1. Claus Brabrand, ITU, Denmark DATA-FLOW ANALYSISMar 25, 2009 Static Analysis: Data-Flow Analysis II Claus Brabrand IT University of Copenhagen ( brabrand@itu.dk ) ( AMP’09: Advanced Models & Programs, 2009 )

2. [ 2 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts, powersets, and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

3. [ 3 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS

4. [ 4 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Quick recap: int x = 1; int y = 3; x = x+2;x y; print(x,y); E. E[x  1 ] E. E[y  3 ] E. E[x  E(x)  2 ] E. E[x  E(y), y  E(x)] [, ]  ENV L [, ] x y 1 1 3 1 3 1 3 1 3 1 3 3 3 3 1 1 3... We (only) need 3 things:   A control-flow graph   A lattice   Transfer functions E. E

5. [ 5 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts, powersets, and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

6. [ 6 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Crossproduct: ’  ’ Crossproduct (binary operator on sets): Given sets: A = { 0, 1 } B = { true, false } A  B = { (0,true), (0,false), (1,true), (1,false) } i.e., creates sets of pairs Exercise: A  A = Z  Z = (A  A)  B = { (0,0), (0,1), (1,0), (1,1) } { (0,0), (0,1), (0,1), …, (1,0), (1,1), …, (42,87), … } { ((0,0),true), ((0,1),true), …, ((1,1),false) }

7. [ 7 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Powersets : ’ P (S)’ Powerset (unary operator on sets): Given set "S = { A, B }"; P (S) = { Ø, {A}, {B}, {A,B} = S } i.e., creates the set of all subsets (of the set) Note: Exercise: P (Z) = P (Z  Z) = If a set S has |S| elements; How many elements does P (S) have? X  S  X  P (S) { Ø, {0}, {1}, {2}, …, {0,1}, … {13,42,87}, … Z } ’ P (S)’ is (therefore) often written ’2 S ’ Answer: 2 |S| { Ø, {(0,0)}, {(1,1)}, …, {(0,0),(3,2),(4,9)}, … Z  Z }

8. [ 8 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Relations Example: “equals” relation: Signature: Relation is: Written as: as a short-hand for: … and as: as a short-hand for: Example: “less-than” relation: Signature: Relation is: Written as: as a short-hand for: … and as: as a short-hand for: 2  3 (2,3)  ‘=’ ‘=’  Z  Z (2,2)  ‘=’ 2 = 2 (8,7)  ‘<’ ‘<’  Z  Z (7,8)  ‘<’ 8 < 7 7 < 8 equals = { (0,0), (1,1), (2,2), (3,3), (4,4), … } less-than = { (0,1), (0,2), (0,3), …, (1,2), (1,3), … } …same as saying: ’=’  P (Z  Z) …same as saying: ’<’  P (Z  Z)

9. [ 9 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Exercises Example: “less-than-or-equal-to” relation: Signature: Relation is: Written as: as a short-hand for: … and as: as a short-hand for: Example: “is-congruent-modulo-3” relation: Signature: Relation is: Written as: as a short-hand for: … and as: as a short-hand for: 3  2 (3,2)  ‘  ’ ‘  ’  Z  Z (2,3)  ‘  ’ 2  3 (7,8)  ‘  3 ’ ‘  3 ’  Z  Z (6,9)  ‘  3 ’ 7  3 8 6  3 9 ‘  ’ = { (0,0), (0,1), (0,2), …, (1,1), (1,1), …, (2,3), … } ‘  3 ’ = { (0,0), (0,3), (0,6), …, (1,1), (1,4), …, (6,9), … } …same as saying: ’’  P (Z  Z) …same as saying: ’  ’  P (Z  Z) …same as saying: ’ ’  P (Z  Z) …same as saying: ’  3 ’  P (Z  Z)

10. [ 10 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Equivalence Relation Let ‘~’ be a binary relation over set A: ‘~’  A  A ~ is an equivalence relation iff: Reflexive: Symmetric: Transitive:  x  A: x ~ x  x,y  A: x ~ y  y ~ x  x,y,z  A: x ~ y  y ~ z  x ~ z

11. [ 11 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts, powersets, and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

12. [ 12 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Partial-Order A Partial-Order is a structure (S, ): S is a set ’ ’ is a binary relation on S (i.e., ’ ’  S  S) satisfying: Reflexivity: Transitivity: Anti-Symmetry:  x  S: x x  x,y  S: x y  y x  x = y  x,y,z  S: x y  y z  x z

13. [ 13 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Visualization: Hasse Diagram Partial-Order (S, ):  Reflexive: Transitive: Anti-Symmetric: Hasse Diagram:  x  S: x x  x,y  S: x y  y x  x = y  x,y,z  S: x y  y z  x z

14. [ 14 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Exercise (Hasse Diagram) Given Hasse Diagram: Write down partial order (B, ): Set B = { … } Relation ’ ’: Signature All elements of the relation (i.e., ’ ’ = { … } ) Give example of element in ’ ’ (w/ + w/o shorthand) Again, but for an element not in the relation

15. [ 15 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Example Partial-Orders Lattice Examples (as Hasse Diagrams): …depending on what is analysed for! 2 or more

16. Claus Brabrand, ITU, Denmark DATA-FLOW ANALYSISMar 25, 2009 Least Upper Bound ' '

17. [ 17 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS ”Least Upper Bound” Upper bound: We say that ’z’ is an upper bound for set ’X’ …written if Least upper bound: We say that ’z’ is the least upper bound of set ’X’ …written if  x  X: x z X z z = X X z   z’: X z’  z z’ upper bound least

18. [ 18 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Example: Least upper bound Analyses use ’ ’ to combine information (at confluence points): x = 2;x = 0; truefalse... [x =, y = ]

19. Claus Brabrand, ITU, Denmark DATA-FLOW ANALYSISMar 25, 2009 Lattice

20. [ 20 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Lattice A Lattice is a Partial Order (L, ) …where ’ S’ exists for all subsets S  L Examples (of lattices): Non-Examples (of non-lattices): Simplification: if we restrict to finite height lattices (which are the ones used in practice); then ’ ’ only has to exist for each pair of elements (i.e., not for all subsets of elements) Why? ”We must be able to combine information”

21. [ 21 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Power-Lattices Powerset Lattices (as Hasse Diagrams): …ordered under ’ ’ = ’  ’ (i.e., subset inclusion): P ({ x+1, y*2 }) P ({ a, b, c }) P ({ x, y })

22. [ 22 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts, powersets, and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

23. [ 23 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Transfer Functions Constant Transfer functions: b = true; f () = Analysing value-of-’b’ Analysing sign-of-’x’ x = 7; f () = transfer function

24. [ 24 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Transfer Functions Unary Transfer functions: b = !b; Analysing value-of-’b’ Analysing sign-of-’x’ x = -x; ! + transfer function

25. [ 25 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Transfer Functions Binary Transfer functions: b = b && c Analysing value-of-’b’ Analysing sign-of-’x’ x = x + n; transfer function (let's just assume ' c ' is false) assume ' c ' is false) (let's just assume ' n ' is 7) assume ' n ' is 7)

26. [ 26 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Lift lattice L (analyses ”constantness” of one single value): We need environments for analyzing: (tracking both ’v’ and ’w’) : i.e. we need lattice ’L  L’: Note: We need Transfer Functions on Environments!  = … w = v * v; (v =, w = ) ENV = ENV’ = L  L  {x,y}  L L |VAR|  VAR  L

27. [ 27 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Crossproduct Lattice Environment Lattice: ’L  L’:  = NB: if L is a lattice, then L  L is always a lattice

28. [ 28 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Exercise Calculate crossproduct lattice:  =

29. [ 29 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS (, ) Transfer Functions on Environment Lattices Constant Transfer functions: x = true; n = 7;  for ’x’for ’y’  for ’n’for ’m’ (, ) x y E. E[x = ] E. E[n = ] n m ENV transfer function (, )

30. [ 30 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS (, ) Transfer Functions on Environment Lattices Unary Transfer functions: x = !y; n = -m;  for ’x’for ’y’  for ’n’for ’m’ (, ) x y E. E[x = f not (E(y))] E. E[n = f - (E(m))] n m ENV transfer function (, )

31. [ 31 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Transfer Functions on Environment Lattices Binary Transfer functions: x = x && y; n = n + m;  (, ) for ’x’for ’y’  for ’n’for ’m’ (, ) x y E. E[x = E(x) && L E(y)] E. E[x = E(n) + L E(m)] n m ENV transfer function

32. Claus Brabrand, ITU, Denmark DATA-FLOW ANALYSISMar 25, 2009 Monotonicity Monotone Transfer Functions

33. [ 33 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Monotone Functions Monotone function (on a lattice L): Note: this is not saying that ’ f ’ is ascending: Examples: f : L  L  x,y  L: x y  f(x) f(y)  x  L: x f(x) All the transfer functions you have seen were monotone! :-) f () = …on lattice: !

34. [ 34 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS More Examples: Exercise: Check monotonicity of ' f ' below: f(X) = {a,b} f(X) = X  {a} f(X) = {a,b} \ X f(X) = X C  x,y  L: x y  f(x) f(y) Monotonicity: …on lattice: P ({a,b,c}) P ({a,b,c}) = 2 {a,b,c} = 2 {a,b,c} Monotone Func’s (cont’d) …on lattice:  E. E[x = ] E. E[x = f not (E(y))] E. E[x = E(x) && L E(y)]

35. [ 35 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts, powersets, and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

36. [ 36 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Fixed-Points A fixed-point for a function …is an element such that: Example: Function: …over P ({ a, b, c }) ' f ' has many fixed-points: { c } { a, c } … { a, b, c } f : L  L l  L l = f( l ) f(X) = X  {c} LEAST fixed point In fact, anything that includes ' c '

37. [ 37 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Another Example Another Example: x = 1; x = x+1; fixed- point! not a fixed- point! a = b = f x=1 (a) c = b d d = f x=x+1 (c) a=a= b=b= d=d= Recursive equations: fixed- point! c=c= LEAST

38. [ 38 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Fixed-Point Theorem! If: ’ f ’ is a monotone function: …over a lattice L (with finite height): Then: ’ f ’ is guaranteed to have a unique least fixed-point …which is computable as: Intuition: f : L  L fix(f) = f i ( ) i≥0 f( ) f(f( ))...until equality Proof is quite simple [cf. Notes, p.13 top]

39. [ 39 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Now you can… Solve ANY recursive equations (involving monotone functions over lattices): x = f(x,y,z) y = g(x,y,z) z = h(x,y,z) Which means that you can solve any recursive data-flow analysis equation! :-)

40. [ 40 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

41. [ 41 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS All you need is…: int x = 1; int y = 3; x = x+2;x y; print(x,y); E. E[x  1 ] E. E[y  3 ] E. E[x  E(x)  2 ] E. E[x  E(y), y  E(x)] [, ]  ENV L [, ] x y... We (only) need 3 things:   A control-flow graph   A lattice   Transfer functions int x = 1; int y = 3; if (...) { x = x+2; } else { x y; } print(x,y); Given program:

42. [ 42 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Solve Equations :-) One big lattice: E.g., (L |VAR| ) |PP| 1 big abstract value vector: [,,..., ]  (L |VAR| ) |PP| 1 big transfer function: F : (L |VAR| ) |PP|  (L |VAR| ) |PP| Compute fixed-point (simply): Start with bottom value vector ( ) Iterate transfer function ‘F’ (until nothing changes) Done; print out (or use) solution…! :-) [, ] (L |VAR| ) |PP|

43. [ 43 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Agenda (25/3, ’09) Relations: Crossproducts, powersets, and relations Lattices: Partial-Orders, least-upper-bound, and lattices Monotone Functions: Monotone Functions and Transfer Functions Fixed Points: Fixed Points and Solving Recursive Equations Putting it all together…: Example revisited

44. [ 44 ] Claus Brabrand, ITU, Denmark Mar 25, 2009DATA-FLOW ANALYSIS Now, please: 3’ recap Please spend 3' on thinking about and writing down the main ideas and points from the lecture – now!: After 1 day After 1 week After 3 weeks After 2 weeks Immediately