# Reps Horwitz and Sagiv 95 (RHS) Another approach to context-sensitive interprocedural analysis Express the problem as a graph reachability query Works

• View
214

2

Embed Size (px)

### Text of Reps Horwitz and Sagiv 95 (RHS) Another approach to context-sensitive interprocedural analysis...

• Slide 1
• Reps Horwitz and Sagiv 95 (RHS) Another approach to context-sensitive interprocedural analysis Express the problem as a graph reachability query Works for distributive problems
• Slide 2
• Reps Horwitz and Sagiv 95 (RHS) g() { if(isLocked()) { unlock; } else { lock; } f() { g(); if (...) { main(); } main() { g(); f(); lock; unlock; }
• Slide 3
• Reps Horwitz and Sagiv 95 (RHS) g() { if(isLocked()) { unlock; } else { lock; } f() { g(); if (...) { main(); } main() { g(); f(); lock; unlock; }
• Slide 4
• Reps Horwitz and Sagiv 95 (RHS) g() { if(isLocked()) { unlock; } else { lock; } f() { g(); if (...) { main(); } main() { g(); f(); lock; unlock; }
• Slide 5
• In class excersice main() { f() } f() { if(Unlocked()) { lock f() } else { unlock }
• Slide 6
• In class excersice main() { f() } f() { if(Unlocked()) { lock f() } else { unlock }
• Slide 7
• Procedure specialization Interprocedural analysis is great for callers But for the callee, information is still merged main() { x := new A(...); y := x.g(); y.f(); x := new A(...); y := x.g(); y.f(); x := new B(...); y:= x.g(); y.f(); } // g too large to inline g(x) { x.f(); // lots of code return x; } // but want to inline f f([email protected]) {... } f([email protected]) {... }
• Slide 8
• Procedure specialization Specialize g for each dataflow information In between inlining and context-sensitve interproc main() { x := new A(...); y := x.g 1 (); y.f(); x := new A(...); y := x.g 1 (); y.f(); x := new B(...); y:= x.g 2 (); y.f(); } g 1 (x) { x.f(); // can now inline // lots of code return x; } g 2 (x) { x.f(); // can now inline // lots of code return x; } // but want to inline f f([email protected]) {... } f([email protected]) {... }
• Slide 9
• A() { call D } B() { call D } C() { call D } D() {... } Recap using pictures
• Slide 10
• A() { } DD B() { } D C() { } D Inlining A() { call D } B() { call D } C() { call D } D() {... }
• Slide 11
• A() { call D } B() { call D } C() { call D } D() {... } caller summary callee summary Context-insensitive summary A() { call D } B() { call D } C() { call D } D() {... }
• Slide 12
• A() { call D } B() { call D } C() { call D } D() {... } context sensitive summary Context sensitive summary A() { call D } B() { call D } C() { call D } D() {... }
• Slide 13
• A() { call D } B() { call D } C() { call D } D() {... } D() {... } Procedure Specialization A() { call D } B() { call D } C() { call D } D() {... }
• Slide 14
• Comparison Caller precisionCallee precisionCode bloat Inlining context-insensitive interproc Context sensitive interproc Specialization
• Slide 15
• Comparison Caller precisionCallee precisioncode bloat Inlining, because contexts are kept separate may be large if we want to get the best precision context-insensitive interproc , because contexts are merged none Context sensitive interproc, because of context sensitive summaries , because contexts are still merged when optimizing callees none Specialization, contexts are kept separate Some, less than inlining
• Slide 16
• Summary on how to optimize function calls Inlining Tail call optimizations Interprocedural analysis using summaries context sensitive context insensitive Specialization
• Slide 17
• Cutting edge research Making interprocedural analysis scalable Optimizing first order function calls Making inlining effective in the presence of dynamic dispatching and class loading
• Slide 18
• Pointer analysis
• Slide 19
• Pointer Analysis Outline: What is pointer analysis Intraprocedural pointer analysis Interprocedural pointer analysis Andersen and Steensgaard
• Slide 20
• Pointer and Alias Analysis Aliases: two expressions that denote the same memory location. Aliases are introduced by: pointers call-by-reference array indexing C unions
• Slide 21
• Useful for what? Improve the precision of analyses that require knowing what is modified or referenced (eg const prop, CSE ) Eliminate redundant loads/stores and dead stores. Parallelization of code can recursive calls to quick_sort be run in parallel? Yes, provided that they reference distinct regions of the array. Identify objects to be tracked in error detection tools x := *p;... y := *p; // replace with y := x? *x :=...; // is *x dead? x.lock();... y.unlock(); // same object as x?
• Slide 22
• Kinds of alias information Points-to information (must or may versions) at program point, compute a set of pairs of the form p ! x, where p points to x. can represent this information in a points-to graph Alias pairs at each program point, compute the set of of all pairs (e 1,e 2 ) where e 1 and e 2 must/may reference the same memory. Storage shape analysis at each program point, compute an abstract description of the pointer structure. p x y zp
• Slide 23
• Intraprocedural Points-to Analysis Want to compute may-points-to information Lattice:
• Slide 24
• Flow functions x := a + b in out F x := a+b (in) = x := k in out F x := k (in) =
• Slide 25
• Flow functions x := &y in out F x := &y (in) = x := y in out F x := y (in) =
• Slide 26
• Flow functions *x := y in out F *x := y (in) = x := *y in out F x := *y (in) =
• Slide 27
• Intraprocedural Points-to Analysis Flow functions:

Documents
Documents
Spiritual
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents
Documents