Flow insensitivity and imprecision If you ignore flow, then you lose precision. main() { x := &y; ... x := &z; } Flow insensitive analysis tells us that x may point to z here! But, insensitivity may alleviate two bottlenecks: (1) space : mem exhausted by large programs
23
Embed
Flow insensitivity and imprecision If you ignore flow, then you lose precision. main() { x := &y;... x := &z; } Flow insensitive analysis tells us that.
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Flow insensitivity and imprecision
If you ignore flow, then you lose precision.
main() { x := &y;
...
x := &z;}
Flow insensitive analysis tells us that x may point to z here!
But, insensitivity may alleviate two bottlenecks:
(1) space : mem exhausted by large programs
(2) time : need speed for JIT or edit , compile loop
Andersen’s : worst case complexity
*x = yx
a b c
y
d e f
x
a b c
y
d e f
Worst case:
N2 per statement
at least N3 for the whole program
Andersen’s is in fact O(N3)
New idea: one successor per node
Each node can point to at most one “thing”.
“Thing” : everything a var may point to.
x
a,b,c
y
d,e,f
*x = yx
a,b,c
y
d,e,f
x
*x = y
y
More general case for *x = y
x
*x = y
y x y
More general case for *x = y
x
*x = y
y x y x y
More general case for *x = y
x
x = *y
y
Handling: x = *y
More general case for x = *y
x
x = *y
y x y
Handling: x = *y
More general case for x = *y
x
x = *y
y x y x y
Handling: x = *y
More general case for x = *y
x
x = y
y
Handling: x = y
More general case for x = y
x
x = y
y x y
Handling: x = y
More general case for x = y
x
x = y
y x y x y
Handling: x = y
More general case for x = y
x
x = y
y x y x y
Handling: x = y (what about y = x?)
More general case for x = y
x
x = y
y x y x y
Handling: x = y (what about y = x?)
same result for y = x !
More general case for x = y
x = &y
x y
Handling: x = &y
More general case for x = &y
x = &y
x yx y
Handling: x = &y
More general case for x = &y
x = &y
x y x
y,…
x y
Handling: x = &y
More general case for x = &y
Our favorite example, once more!
S1: l := new Cons
p := l
S2: t := new Cons
*p := t
p := t
1
2
3
4
5
Our favorite example, once more!
S1: l := new Cons
p := l
S2: t := new Cons
*p := t
p := t
l
S1
t
S2
p
l
S1
l
S1
p
l
S1
t
S2
p
l
S1,S2
tp
1
2
3
4
5
1 2
3
l
S1
t
S2
p
4
5
Flow insensitive loss of precision
S1: l := new Cons
p := l
S2: t := new Cons
*p := t
p := t
l
t
S1
p
S2
l
t
S1
p
S2
l
t
S1
p
S2
l
t
S1
p
S2
Flow-sensitiveSubset-based
Flow-insensitiveSubset-based
l
t
S1
p
S2
l
S1,S2
tp
Flow-insensitiveUnification-based
bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i := ...;}
void foo(int* p) { printf(“%d”,*p);}
1234
Another example
bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i := ...;}