180 likes | 310 Views
CS 795: Code Analysis Techniques. Slide Set 1 C. M. Overstreet Old Dominion University For CS 488, Fall 2007. Course objectives. At end of course, you will understand how analysis of source code can be used in several aspects of computing/ software engineering: What’s feasible, what isn’t
E N D
CS 795: Code Analysis Techniques Slide Set 1 C. M. Overstreet Old Dominion University For CS 488, Fall 2007
Course objectives • At end of course, you will understand how analysis of source code can be used in several aspects of computing/ software engineering: • What’s feasible, what isn’t • Basic algorithms • Basic problems • Basic application areas
Lecture overview • Some motivation for code analysis • Some examples: some easy, some hard, some impossible • Some examples of where used • Assignment -- but not for CS 488
Example 1: elimination of infinite loops • Infinite loops are usually undesirable (but often not. Why?) • Can you write a program that checks another program for infinite loops? • Initial idea: just consider while loops: • Check loop body to see if any action modifies some loop control variables. • Does this work? • If no change, is loop infinite? • What if change is conditional? • Can one always do this? How? What about input data?
Example 1 (cont.) • Point: often partial solutions can be useful even if a general solution does not exist. • Question: What is the Halting Problem and why is it important?
Static & Dynamic Analysis • From their beginning, compilers have tried to optimize code. • Done by static analysis • Figure things out by analyzing source code • In UNIX, lint is a very early static code analyzer • Many types of useful information about code itself can only be obtained by running to code and monitoring its behaviors. • This is dynamic analysis
Example 3: uninitialized variables • Uninitialized variables are usually undesirable. • Should compilers make them illegal? • Can compilers make them illegal? • Can you write a program which detects uninitialized variables? Some? All? • Always? Sometimes? • Using static analysis? • i.e., uninitialized vars detected at compile time • Using dynamic analysis? • i.e. uninitialized vars detected at run time
Key application area: Compiler optimization • Oldest application area • Crucial concern of compiler writers when the first compiler was written • What was the first compiler? What language did it compile? • When? • Standard techniques (from 1954): for loops • Eliminate common subexpressions • if a*b occurs more than once, don’t evaluate it twice • Move code out of loop if possible • j = 3*x + 2*y need not be always be recomputed with each loop iteration • Make subscript evaluation more efficient • do an inc rather than a multiply • Usually only worry about loops. Why?
Compiler (cont.) • What’s hard about: • Common subexpression elimination? • Code motion? • Subscript simplification? • Several things: • Need to know nothing else changes the variables of interest • Problem significantly reduced if ftn calls are not present • Within an expression (order of expression eval?) • With loop body • With (or without) ftn calls, alias problem
The Alias Problem - 1 • For several things we discuss, this is a problem. • An alias exists between two or more variables when the same memory location can be accessed with each variable. The variables then are said to be aliased. • Multiple names for the same thing/place. • Some programming languages explicitly allow the programmer to give two different names to the same memory location. (Why?) • Tricky problem; the existence of aliases may depend on the loader rather than the compiler. Why? • Some aliases are easily detected, some not. • Sometimes code logic relies on aliases.
The Alias Problem - 2 • How introduced? • Pointers • Array subscripts: • a[ i ] = x; a[ j ] = y; // does i == j? • a[ a[ i ] ] = x; a[ f[ j ] ] = y; // how hard to detect alias? • Parameters • what’s the difference in “call by name” and “call by value”? • Run-time stack when functions are called with uninitialized local variables • ...
Why Worry about Aliases? • Some of the analyses we’re interested in depends on how variables change values. • Two different dead code definitions: • Code never executed (how can this happen?) • Code whose execution has no external effect (except speed). • Dead code is not always undesirable. Why? • Example: x = 0; y = f[ a, b, c ]; cin >> x; • Is the first statement dead? • If so, it is said to be killed by the cin statement.
Back to loop analysis -1 • To move a statement from inside to outside a loop, we need to check that “key” values are not changed with each loop iteration. • Example: a statement like “x=a+b” inside a loop can sometimes be moved outside a loop if neither a nor b are reassigned in the loop. • True or False? • Does it depend on how x is referenced in the loop? • Byte war story!
Back to loop analysis - 2 • Why can aliases cause problems with code motion? • Why can aliases cause problems with common subexpression elimination? • Why can aliases cause problems with subscript analysis?
Another example: side effects of function calls • Consider the statement: x = f[a,b] + a + g[a,c]; (assume this isn’t C or C++) • What if f calls a function with a side-effect? • Considered to be a dangerous statement. "Careful" programmers avoid this type of coding. • Why? • What if a is passed to f by address? • What if c is global to f and may be changed by f • I've used an language that, if requested, makes no distinction between array refs and function calls. Why might this be useful?
Parameter passing and aliases • Consider a ftn which modifies globals. What if that global is also passed as a parameter to the function? • What if the same variable occurs more than once in a function call’s parameter list?
Program Slice • Program slice: • Pick a variable and a particular statement in a program • Generate a subset of that program that produces exactly the same value for that variable in that statement. • This is called a slice • Assertion: programmers use slices when debugging. • See Weiser’s IEEE SE Program Slicing paper, July 1984.
Searching for papers - demo • www.acm.org, search for papers • program slice • alias problem • control flow graph • parse tree