1. Program Analysis via Graph Reachability Thomas Reps University of Wisconsin PLDI 00 Tutorial, Vancouver, B.C., June 18, 2000 http://www.cs.wisc.edu/~reps/

2. int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Backward Slice Backward slice with respect to “printf(“%d\n”,i)”

3. int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Backward Slice Backward slice with respect to “printf(“%d\n”,i)”

4. int main() { int i = 1; while (i < 11) { i = i + 1; } printf(“%d\n”,i); } Slice Extraction Backward slice with respect to “printf(“%d\n”,i)”

5. Forward Slice int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Forward slice with respect to “sum = 0”

6. Forward Slice int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); }

7. What Are Slices Useful For? Understanding Programs –What is affected by what? Restructuring Programs –Isolation of separate “computational threads” Program Specialization and Reuse –Slices = specialized programs –Only reuse needed slices Program Differencing –Compare slices to identify changes Testing –What new test cases would improve coverage? –What regression tests must be rerun after a change?

8. Line-Character-Count Program void line_char_count(FILE *f) { int lines = 0; int chars; BOOL eof_flag = FALSE; int n; extern void scan_line (FILE *f, BOOL *bptr, int *iptr); scan_line(f, &eof_flag, &n); chars = n; while(eof_flag == FALSE){ lines = lines + 1; scan_line(f, &eof_flag, &n); chars = chars + n; } printf(“lines = %d\n”, lines); printf(“chars = %d\n”, chars); }

9. Character-Count Program void char_count(FILE *f) { int lines = 0; int chars; BOOL eof_flag = FALSE; int n; extern void scan_line (FILE *f, BOOL *bptr, int *iptr); scan_line(f, &eof_flag, &n); chars = n; while(eof_flag == FALSE){ lines = lines + 1; scan_line(f, &eof_flag, &n); chars = chars + n; } printf(“lines = %d\n”, lines); printf(“chars = %d\n”, chars); }

10. Line-Character-Count Program void line_char_count(FILE *f) { int lines = 0; int chars; BOOL eof_flag = FALSE; int n; extern void scan_line (FILE *f, BOOL *bptr, int *iptr); scan_line(f, &eof_flag, &n); chars = n; while(eof_flag == FALSE){ lines = lines + 1; scan_line(f, &eof_flag, &n); chars = chars + n; } printf(“lines = %d\n”, lines); printf(“chars = %d\n”, chars); }

11. Line-Count Program void line_count(FILE *f) { int lines = 0; int chars; BOOL eof_flag = FALSE; int n; extern void scan_line2 (FILE *f, BOOL *bptr, int *iptr); scan_line2(f, &eof_flag, &n); chars = n; while(eof_flag == FALSE){ lines = lines + 1; scan_line2(f, &eof_flag, &n); chars = chars + n; } printf(“lines = %d\n”, lines); printf(“chars = %d\n”, chars); }

12. Control Flow Graph Enter sum = 0i = 1 while(i < 11) printf(sum)printf(i) sum = sum + ii = i + i T F int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); }

13. Flow Dependence Graph int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0printf(sum) printf(i) sum = sum + ii = i + i Flow dependence pq Value of variable assigned at p may be used at q. i = 1 while(i < 11)

14. q is reached from p if condition p is true (T), not otherwise. Control Dependence Graph Control dependence pq T pq F Similar for false (F). Enter sum = 0i = 1 while(i < 11) printf(sum) printf(i) sum = sum + ii = i + i T T T T T T T T int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); }

15. Program Dependence Graph (PDG) int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0i = 1 while(i < 11) printf(sum) printf(i) sum = sum + ii = i + i T T T T T Control dependence Flow dependence T T T

16. Program Dependence Graph (PDG) int main() { int i = 1; int sum = 0; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0i = 1 while(i < 11) printf(sum) printf(i) sum = sum + ii = i + i T T T T T T T T Opposite Order Same PDG

17. Backward Slice int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0i = 1 while(i < 11) printf(sum) printf(i) sum = sum + ii = i + i T T T T T T T T

18. Backward Slice (2) int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0 i = 1 while(i < 11) printf(sum) printf(i) sum = sum + i i = i + i T T T T T T T T

19. Backward Slice (3) int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0 i = 1 while(i < 11) printf(sum) printf(i) sum = sum + i i = i + i T T T T T T T T

20. Backward Slice (4) int main() { int sum = 0; int i = 1; while (i < 11) { sum = sum + i; i = i + 1; } printf(“%d\n”,sum); printf(“%d\n”,i); } Enter sum = 0 i = 1 while(i < 11) printf(sum) printf(i) sum = sum + i i = i + i T T T T T T T T

21. Slice Extraction int main() { int i = 1; while (i < 11) { i = i + 1; } printf(“%d\n”,i); } Enter i = 1 while(i < 11) printf(i) i = i + i T T T T T

23. Interprocedural Slice int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Backward slice with respect to “printf(“%d\n”,i)”

24. Interprocedural Slice int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Backward slice with respect to “printf(“%d\n”,i)”

25. int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } Interprocedural Slice int add(int x, int y) { return x + y; } Superfluous components included by Weiser’s slicing algorithm [TSE 84] Left out by algorithm of Horwitz, Reps, & Binkley [PLDI 88; TOPLAS 90]

26. Each PDG has nodes for –entry point –procedure parameters and function result Each call site has nodes for –call –arguments and function result Appropriate edges –entry node to parameters –call node to arguments –call node to entry node –arguments to parameters How is an SDG Created?

27. System Dependence Graph (SDG) Enter main Call p Enter p

28. SDG for the Sum Program Enter main sum = 0i = 1 while(i < 11) printf(sum) printf(i) Call add x in = sum y in = i sum = x out x in = iy in = 1i = x out Enter add x = x in y = y in x = x + yx out = x

29. Interprocedural Backward Slice Enter main Call p Enter p

30. Interprocedural Backward Slice (2) Enter main Call p Enter p

31. Interprocedural Backward Slice (3) Enter main Call p Enter p

32. Interprocedural Backward Slice (4) Enter main Call p Enter p

33. Interprocedural Backward Slice (5) Enter main Call p Enter p

34. Interprocedural Backward Slice (6) Enter main Call p Enter p [ ] ) (

35. Matched-Parenthesis Path ) ( ) [

36. Interprocedural Backward Slice (6) Enter main Call p Enter p

37. Interprocedural Backward Slice (7) Enter main Call p Enter p

38. Slice Extraction Enter main Call p Enter p

39. Slice of the Sum Program Enter main i = 1 while(i < 11) printf(i) Call add x in = iy in = 1i = x out Enter add x = x in y = y in x = x + yx out = x

40. CFL-Reachability [Yannakakis 90] G: Graph (N nodes, E edges) L: A context-free language L-path from s to t iff Running time: O(N 3 )

41. Interprocedural Slicing via CFL-Reachability Graph: System dependence graph L: L(matched) [roughly] Node m is in the slice w.r.t. n iff there is an L(matched)-path from m to n

42. ( e [ e ] e [ e ]] e ) matched | e | [ matched ] | ( matched ) | matched matched CFL-Reachability s t s ( eeeeee[[[ t ) ]]] s t s t Ordinary Graph Reachability

43. CFL-Reachability via Dynamic Programming Grammar Graph B C A A  B C

44. st Degenerate Case: CFL-Recognition “(a + b) * c”  L(exp) ? exp  id | exp + exp | exp * exp | ( exp ) ) (acb+*

45. * a++)bc st Degenerate Case: CFL-Recognition “a + b) * c +”  L(exp) ? exp  id | exp + exp | exp * exp | ( exp )

46. CYK: Context-Free Recognition  = “( [ ] ) [ ]” Is   L(M)? M  M M | ( M ) | [ M ] | ( ) | [ ]

47. CYK: Context-Free Recognition M  M M | ( M ) | [ M ] | ( ) | [ ] M  M M | LPM ) | LBM ] | ( ) | [ ] LPM  ( M LBM  [ M

48. CYK Is “( [ ] ) [ ]”  L(M)? st ( [ ] ) [ ] M  M M | LPM ) | LBM ] | ( ) | [ ] LPM  ( M LBM  [ M MM LPM M M

49. CFL-Reachability via Dynamic Programming Grammar Graph B C A A  B C

50. Dynamic Transitive Closure ?! Aiken et al. –Set-constraint solvers –Points-to analysis Henglein et al. –type inference But a CFL captures a non-transitive reachability relation [Valiant 75]

51. S T Program Chopping Given source S and target T, what program points transmit effects from S to T? Intersect forward slice from S with backward slice from T, right?

52. Non-Transitivity and Slicing int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Forward slice with respect to “sum = 0”

53. int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } Forward slice with respect to “sum = 0” Non-Transitivity and Slicing int add(int x, int y) { return x + y; }

54. Non-Transitivity and Slicing int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Backward slice with respect to “printf(“%d\n”,i)”

55. Non-Transitivity and Slicing int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Backward slice with respect to “printf(“%d\n”,i)”

56. Forward slice with respect to “sum = 0” Non-Transitivity and Slicing int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Backward slice with respect to “printf(“%d\n”,i)” 

57. Non-Transitivity and Slicing int main() { int sum = 0; int i = 1; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; } Chop with respect to “sum = 0” and “printf(“%d\n”,i)” 

58. Non-Transitivity and Slicing Enter main sum = 0i = 1 while(i < 11) printf(sum) printf(i) Call add x in = sum y in = i sum = x out x in = iy in = 1i = x out Enter add x = x in y = y in x = x + yx out = x ( ]

59. Program Chopping Given source S and target T, what program points transmit effects from S to T? S T “Precise interprocedural chopping” [Reps & Rosay FSE 95]

60. CF-Recognition vs. CFL-Reachability CF-Recognition –Chain graphs –General grammar: sub-cubic time [Valiant75] –LL(1), LR(1): linear time CFL-Reachability –General graphs: O(N 3 ) –LL(1): O(N 3 ) –LR(1): O(N 3 ) –Certain kinds of graphs: O(N+E) –Regular languages: O(N+E) Gen/kill IDFA GMOD IDFA

61. Regular-Language Reachability [Yannakakis 90] G: Graph (N nodes, E edges) L: A regular language L-path from s to t iff Running time: O(N+E) Ordinary reachability (= transitive closure) –Label each edge with e –L is e* vs. O(N 3 )

62. Themes Harnessing CFL-reachability Relationship to other analysis paradigms Exhaustive alg.  Demand alg. Understanding complexity –Linear... cubic... undecidable Beyond CFL-reachability

63. Relationship to Other Analysis Paradigms Dataflow analysis –reachability versus equation solving Deduction Set constraints

64. Dataflow Analysis Goal: For each point in the program, determine a superset of the “facts” that could possibly hold during execution Examples –Constant propagation –Reaching definitions –Live variables –Possibly uninitialized variables

65. Useful For... Optimizing compilers Parallelizing compilers Tools that detect possible logical errors Tools that show the effects of a proposed modification

66. Possibly Uninitialized Variables Startx = 3 if... y = x y = w w = 8 printf(y) {w,x,y} {w,y} {w} {w,y} {} {w,y} {}

67. Precise Intraprocedural Analysis start n C

68. x = 3 p(x,y) return from p printf(y) start main exit main start p(a,b) if... b = a p(a,b) return from p printf(b) exit p ( ) ] (

69. Precise Interprocedural Analysis start n C ret () [Sharir & Pnueli 81]

70. Representing Dataflow Functions Identity Function Constant Function a bc a bc

71. Representing Dataflow Functions “Gen/Kill” Function Non-“Gen/Kill” Function a bc a bc

72. x = 3 p(x,y) return from p printf(y) start main exit main start p(a,b) if... b = a p(a,b) return from p printf(b) exit p xy a b

73. a bcbc a Composing Dataflow Functions bc a

74. x = 3 p(x,y) return from p start main exit main start p(a,b) if... b = a p(a,b) return from p exit p xy a b printf(y) Might b be uninitialized here? printf(b) NO! ( ] Might y be uninitialized here? YES! ( )

75. matched  matched matched | ( i matched ) i 1  i  CallSites | edge |  stack ) ( ( ( ( ( ) ) ) ) ( ) Off Limits!

76. ) ( ( ( ( ( ) ) ) ( ) ( stack ( ( unbalLeft  matched unbalLeft | ( i unbalLeft 1  i  CallSites |  stack Off Limits!

77. Interprocedural Dataflow Analysis via CFL-Reachability Graph: Exploded control-flow graph L: L(unbalLeft) Fact d holds at n iff there is an L(unbalLeft)-path from

78. Asymptotic Running Time [Reps, Horwitz, & Sagiv 95] [Reps, Horwitz, & Sagiv 95] CFL-reachability –Exploded control-flow graph: ND nodes –Running time: O(N 3 D 3 ) Exploded control-flow graph Special structure Running time: O(ED 3 ) Typically: E l N, hence O(ED 3 ) l O(ND 3 ) “Gen/kill” problems: O(ED)

79. Why Bother? “We’re only interested in million-line programs” Know thy enemy! –“ Any” algorithm must do these operations –Avoid pitfalls (e.g., claiming O(N 2 ) algorithm) The essence of “context sensitivity” Special cases –“Gen/kill” problems: O(ED) Compression techniques –Basic blocks –SSA form, sparse evaluation graphs Demand algorithms

80. Relationship to Other Analysis Paradigms Dataflow analysis –reachability versus equation solving Deduction Set constraints

81. The Need for Pointer Analysis int main() { int sum = 0; int i = 1; int *p = ∑ int *q = &i; int (*f)(int,int) = add; while (*q < 11) { *p = (*f)(*p,*q); *q = (*f)(*q,1); } printf(“%d\n”,*p); printf(“%d\n”,*q); } int add(int x, int y) { return x + y; }

82. The Need for Pointer Analysis int main() { int sum = 0; int i = 1; int *p = ∑ int *q = &i; int (*f)(int,int) = add; while (*q < 11) { *p = (*f)(*p,*q); *q = (*f)(*q,1); } printf(“%d\n”,*p); printf(“%d\n”,*q); } int add(int x, int y) { return x + y; }

83. The Need for Pointer Analysis int main() { int sum = 0; int i = 1; int *p = ∑ int *q = &i; int (*f)(int,int) = add; while (i < 11) { sum = add(sum,i); i = add(i,1); } printf(“%d\n”,sum); printf(“%d\n”,i); } int add(int x, int y) { return x + y; }

84. Flow-Sensitive Points-To Analysis p = &q; p = q; p = *q; *p = q; pq p r1r1 r2r2 q r1r1 r2r2 q s1s1 s2s2 s3s3 p p s1s1 s2s2 q r1r1 r2r2 pq p r1r1 r2r2 q r1r1 r2r2 q s1s1 s2s2 s3s3 p p s1s1 s2s2 q r1r1 r2r2

85. Flow-Sensitive  Flow-Insensitive start main exit main 33 22 11 44 55 33 22 11 44 55

86. Flow-Insensitive Points-To Analysis [Andersen 94, Shapiro & Horwitz 97] p = &q; p = q; p = *q; *p = q; pq p r1r1 r2r2 q r1r1 r2r2 q s1s1 s2s2 s3s3 p p s1s1 s2s2 q r1r1 r2r2

87. Flow-Insensitive Points-To Analysis a = &e; b = a; c = &f; *b = c; d = *a; a d b c f e

88. CFL-Reachability via Dynamic Programming Grammar Graph B C A A  B C

89. CFL-Reachability = Chain Programs Grammar A  B C Graph B C a(X,Z) :- b(X,Y), c(Y,Z). z x y A

90. Base Facts for Points-To Analysis p = &q; p = q; p = *q; *p = q; assignAddr(p,q). assign(p,q). assignStar(p,q). starAssign(p,q).

91. Rules for Points-To Analysis (I) pointsTo(P,Q) :- assignAddr(P,Q). pointsTo(P,R) :- assign(P,Q), pointsTo(Q,R). p = &q; pq p = q; p r1r1 r2r2 q

92. Rules for Points-To Analysis (II) pointsTo(P,S) :- assignStar(P,Q),pointsTo(Q,R),pointsTo(R,S). pointsTo(R,S) :- starAssign(P,Q),pointsTo(P,R),pointsTo(Q,S). p = *q; r1r1 r2r2 q s1s1 s2s2 s3s3 p *p = q; p s1s1 s2s2 q r1r1 r2r2

93. Creating a Chain Program pointsTo(R,S) :- starAssign(P,Q),pointsTo(P,R),pointsTo(Q,S). *p = q; p s1s1 s2s2 q r1r1 r2r2 pointsTo(R,S) :- pointsTo(P,R),starAssign(P,Q),pointsTo(Q,S). pointsTo(R,S) :- pointsTo(R,P),starAssign(P,Q),pointsTo(Q,S). pointsTo(R,P) :- pointsTo(P,R).

94. Base Facts for Points-To Analysis p = &q; p = q; p = *q; *p = q; assignAddr(p,q). assign(p,q). assignStar(p,q). starAssign(p,q). starAssign(q,p). assignStar(q,p). assign(q,p). assignAddr(q,p).

95. Creating a Chain Program pointsTo(P,Q) :- assignAddr(P,Q). pointsTo(P,R) :- assign(P,Q), pointsTo(Q,R). pointsTo(P,S) :- assignStar(P,Q),pointsTo(Q,R),pointsTo(R,S). pointsTo(Q,P) :- assignAddr(Q,P). pointsTo(R,S) :- pointsTo(R,P),starAssign(P,Q),pointsTo(Q,S). pointsTo(S,P) :- pointsTo(S,R),pointsTo(R,Q),assignStar(Q,P). pointsTo(S,R) :- pointsTo(S,Q),starAssign(Q,P),pointsTo(P,R). pointsTo(R,P) :- pointsTo(R,Q), assign(Q,P).

96. ... and now to CFL-Reachability pointsTo  assign pointsTo pointsTo  assignStar pointsTo pointsTo pointsTo  assignAddr pointsTo  pointsTo starAssign pointsTo pointsTo  pointsTo pointsTo assignStar pointsTo  pointsTo starAssign pointsTo pointsTo  pointsTo assign

97. Themes Harnessing CFL-reachability Relationship to other analysis paradigms Exhaustive alg.  Demand alg. Understanding complexity –Linear... cubic... undecidable Beyond CFL-reachability

98. Exhaustive Versus Demand Analysis Exhaustive analysis: All facts at all points Optimization: Concentrate on inner loops Program-understanding tools: Only some facts are of interest

99. Exhaustive Versus Demand Analysis Demand analysis: –Does a given fact hold at a given point? –Which facts hold at a given point? –At which points does a given fact hold? Demand analysis via CFL-reachability –single-source/single-target CFL-reachability –single-source/multi-target CFL-reachability –multi-source/single-target CFL-reachability

100. x = 3 p(x,y) return from p printf(y) start main exit main start p(a,b) if... b = a p(a,b) return from p printf(b) exit p xy a b YES! ( ) NO! “Semi-exhaustive”: All “appropriate” demands Might y be uninitialized here? Might b be uninitialized here?

101. Experimental Results [Horwitz, Reps, & Sagiv 1995] [Horwitz, Reps, & Sagiv 1995] 53 C programs (200-6,700 lines) For a single fact of interest: –demand always better than exhaustive All “appropriate” demands beats exhaustive when percentage of “yes” answers is high –Live variables –Truly live variables –Constant predicates –...

102. Demand Analysis and LP Queries (I) Flow-insensitive points-to analysis –Does variable p point to q? Issue query: ?- pointsTo(p, q). Solve single-source/single-target L(pointsTo)- reachability problem –What does variable p point to? Issue query: ?- pointsTo(p, Q). Solve single-source L(pointsTo)-reachability problem –What variables point to q? Issue query: ?- pointsTo(P, q). Solve single-target L(pointsTo)-reachability problem

103. Demand Analysis and LP Queries (II) Flow-sensitive analysis –Does a given fact f hold at a given point p? ?- dfFact(p, f). –Which facts hold at a given point p? ?- dfFact(p, F). –At which points does a given fact f hold? ?- dfFact(P, f). E.g., flow-sensitive points-to analysis ?- dfFact(p, pointsTo(x, Y)). ?- dfFact(P, pointsTo(x, y)). etc.