1 / 23

Flow insensitivity and imprecision

Flow insensitivity and imprecision. If you ignore flow, then you lose precision. main() { x := &y; ... x := &z; }. Flow insensitive analysis tells us that x may point to z here!. But, insensitivity may alleviate two bottlenecks: (1) space : mem exhausted by large programs

duff
Download Presentation

Flow insensitivity and imprecision

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Flow insensitivity and imprecision If you ignore flow, then you lose precision. main() { x := &y; ... x := &z; } Flow insensitive analysis tells us that x may point to z here! But, insensitivity may alleviate two bottlenecks: (1) space : mem exhausted by large programs (2) time : need speed for JIT or edit , compile loop

  2. Andersen’s : worst case complexity Worst case: N2 per statement at least N3 for the whole program Andersen’s is in fact O(N3) x y x y *x = y a b c d e f a b c d e f

  3. New idea: one successor per node Each node can point to at most one “thing”. “Thing” : everything a var may point to. x y x y *x = y a,b,c d,e,f a,b,c d,e,f

  4. More general case for *x = y x y *x = y

  5. More general case for *x = y x y x y *x = y

  6. x y x y x y *x = y More general case for *x = y

  7. More general case for x = *y Handling: x = *y x y x = *y

  8. More general case for x = *y Handling: x = *y x y x y x = *y

  9. x y x y x y x = *y More general case for x = *y Handling: x = *y

  10. More general case for x = y Handling: x = y x y x = y

  11. More general case for x = y Handling: x = y x y x y x = y

  12. x y x y x y x = y More general case for x = y Handling: x = y

  13. x y x y x y x = y More general case for x = y Handling: x = y (what about y = x?)

  14. x y x y x y x = y More general case for x = y Handling: x = y (what about y = x?) same result for y = x !

  15. More general case for x = &y Handling: x = &y x y x = &y

  16. More general case for x = &y Handling: x = &y x y x y x = &y

  17. More general case for x = &y Handling: x = &y x y x y x x = &y y,…

  18. Our favorite example, once more! S1: l := new Cons 1 p := l 2 S2: t := new Cons 3 *p := t 4 p := t 5

  19. Our favorite example, once more! l l p 1 2 S1: l := new Cons 1 S1 S1 3 p := l 2 l p t l p t 4 S2: t := new Cons 3 S1 S2 S1 S2 5 *p := t 4 l p t l p t p := t 5 S1 S2 S1,S2

  20. p t l S1 S2 Flow insensitive loss of precision Flow-insensitive Unification- based S1: l := new Cons Flow-sensitive Subset-based Flow-insensitive Subset-based p := l p t l S1 S2 S2: t := new Cons p t l p t l S1 S2 *p := t p t S1,S2 l S1 S2 p := t p t l S1 S2

  21. Another example bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i := ...; } void foo(int* p) { printf(“%d”,*p); } 1 2 3 4

  22. Another example p bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i := ...; } void foo(int* p) { printf(“%d”,*p); } i i j i j 1 2 3 1 2 a a b a b 3 4 4 p p i j i,j a b a,b

  23. Steensgaard and beyond Well engineered implementation of Steensgaard: 2.1 MLOC in 1 minute (Word97) One Level Flow (Das PLDI 00) extension to Steensgaard achieves higher precision 2.1 MLOC in 2 minutes (Word 97)

More Related