4 Chaotic Iterations

Outline
Chaotic Iterations, Termination, Optimality,

Correctness, JOP vs. LFP
cs264
Ras Bodik
familiar constant propagation

mathematical background: posets and lattices
chaotic iterations
termination
precision
spring 2005
slides by Mooly Sagiv
2
A Simple Example Program
[xx0, yx0, zx0]

[xx0, yx0, zx3]
z=3
[xx0, yx0, zx0]

[xx0, yx0, zx3]
x=1
x=1
[xx1, yx0, zx3]
while (x > 0) (
while (x > 0) (
z=3
[xx1, yx0, zx3]

[xx1, yx0, zx3]
[xx1, yx7, zx3]
if (x = 1) then y = 7
else y = z + 4
x=3
print y
[xxS, yx0, zx3]

[xx1, yx7, zx3]
if (x = 1) then y = 7
else y = z + 4
[xx1, yx7, zx3]

[xx3, yx7, zx3]
x=3
print y
[xx3, yx7, zx3]
[xx1, yx7, zx3]

[xx3, yx7, zx3]
[xx3, yx7, zx3]
z=3
[xx0, yx0, zx0]

[xx0, yx0, zx3]
z=3
[xx0, yx0, zx0]

[xx0, yx0, zx3]
x=1
[xx1, yx0, zx3]
x=1
[xx1, yx0, zx3]
while (x > 0) (
[xxS, yx0, zx3]

[xxS, yx7, zx3]
while (x > 0) (
if (x = 1) then y = 7
else y = z + 4
x=3
print y
)
[xxS, yx0, zx3]

[xxS, yx7, zx3]
[xxS, yx7,zx3]
else y =z + 4
[xx1, yx7,zx3]
[xx3, yx7, zx3]
if (x = 1) then y = 7
[xx1, yx7, zx3]

[xx3, yx7, zx3]
x=3
print y
[xx3, yx7, zx3]
)
5
[xx3, yx7, zx3]

6
z=3
[xx0, yx0, zx0]

[xx0, yx0, zx3]
z=3
[xx0, yx0, zx0]

[xx0, yx0, zx3]
x=1
[xx1, yx0, zx3]
x=1
[xx1, yx0, zx3]
[xxS, yx0, zx3]

[xx1, yx7, zx3]
if (x = 1) then y = 7
[xxS, yx7,zx3]
else y =z + 4
[xxS, yx7,zx3]
[xx1, yx7,zx3]
x=3
[xx3, yx7, zx3]
while (x > 0) (
print y
)
[xxS, yx0, zx3]

[xx1, yx7, zx3]
while (x > 0) (
if (x = 1) then y = 7
else y =z + 4
[xxS, yx7,zx3]
[xxS, yx7,zx3]
[xx3, yx7, zx3]
x=3
print y
[xx3, yx7, zx3]
[xx3, yx7, zx3]
)
7
Computing Constants
Constructing CFG
Construct a control flow graph (CFG)

Associate transfer functions with control flow graph
edges
Iterate until a solution is found
The solution is unique
z =3
z=3
x =1
x=1
while (x > 0) (
while (x>0)
if (x = 1) then y = 7
But order of evaluation may affect the number of iterations
if (x=1)
else y =z + 4
x=3
y =7
print y
y =z+4
x=3
)
print y
Associating Transfer Functions
Iterative Computation
[xx0, yx0, zx0]
z =3
z =3
Pe.e[zx3]
Pe.e[zx3]
x =1
x =1
while (x>0)
Pe.e[xx1]
while (x>0)
Pe.e[xx1]
Pe. if x 0 then e
Pe. if x >0 then e
else z
else z
if (x=1)
Pe. e 6[xx1, y xS, zxS]
Pe.e y =7
Pe.e[yx7]
x=3
print y
Pe. if x 0 then e
10
else z
Pe. if x >0 then e
Pe.e[xx3]
11
Pe.e y =7
Pe.e[yx7]
z x=3
z
else z
else z
if (x=1)
y =z+4
Pe.e[yxe(z)+4]
Pe. if x 0 then e
print y
Pe. if x 0 then e
else z
y =z+4 z
Pe.e[yxe(z)+4]
Pe.e[xx3]
12
[xx0, yx0, zx0]
[xx0, yx0, zx0]
z =3
Pe.e[zx3]
[xx1, yx0, zx0]
z =3
Pe.e[zx3]
[xx0, yx0, zx3]
x =1
x =1
Pe.e[xx1]
z
while (x>0)
z
Pe. if x >0 then e
else z
Pe. if x 0 then e
Pe.e y =7
Pe.e[yx7]
z x=3
z
else z
else z
Pe.e[xx3]
print y
[xx0, yx0, zx0]

Pe.e[zx3]
Pe. if x >0 then e

Pe. if x 0 then e
Pe.e y =7
Pe.e[yx7]
z x=3
else z
else z
else z
Pe.e[zx3]
Pe.e[xx3]
print y
Pe. if x >0 then e
else z
else z
else z
y =z+4 z
Pe.e[yxe(z)+4]
Pe.e[xx3]
print y
16
[xx0, yx0, zx0]
z =3
Pe.e[zx3]
[xx0, yx0, zx3]
x =1
x =1
Pe.e[xx1]
[xx1, yx0, zx3] while (x>0)
Pe.e[xx1]
Pe. if x 0 then e
Pe. if x >0 then e
else z
else z
[xx1, yx0, zx3]
if (x=1)
[xx1, yx0, zx3]Pe.e y =7

Pe.e[yx7]
z x=3
z
Pe. if x 0 then e
Pe.e y =7
Pe.e[yx7]
z x=3
15
Pe. if x 0 then e
if (x=1)
y =z+4 z
Pe.e[yxe(z)+4]
Pe.e[zx3]
[xx1, yx0, zx3]
14
x =1
[xx1, yx0, zx3]
z =3
[xx0, yx0, zx3]
Pe.e[xx3]
[xx0, yx0, zx0]
else z
Pe.e[xx1]
Pe. if x 0 then e
if (x=1)
Pe. if x 0 then e
y =z+4 z
Pe.e[yxe(z)+4]
print y
Pe.e[xx1]
else z
z =3
[xx0, yx0, zx3]
x =1
else z
z =3
[xx0, yx0, zx3]
Pe. if x >0 then e
Pe.e y =7
Pe.e[yx7]
z x=3
13
Pe. if x 0 then e
if (x=1)
y =z+4 z
Pe.e[yxe(z)+4]
[xx0, yx0, zx0]
while (x>0)
if (x=1)
Pe.e[xx1]
Pe. if x 0 then e
print y
Pe. if x 0 then e
else z
Pe. if x >0 then e

Pe.e[yx7]
[xx1, yx7, zx3] x=3
Pe.e[xx3]
17
else z
else z
if (x=1)
y =z+4 z
Pe.e[yxe(z)+4]
Pe. if x 0 then e
print y
Pe. if x 0 then e
else z
y =z+4 z
Pe.e[yxe(z)+4]
Pe.e[xx3]
18
[xx0, yx0, zx0]
[xx0, yx0, zx3]
[xx0, yx0, zx0]
z =3
Pe.e[zx3]
[xx0, yx0, zx3]
x =1
z =3
Pe.e[zx3]
x =1
Pe.e[xx1]

[xx1, yx0, zx3]
Pe.e[xx1]
Pe. if x 0 then e
Pe. if x >0 then e
else z
[xxS, yx0, zx3] while (x>0)
else z
[xx1, yx0, zx3]
if (x=1)
Pe. if x 0 then e
Pe.e[yx7]
[xx1, yx7, zx3] x=3
else z
Pe.e[yx7]
19
[xx0, yx0, zx3]
[xx0, yx0, zx0]
z =3
Pe.e[zx3]
[xx0, yx0, zx3]
x =1
Pe. if x >0 then e

Pe. if x 0 then e
else z
z =3
Pe.e[zx3]
x =1
else z
[xxS, yx0, zx3]
else z
Pe. if x >0 then e

Pe. if x 0 then e
Pe.e[yx7]
[xx1, yx7, zx3] x=3
Pe.e[xx3]
21
else z
else z
else z
y =z+4 z
Pe.e[yxe(z)+4]
[xxS, yx0, zx3]Pe.e y =7
[xx3, yx7, zx3] print y
Pe. if x 0 then e
if (x=1)
y =z+4 z
Pe.e[yxe(z)+4]
Pe.e[yx7]
[xx1, yx7, zx3] x=3
Pe.e[xx3]
22
[xx0, yx0, zx0]
z =3
Pe.e[zx3]
[xx0, yx0, zx3]
x =1
z =3
Pe.e[zx3]
x =1
Pe.e[xx1]

[xxS, yx0, zx3]
20
Pe.e[xx1]
Pe. if x 0 then e
if (x=1)
[xx0, yx0, zx3]
Pe.e[xx3]
Pe.e[xx1]
[xx0, yx0, zx0]
else z

[xxS, yx0, zx3]
Pe. if x 0 then e
[xx1, yx7, zx3] x=3
Pe.e[xx3]
else z
y =z+4 z
Pe.e[yxe(z)+4]
[xx0, yx0, zx0]
Pe. if x >0 then e
else z
if (x=1)
y =z+4 z
Pe.e[yxe(z)+4]
Pe. if x 0 then e
Pe.e[xx1]
Pe. if x 0 then e
Pe. if x >0 then e
else z
else z
[xxS, yx0, zx3]
if (x=1)
[xxS, yx0, zx3]Pe.e y =7

Pe.e[yx7]
[xx1, yx7, zx3] x=3

Pe. if x 0 then e
else z
Pe. if x >0 then e
Pe.e[xx3]
23
else z
else z
if (x=1)
y =z+4 [xxS, yx0, zx3]

Pe.e[yxe(z)+4]
Pe. if x 0 then e

Pe.e[yx7]
[xxS, yx7, zx3] x=3

Pe. if x 0 then e
else z
y =z+4 [xxS, yx0, zx3]

Pe.e[yxe(z)+4]
Pe.e[xx3]
24
Posets
Mathematical Background
Declaratively define
A partial ordering is a binary relation
b : L % L {false, true}
The result of the analysis

The exact solution
Allow comparison
For all l c L : l b l (Reflexive)

For all l1, l2, l3 c L : l1 b l2, l2 b l3 l1 b l3
(Transitive)
For all l1, l2c L : l1 b l2, l2 b l1 l1 = l2
(Anti-Symmetric)
25
26
Upper and Lower Bounds
Posets
Denoted by (L, b )
In program analysis:
l1 b l2
l1 is more precise than l2
l1 represents fewer concrete states than l2
Examples
Consider a poset (L, b )

A subset L ` L has a lower bound l c L if for all
l c L : l b l
A subset L ` L has an upper bound u c L if for
all l c L : l b u
Total orders (N, )

Powersets (P(S), `)
Powersets (P(S), r)
Constant propagation
27
28
Complete Lattices
Bounds
A greatest lower bound of a subset L ` L is a lower
bound l0 cL such that l b l0 for any lower bound l of L
A lowest upper bound of a subset L ` L is an upper
bound u0 cL such that u0 b u for any upper bound u of L
For every subset L ` L:
A poset (L, b ) is a complete lattice if every

subset has least and upper bounds
L = (L, b) = (L, b, 7, 6, z, S)
z=7=6L
S=7L=6
Examples
The greatest lower bound of L is unique if at all exists
Total orders (N, )

Powersets (P(S), `)
Powersets (P(S), r)
6L (meet) a 6b
The lowest upper bound of L is unique if at all exists

7L (join) a7b
29
30
Complete Lattices
Cartesian Products
A complete lattice
(L1, b1) = (L1, b, 71, 61, z1, S1)
A complete lattice
(L2, b2) = (, b, 72, 62, z2, S2)
Define a Poset L = (L1 % L2 ,b ) where
Lemma For every poset (L, b ) the following

conditions are equivalent
L is a complete lattice
Every subset of L has a least upper bound
Every subset of L has a greatest lower bound
(x1, x2) b (y1, y2) if

x1 b y1 and
x2 b y 2
31
32
Finite Maps
Chains
A subset Y ` L in a poset (L, b ) is a chain if every two
elements in Y are ordered
A complete lattice
(L1, b1) = (L1, b, 71, 61, z1, S1)
A finite set V
Define a Poset L = (V L1 ,b ) where
For all l1, l2 c Y: l1 b l2 or l2 b l1
An ascending chain is a sequence of values

l1 b l2 b l3 b
A strictly ascending chain is a sequence of values
e1 b e2 if for all v V
l1 a l2 a l3a
e1v b e2v
A descending chain is a sequence of values

l1 t l2 t l3 t
A strictly descending chain is a sequence of values

l1 s l2 s l3 s
L has a finite height if every chain in L is finite

Lemma A poset (L, b ) has finite height if and only if every
strictly decreasing and strictly increasing chains are finite
33
34
Galois Connection
Monotone Functions
A poset (L, b )
A function f: L L is monotone if for every
Lattices C and A and functions : C A and : A C

The pair of functions (, ) form
Galois connection if
l1, l2 c L:
and are monotone

a A: ((a)) b a
c C: c b ((C))
l1 b l2 f(l1 ) b f(l2 )
Alternatively if:
c C . a A
(c) b a iff c b (a)
and uniquely determine each other
35
36
S
f(S)
Fixed Points
Chaotic Iterations
f2(S)
A monotone function f: L L where
Red(f)
(L, b, 7, 6, z, S) is a complete lattice
Fix(f) = { l: l c L, f(l) = l}
Red(f) = {l: l c L, f(l) b l}
Fix(f)
Ext(f) = {l: l c L, l b f(l)}
l1 b l2 f(l1 ) b f(l2 )
Tarskis Theorem 1955: if f is monotone then:
lfp(f) = 6 Fix(f) = 6 Red(f) c Fix(f)
gfp(f) = 7 Fix(f) = 7 Ext(f) c Fix(f)
Ext(f)
A lattice L = (L, b, 7, 6, z, S) with finite strictly increasing

chains
Ln = L % L % % L
A monotone function f: Ln Ln
Compute lfp(f)
The simultaneous least fixed of the system {x[i] = fi(x) : 1
i n }
gfp(f)
lfp(f)
x := (z, z, , z)
while (f(x) x ) do
f2(z)
x := f(x)
f(z)
z
38
Precision
Chaotic Iterations
Least fixed point gives us

for i :=1 to n do
x[i] = z
Minimum number of non-constant

Maximum number of z
WL = {1, 2, , n}
while (WL ) do
select and remove an element i c WL
new := fi(x)
if (new x[i]) then
x[i] := new;
Add all the indexes that directly depends on i to WL
39
40
Specialized Chaotic Iterations
WL
[xx0, yx0, zx0]

1
Chaotic(G(V, E): Graph, s: Node, L: Lattice, : L, f: E (L L) ){
z =3
Pe.e[zx3]
for each v in V to n do dfentry[v] := z
df[v] =
Pe. if x 0 then e
while (x>0)
while (WL ) do
select and remove an element u c WL
Pe. if x >0 then e

if (x=1)
for each v, such that. (u, v) E do

5
6
Pe.e y =7
temp = f(e)(dfentry[u])
new := dfentry(v)7 temp
Pe.e[yx7]
7
if (new dfentry[v]) then
41
else z
else z
Pe. if x 0 then e
y =z+4
Pe.e[yxe(z)+4]
x=3
dfentry[v] := new;
WL := WL {v}
{2}
df[2]:=[xx0, yx0, zx3]
{3}
df[3]:=[xx1, yx0, zx3]
x =1
Pe.e[xx1]
WL = {s}
dfentry[v]
{1}
Pe.e[xx3]
{4}
df[4]:=[xx1, yx0, zx3]
{5}
df[5]:=[xx1, yx0, zx3]
{7}
df[7]:=[xx1, yx7, zx3]
{8}
df[8]:=[xx3, yx7, zx3]
else z {3}
df[3]:=[xxS, yxS, zx3]
{4}
{5,6}
df[5]:=[xx1, yxS, zx3]
{6,7}
{7}
df[7]:=[xxS, yx7, zx3]
print y
Complexity of Chaotic Iterations
Specialized Chaotic Iterations: System of Equations
Parameters:
S=
dfentry[s] =
dfentry[v] = 7{f(u, v) (dfentry[u]) | (u, v) E }
n the number of CFG nodes

k is the maximum outdegree of edges
A lattice of height h
c is the maximum cost of
applying f(e)
7
L comparisons
FS:Ln Ln
FS (X)[s] =
FS(X)[v] = 7{f(u, v)(X[u]) | (u, v) E }
Complexity: O(n * h * c * k)
lfp(S) = lfp(FS)
43
44
Soundness, Completeness
The Abstract Interpretation Technique
Soundness:
The foundation of program analysis

Goals
Every detected constant is indeed such

Every error will be detected
The least fixed point contains all occurring runtime states
Establish soundness of (find faults in) a given program

analysis algorithm
Design new program analysis algorithms
Completeness:
The main ideas:
Every constant is indeed detected as such

Every detected error is real
Every state contained in the least fixed point is reachable for
some input
Relate each step in the algorithm to a step in a structural

operational semantics
Establish global correctness using a general theorem
Not limited to a particular form of analysis

45
Soundness in
Constant Propagation
46
Proof of Soundness
Define an appropriate structural operational semantics
Define collecting structural operational semantics
Establish a Galois connection between collecting states and
reaching definitions
(Local correctness) Show that the abstract interpretation of every
atomic statement is sound
w.r.t. the collecting semantics
(Global correctness) Conclude that the analysis is sound CC1976
Every detected constant is indeed such

May include fewer constants
May miss z
At every CFG node l
All constants in dfentry(l) are indeed constants
At every CFG node l dfentry(l) represents all the
possible concrete states arising when the structural
operational semantics reaches l
(lfp(S)[v, entry]) REACH[v, entry]

47
48
Structural Semantics for While
Structural Semantics for While if construct
[asssos] <x := a, s> s[x hAas]
axioms
[skipsos] <skip, s> s

[comp1sos] <S1 , s> <S1, s>
<S1; S2, s> < S1; S2, s>
rules
[ifttsos] <if b then S1 else S2, s> <S1, s>
if Bbs=tt
[ifffos] <if b then S1 else S2, s> <S2, s>
if Bbs=ff
[comp2sos] <S1 , s> s

<S1; S2, s> < S2, s>
49
50
Collecting Semantics
Structural Semantics for While while construct
The input state is not known at

compile-time
Collect all the states for all
possible inputs to the program
No lost of precision
[whilesos] <while b do S, s>

<if b then (S; while b do S) else skip, s>
51
52
Another Example
{[xx0, yx0, zx0]}

x= 0
z=3
{[xx0, yx0, zx3]}

x=1
{[xx1, yx0, zx3]}
while (x > 0) ( {[xx1, yx0, zx3], [xx3, yx0, zx3],}
while (true) do
x = x +1
if (x = 1) then y = 7
{[xx1, yx7, zx3], [xx3, yx7, zx3]}
else y = z + 4
x=3
{[xx1, yx7, zx3], [xx3, yx7, zx3]}
print y
{[xx3, yx7, zx3]}

{[xx3, yx7, zx3]}
53
54
Equations Generated for Collecting

Interpretation
An Iterative Definition
Equations for elementary statements
Generate a system of monotone equations

The least solution is well-defined
The least solution is the collecting interpretation
But may not be computable
[skip]
CSexit(1) = CSentry(l)
[b]
CSexit(1) = {: CSentry(l), b=tt}
[x := a]
CSexit(1) = {(s[x hAas]) | s CSentry(l)}
Equations for control flow constructs

CSentry(l) = CSexit(l) l immediately precedes l in
the control flow graph
55
An equation for the entry

CSentry(1) = { | Var* Z}
Specialized Chaotic Iterations

System of Equations (Collecting Semantics)
The Least Solution

2n sets of equations
CSentry(1), , CSentry (n), CSexit(1), , CSexit (n)
Can be written in vectorial form
S=
CSentry[s] ={0}
CSentry[v] = {f(e)(CSentry[u]) | (u, v) E }
CS = Fcs (CS)
where f(e) = X. {st(e) | X} for atomic statements
The least solution lfp(Fcs) is well-defined

Every component is minimal
Since Fcs is monotone such a solution always exists
CSentry(v) = {s|s0| <P, s0 > * (S, s)),
init(S)=v}
Simplify the soundness criteria
f(e) = X.{ | b(e) =tt }

FS:Ln Ln
Fs(X)[v] = {f(e)[u] | (u, v) E }
lfp(S) = lfp(FS)
57
Abstract (Conservative) interpretation
58
Abstract (Conservative) interpretation
Operational
semantics
Set of states
statement s
concretization
abstract
representation
statement s
Abstract
semantics
56
Operational
semantics
Set of states
` Set of states
Set of states
statement s
abstraction
concretization
abstract
representation
abstract
representation
59
Set of states
abstraction
statement s
Abstract
semantics
abstract
abstract
representation t representation
60
10
The Abstraction Function
The Concretization Function
Map collecting states into constants

The abstraction of an individual state
CP:[Var* Z] [Var* Z{z, S}]
CP() =
The abstraction of set of states
CP:P([Var* Z]) [Var* Z{z, S}]
CP (CS) = 7 { CP () | CS} = 7{| CS}
Soundness
CP (CSentry (v)) b dfentry(v)
Completeness
Map constants into collecting states

The formal meaning of constants
The concretization
CP: [Var* Z{z, S}] P([Var* Z])
CP (df) = {| CP () b df} = { | b df}
Soundness
CSentry (v) CP (dfentry(v))
Optimality
61
Galois Connection
62
Local Concrete Semantics
CP is monotone
CP is monotone
df [Var* Z{z, S}]
For every atomic statement S

S : [Var* Z] [Var* Z]
x := a] s = s[x hAas]
skip] s = s
CP( CP (df)) b df
c P([Var* Z])
For Boolean conditions
c CP b CP ( CP(C))
63
64
Local Soundness
Local Abstract Semantics
For every atomic statement S show one of the

following

S # :Var* L Var* L
x := a #(e) = e [x x a #(e)
skip # (e) = e
CP({S | CS }b S# ( CP(CS))
{S | CP (df)} CP (S# (df))
({S | CP (df)}) b S# (df)
For Booleans
The above condition implies global soundness

[Cousot & Cousot 1976]
(CSentry (l)) b dfentry(l)
CSentry (l) (dfentry(l))
65
66
11
Lemma 1
Assignments in constant propagation

Monotone
Consider a lattice L.
df1 b df2 x :=e#(df1 )b x :=e#(df2)
f: L L is monotone iff
for all X L: 7{f(z) | z X } b f(7{z | z X })
Local Soundness
({ x :=e | CS }b x :=e # ((CS))
67
Soundness Theorem(1)
68
1.
Let (, ) form Galois connection from C to A
1.
2.
f: C C be a monotone function
2.
3.
f# : A A be a monotone function
3.
4.
cC: (f(c)) b f#((c))
4.
aA: f((a)) b
(f#(a))
lfp(f) b (lfp(f#))
(lfp(f)) b lfp(f#)
(lfp(f)) b
lfp(f) b (lfp(f#))
lfp(f#)
69
1.
2.
3.
4.
aA: (f((a))) b f#(a)
70
Proof of Soundness (Summary)

Define an appropriate structural operational semantics
Define collecting structural operational semantics
Establish a Galois connection between collecting states
and reaching definitions
(Local correctness) Show that the abstract interpretation
of every atomic statement is sound
w.r.t. the collecting semantics
(Global correctness) Conclude that the analysis is sound
(lfp(f)) b lfp(f#)
lfp(f) b (lfp(f#))
71
72
12
Best (Conservative) interpretation
Induced Analysis (Relatively Optimal)

It is sometimes possible to show that a given analysis is
not only sound but optimal w.r.t. the chosen abstraction
Operational
semantics
Set of states
statement s
concretization
abstract
representation
statement s
Abstract
semantics
Set of states `
Set of states
abstraction
concretization
abstract
representation
but not necessarily optimal!
Define
S# (df) = ({S| (df)})
But this S# may not be computable
Derive (at compiler-generation time) an alternative form
for S#
A useful measure to decide if the abstraction must lead
to overly imprecise results
73
74
Example Dataflow Problem
Example: May-Be-Garbage
Formal available expression analysis

Find out which expressions are available at a given program point
Example program
x=y+t
z=y+r
while () {
t = t + (y + r)
}
Lattice
Galois connection
Basic statements
Soundness
A variable x may-be-garbage at a program point v if

there exists a execution path leading to v in which xs
value is unpredictable:
Was not assigned
Was assigned using an unpredictable expression
Lattice
Galois connection
Basic statements
Soundness
75
76
The PWhile Programming Language

Abstract Syntax
Points-To Analysis
Determine if a pointer variable p may point to
q on some path leading to a program point
a := x | *x | &x | n | a1 opa a2
Adapt other optimizations
b := true | false | not b | b1 opb b2 | a1 opr a2
x = 5; *p = 7 ; x
S := x := a | *x := a | skip | S1 ; S2 |
if b then S1 else S2 | while b do S
Pointer aliases
Variables p and q are may-aliases at v if the points-to set
at v contains entries (p, x) and (q, x)
Side-effect analysis
*p = *q + * * t
77
78
13
Concrete Semantics 1 for PWhile
Points-To Analysis
State1= [LocLocZ]
Lattice Lpt =
Galois connection

S : States1 States1
x := a ()=[loc(x) hAa ]
x := &y ()
x := *y ()
x := y ()
*x := y ()
79
Abstract Semantics for PWhile
80
Example
S #: P(Var* Var*) P(Var* Var*)
t := &a;
y := &b;
x := &y #
z := &c;
For
every atomic statement S
x := *y
x := y
if x> 0;
then p:= &y;
else p:= &z;
*x := y #
*p := t;
81
Example
82
Flow-insensitive points-to-analysis Steengard 96
/* */ t := &a; /* {(t, a)}*/

/* {(t, a)}*/ y := &b; /* {(t, a), (y, b) }*/
/* {(t, a), (y, b)}*/ z := &c; /* {(t, a), (y, b), (z, c) }*/
if x> 0;
then p:= &y; /* {(t, a), (y, b), (z, c), (p, y)}*/
Ignore control flow

One set of points-to per program
Can be represented as a directed graph
Conservative approximation
Accumulate pointers
Can be computed in almost linear time
else p:= &z; /* {(t, a), (y, b), (z, c), (p, z)}*/
/* {(t, a), (y, b), (z, c), (p, y), (p, z)}*/
*p := t;
/* {(t, a), (y, b), (y, c), (p, y), (p, z), (y, a), (z, a)}*/
83
84
14
Example
Precision
t := &a;
y := &b;
We cannot usually have
z := &c;
But can we say something about precision in all

programs?
(CS) = DF
on all programs
if x> 0;
then p:= &y;
else p:= &z;
*p := t;
85
86
The Join-Over-All-Paths (JOP)
JOP vs. Least Solution
Let paths(v) denote the potentially infinite set paths

from start to v (written as sequences of labels)
For a sequence of edges [e1, e2, , en] define
f [e1, e2, , en]: L L by composing the effects of basic
blocks
f [e1, e2, , en](l) = f(en) ( (f(e2) (f(e1) (l)) )
JOP[v] = 7{f[e1, e2, ,en]()
[e1, e2, , en] paths(v)}
The DF solution obtained by Chaotic iteration satisfies for

every l:
JOP[v]b DFentry(v)
A function f is additive (distributive) if

f(7{x| x X}) = 7{f(x) | X}
If every fl is additive (distributive) for all the nodes v

JOP[v] = DFentry(v)
87
88
Conclusions
Chaotic iterations is a powerful technique

Easy to implement
Rather precise
But expensive
More efficient methods exist for structured programs
Abstract interpretation relates runtime semantics and

static information
The concrete semantics serves as a tool in designing
abstractions
More intuition will be given in the sequel
89
15

4 Chaotic Iterations

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

4 Chaotic Iterations

Uploaded by

Copyright:

Available Formats

Outline

Chaotic Iterations, Termination, Optimality,

familiar constant propagation

A Simple Example Program

A Simple Example Program

[xx0, yx0, zx0]

[xx0, yx0, zx0]

[xx1, yx0, zx3]

[xx1, yx0, zx3]

[xxS, yx0, zx3]

[xx1, yx7, zx3]

[xx3, yx7, zx3]

[xx1, yx7, zx3]

A Simple Example Program

A Simple Example Program

[xx0, yx0, zx0]

[xx0, yx0, zx0]

[xx1, yx0, zx3]

[xx1, yx0, zx3]

[xxS, yx0, zx3]

[xxS, yx0, zx3]

[xx1, yx7, zx3]

[xx3, yx7, zx3]

[xx3, yx7, zx3]

A Simple Example Program

A Simple Example Program

[xx0, yx0, zx0]

[xx0, yx0, zx0]

[xx1, yx0, zx3]

[xx1, yx0, zx3]

[xxS, yx0, zx3]

[xxS, yx0, zx3]

[xx3, yx7, zx3]

[xx3, yx7, zx3]

Construct a control flow graph (CFG)

But order of evaluation may affect the number of iterations

Associating Transfer Functions

Pe. if x >0 then e

Pe. e 6[xx1, y xS, zxS]

[xx1, yx0, zx0]

[xx0, yx0, zx3]

Pe. if x >0 then e

[xx0, yx0, zx0]

Pe. if x >0 then e

Pe. e 6[xx1, y xS, zxS]

Pe. if x >0 then e

[xx0, yx0, zx3]

[xx1, yx0, zx3] while (x>0)

[xx1, yx0, zx3] while (x>0)

[xx1, yx0, zx3]

Pe. e 6[xx1, y xS, zxS]

[xx1, yx0, zx3]Pe.e y =7

Pe. e 6[xx1, y xS, zxS]

[xx1, yx0, zx3]

[xx1, yx0, zx3]

[xx0, yx0, zx3]

[xx1, yx0, zx3] while (x>0)

[xx1, yx0, zx3] while (x>0)

[xx0, yx0, zx3]

[xx0, yx0, zx3]

Pe. if x >0 then e

Pe. e 6[xx1, y xS, zxS]

Pe. e 6[xx1, y xS, zxS]

Pe. if x >0 then e