Lecture 9: Interprocedural Analysis 17-355/17-655/17-819: Program Analysis Rohan Padhye and Jonathan Aldrich March 4, 2021 * Course materials developed with Claire Le Goues 1 (c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Lecture 9: InterproceduralAnalysis
17-355/17-655/17-819: Program AnalysisRohan Padhye and Jonathan Aldrich
March 4, 2021
* Course materials developed with Claire Le Goues
1(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Approach #1: Analyze functions independentlyโข Pretend function f() cannot see the source of function g()โข Simulates separate compilation and dynamic linking (e.g. C, Java)โข Create CFG for each function body and run intraprocedural analysisโข Q: What should be is ๐! and๐" ๐ฅ โ ๐(๐ฆ) and ๐" return ๐ฅ for zero
analysis?
7(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Approach #2: User-defined Annotations
9(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
@NonZero -> @NonZero
Approach #2: User-defined Annotations
10(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
@NonZero -> @NonZero @NonZero -> @NonZero
Error!
Approach #2: User-defined Annotations
11(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
@NonZero -> @NonZero @Any -> @NonZero
Error!
Approach #3: Interprocedural CFG
12(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
3:return๐ฆ
1:fun ๐๐๐ข๐๐๐(๐ฅ)
2:๐ฆ โ 2 โ ๐ฅ
4:fun ๐๐๐๐()
7:โฆ
5:๐ง โ 0
local
6:๐ค โ ๐๐๐ข๐๐๐(๐ง)returnw
call
๐! return ๐ฅ "#$ ๐ = ๐ง โ ๐ ๐ง ๐ง โ ๐บ๐๐๐๐๐๐ } โช {๐๐๐ก โ ๐(๐ฅ)}
๐! ๐ฅ โ ๐ ๐ฆ %&'(% ๐ = ๐ \ ( ๐ฅ โช ๐บ๐๐๐๐๐๐ )๐! ๐ฅ โ ๐ ๐ฆ '(%% ๐ = {๐๐๐๐๐๐ ๐ โ ๐ ๐ฆ }
Approach #3: Interprocedural CFG
13(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Exercise: What would be the result of zero analysis for this program on line 7 and at the end?
Approach #3: Interprocedural CFG
14(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
3:return๐ฆ
1:fun ๐๐๐ข๐๐๐(๐ฅ)
2:๐ฆ โ 2 โ ๐ฅ
4:fun ๐๐๐๐()
7:z:=10/w
5:๐ง โ 5
local
6:๐ค โ ๐๐๐ข๐๐๐(๐ง)returnw
call
8:๐ง โ 0
9:๐ค โ ๐๐๐ข๐๐๐(๐ง)call
10:โฆlocalreturnw
Problems with Interprocedural CFGโข Merges ( joins) information across call sites to same functionโข Loses precisionโข Models infeasible paths (call from one site and return to another)โข Can we โrememberโ where to return data-flow values?
15(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Context-Sensitive Analysis Example
17(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Key idea: Separate analyses for functions called in different โcontextsโ.
(โcontextโ = some statically definable condition)
Context-Sensitive Analysis Example
18(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Context ๐๐๐ ๐๐๐๐
Line 6 {x->N} {x->N, y->N}
Line 9 {x->Z} {x->Z, y->Z}
Context-Sensitive Analysis Example
19(c) 2021 J. Aldrich, C. Le Goues, R. Padhye
Context ๐๐๐ ๐๐๐๐
<main, T> T {w->Z, Z->Z}
<double, N> {x->N} {x->N, y->N}
<double, Z> {x->Z} {x->Z, y->Z}