all bound variables are unique –So a bound variable uniquely identifies a function –Can be done by renaming variables For each application e 1 e 2, what is the set of lambda terms L(e 1 ) to which e 1 may evaluate? –L(…) is a set of static, or syntactic, lambdas –L(…) defines a call graph the set of functions that may be called by an application

37. Prof. Aiken CS 294 Lecture 437 A More General Definition To compute L(…) for applications, we will need to compute it for every expression. Define: L(e) is the set of syntactic lambda abstractions to which e may evaluate The problem is to compute L(e) for every expression e

38. Prof. Aiken CS 294 Lecture 438 Defining L(…) x.e L( x.e) = x.e e 1 e 2 for each x.e 2 L(e 1 ) L(e 2 ) µ L(x) L(e) µ L(e 1 e 2 ) The value of the application includes the value of the function body The actual argument of the call flows to the formal argument

39. Prof. Aiken CS 294 Lecture 439 Rephrasing the Constraints with µ The following constraints have the same least solution as the original constraints: x.e x.e µ L( x.e) e 1 e 2 x.e 0 µ L(e 1 ) ) (L(e 2 ) µ L(x) Æ L(e 0 ) µ L(e 1 e 2 )) Note: Each L(e) is a constraint variable Each x.e is a constant

40. Prof. Aiken CS 294 Lecture 440 Example (( x.x) ( y.y)) ( z.z) x.x µ L( x.x) y.y µ L( y.y) z.z µ L( z.z) L( y.y) µ L(x) L(x) µ L(( x.x) ( y.y)) L( z.z) µ L(y) L(y) µ L((( x.x) ( y.y)) ( z.z)) Least solution: L( x.x) = x.x L( y.y) = y.y L( z.z) = z.z L( y.y) = L(x) = L(( x.x) ( y.y)) L( z.z) = L(y) = L((( x.x) ( y.y)) ( z.z))

41. Prof. Aiken CS 294 Lecture 441 The Example (( x.x) ( y.y)) ( z.z) with Graphs z z.z y y.yx x.x ( x.x) ( y.y) (( x.x) ( y.y)) ( z.z) x.x y.y z.z

42. Prof. Aiken CS 294 Lecture 442 The Solution for (( x.x) ( y.y)) ( z.z) z z.z y y.yx x.x ( x.x) ( y.y) (( x.x) ( y.y)) ( z.z) The solution is given by edges ( x.e,*) x.x z.z y.y

43. Prof. Aiken CS 294 Lecture 443 Control Flow Graphs in OO Languages Consider a method call e 0.f(e 1,…,e n ) To build a control-flow graph, we need to know which f methods may be called –Depends on the class of e 0 at runtime The problem: –For each expression, estimate the set of classes it could evaluate to at run time

44. Prof. Aiken CS 294 Lecture 444 An OO Language P ::= C 1... C n E C ::= class ClassId [inherits ClassId] var Id 1... Id k M 1... M n M ::= method MId(Id) E E ::= Id := E | E.MId(E,…,E) | E;E | new ClassId | if E E E

45. Prof. Aiken CS 294 Lecture 445 Constraints id := e C(e) µ C(id) C(e) µ C(id := e) e 1 ; e 2 C(e 2 ) µ C(e 1 ; e 2 ) new A { A } µ C(new A) if e 1 e 2 e 3 C(e 2 ) µ C(if e 1 e 2 e 3 ) C(e 3 ) µ C(if e 1 e 2 e 3 ) e 0.f(e 1 ) for each class A with a method f(x) e A 2 C(e 0 ) ) C(e 1 ) µ C(x) Æ C(e) µ C(e 0.f(e 1 ))

46. Prof. Aiken CS 294 Lecture 446 Notes Receiver class analysis of OO languages and control flow analysis of functional languages are the same problem Receiver class analysis is important in practice –Heavily object-oriented code pays a high price for the indirection in method calls –If we can show that only one method can be called, the function can be statically bound Or even inlined and optimized

47. Prof. Aiken CS 294 Lecture 447 Type Safety Notice that our OO language is untyped –We can run (new A).f(0) even if A has no f method –Gives a runtime error By adding upper bounds to the constraints, we can make receiver class analysis into a type inference procedure for our language

48. Prof. Aiken CS 294 Lecture 448 Type Inference id := e C(e) µ C(id) C(e) µ C(id := e) e 1 ; e 2 C(e 2 ) µ C(e 1 ; e 2 ) new A { A } µ C(new A) if e 1 e 2 e 3 C(e 2 ) µ C(if e 1 e 2 e 3 ) C(e 3 ) µ C(if e 1 e 2 e 3 ) C(e 1 ) µ { Bool } e 0.f(e 1 ) for each class A with a method f(x) e A 2 C(e 0 ) ) C(e 1 ) µ C(x) Æ C(e) µ C(e 0.f(e 1 )) C(e 0 ) µ { A | A has an f method }

49. Prof. Aiken CS 294 Lecture 449 Type Inference (Cont.) These constraints may not have a solution –May discover that the constraints require { B } µ ; If there is a solution, every dispatch will succeed at runtime Note: Requires a whole-program analysis

50. Prof. Aiken CS 294 Lecture 450 Alias Analysis (Review) In languages with side effects, want to know which locations may have aliases –More than one “name” –More than one pointer to them E.g., Y = &Z X = Y *X = 3 /* changes the value of *Y */

51. Prof. Aiken CS 294 Lecture 451 Alias Analysis: An Improvement The unification-based analysis we saw in Lecture 3 is coarse Points-to sets are equivalence classes Inclusion-based analysis can be more accurate

52. Prof. Aiken CS 294 Lecture 452 The Encoding of a Location For a program variable x: ref(label,  x,  x ) A label: a 0-ary constructor A covariant field: used for reading from the location A contravariant field: used for writing to the location

53. Prof. Aiken CS 294 Lecture 453 Inference Rules

54. Prof. Aiken CS 294 Lecture 454 In Practice Many natural inclusion-based analysis problems are equivalent to dynamic transitive closure Widely believed to be impractical –O(n 3 ) suggests it may be slow –And in fact it is Many implementations have tried

55. Prof. Aiken CS 294 Lecture 455 One Problem Consider what happens on a cycle in the graph A constructed lower bound on any one node is propagated to every node in the cycle c(…)

56. Prof. Aiken CS 294 Lecture 456 Observation A cycle in the graph corresponds to a cycle in the constraints –x 1 µ x 2 µ... µ x n µ x 1 –All of these variables are equal in all solutions! Thus, there is a lot of wasted work in pushing values around cycles –And cycles are very common

57. Prof. Aiken CS 294 Lecture 457 The Idea We want to detect and eliminate cycles on-line –Collapse cycles to a single node –During constraint resolution On-line cycle detection is very hard –No known algorithm is significantly better than stopping the graph closure and doing a depth-first search of the entire graph

58. Prof. Aiken CS 294 Lecture 458 Partial On-Line Cycle Elimination Instead, we will settle for partial cycle elimination –For every cycle that exists in the graph, guarantee we find at least a piece of it –And do it cheaply

59. Prof. Aiken CS 294 Lecture 459 A Different Representation We change the representation of the graph –Assign every variable x (node) arbitray index R(x) –Each node has a list of edges stored with it –An edge (x,y) is stored At x if R(x) > R(y) (a successor edge, colored red) At y if R(y) > R(x) (a predecessor edge, colored blue) New transitive closure rule:

60. Prof. Aiken CS 294 Lecture 460 Cycle Detection Algorithm On each edge addition (x,y) –If (x,y) is a successor edge (R(x) > R(y)) then search along predecessor edges from x. When a node z s.t. R(z) < R(y) is found, prune that path If y is found, a cycle is detected –If (x,y) is a predecessor edge (R(x) < R(y)) then search along successor edges from y. When a node z s.t. R(z) < R(x) is found, prune that path If x is found, a cycle is detected

61. Prof. Aiken CS 294 Lecture 461 Cycle Detection in Pictures 5722 45 9 17 42

62. Prof. Aiken CS 294 Lecture 462 Part of Every Cycle is Detected Every cycle has at least one red and one blue edge –Indices cannot uniformly increase or decrease around a cycle Thus, the transitivity rule always applies –Always adds a chord across the cycle, giving a smaller cycle Two-cycles are always detected 5722 99 42

63. Prof. Aiken CS 294 Lecture 463 Analysis of Cycle Detection Part of every cycle is detected Expected number of nodes visited per edge addition is very low –About 2, in theory –Why? Long chains of descending, arbitrarily chosen indices are very unlikely Can show asymptotic speedup in graph closure for random graphs

64. Prof. Aiken CS 294 Lecture 464 Experiments Cycle detection is fast –In experiments, 1.8 nodes visited/edge addition –Constants are very small About 80% of nodes in cycles are detected –Detected cycles are removed from the graph and put in a union/find data structure Gives asymptotic performance improvement –For alias analysis of C Allows programs 10X larger to be analyzed than without

65. Prof. Aiken CS 294 Lecture 465 Summary Dynamic transitive closure algorithms are coming –Still “in the lab”, but increasingly practical –Need more tricks than cycle elimination

66. Prof. Aiken CS 294 Lecture 466 Summary of Constraint-Based Analysis Constraints separate –Specification (system of constraints) –Implementation (constraint resolution) Clear place to apply algorithmic knowledge No forwards-backwards distinction –Can solve for any unknown Infinite domains Separate analysis is easy –Can always solve constraints

67. Prof. Aiken CS 294 Lecture 467 Where is Constraint-Based Analysis Weak? Only fairly simple constraints are practical –This situation is improving Doesn’t capture all of abstract interpretation –In particular, situations where there is a favored direction (forwards, backwards) for efficiency reasons

68. Prof. Aiken CS 294 Lecture 468 Things We Didn’t Talk About Polymorphism –Context-free reachability & polymorphic recursion Effect Systems –A computation has a type & an effect –E.g., the set of memory locations written –Mixed constraint systems Other constraint languages –There are some besides = and µ