static single assignment (ssa) form jaeho shin 2005-03-11 16:00 ropas weekly show & tell
Post on 14-Dec-2015
212 Views
Preview:
TRANSCRIPT
Static Single Assignment (SSA) Form
Jaeho Shin <netj@ropas.snu.ac.kr>
2005-03-11 16:00ROPAS Weekly Show & Tell
2/32
Outline
1. Preliminaries2. Concept and definition of SSA form3. Algorithm for computing SSA form4. Relation with
– functional programming– continuation passing style
5. Flow sensitivity of analyses with SSA
3/32
Preliminaries
• Control flow graph– predecessor, successor
• Dominators, strict dominators• Immediate dominator• Dominator tree
– parent, children
• Continuation passing style
4/32
Definition of SSA form
• Static Single Assignment Form is a transformed program– Whose variables are renamed
• e.g. x --> xi
– Having only one definition for each variable– Without changing the semantics of the
original program• i.e. every renamed variable xi of x must have
the same value for every possible control flow path
5/32
Why SSA form?
• More compact def-use chain• Control flow becomes explicit on
variable names• Improves performance of many data-
flow analyses
6/32
Example 1
a = x + yb = a - 1a = y + bb = x * 4a = a + b
a1 = x + yb1 = a1 - 1a2 = y + b1b2 = x * 4a3 = a2 + b2
It’s so easy! Isn’t it?
Well… not in general!
7/32
Example 2
o = 0e = 0i = 0while (i<100) if (i % 2 == 0) e = e + i else o = o + i i = i + 1print i, o, e
8/32
o = 0e = 0i = 0
if i < 100
e = e + i o = o + i
print i, o, e
if i % 2 == 0
i = i + 1
Example 2as a CFG
9/32
Example 2What’s the matter?
o1 = 0e1 = 0i1 = 0o2 = ?
e2 = ?i2 = ?if i2 < 100
e3 = e2 + i2
o3 = o2 + i2
print i2, o2, e2
if i2 % 2 == 0
i3 = i2 + 1
e3, o3, i3
e1, o1, i1
10/32
We need -function
• -function:– a function that is defined to magically choose t
he correct variable from incoming control flow edges
• But, where should we place ’s?
11/32
Example 2How about this?
o1 = 0e1 = 0i1 = 0
o2 = (o1,o7)e2 = (e1,e7)i2 = (i1,i7)if i2 < 100
o8 = (o2)e8 = (e2)i8 = (i2)print i8, o8, e8
o3 = (o2)e3 = (e2)i3 = (i2)if i3 % 2 == 0
o4 = (o3)e4 = (e3)i4 = (i3)e6 = e4 + i4
o5 = (o3)e5 = (e3)i5 = (i3)o6 = o5 + i5
o7 = (o4,o6)e7 = (e6,e5)i6 = (i4,i5)i7 = i6 + 1
12/32
Dominance Frontiers
• Dominance frontier of a CFG node X:– The set of all CFG nodes Y such that
X dominates a predecessor of Ybut does not strictly dominate Y
13/32
Dominance Frontiers (cont’d)
• Dominance frontiers of node X form the boundary between following nodes of X that X dominates and does not
X
Z
Y
nodes dominated by
X
dominance frontiers of X
W
14/32
Placing ’s at DF
• Definitions other than those in X may flow into Y, Z or W
• We need to place ’s for each variable defined in Xat the dominance frontiers of X
X
Z
Y
x = 1
x = 2
y = x * 2
W
a = x + 1
15/32
Example 2in minimal SSA form
o1 = 0e1 = 0i1 = 0
o2 = (o1,o4)e2 = (e1,e4)i2 = (i1,i3)if i2 < 100
e3 = e2 + i2 o3 = o2 + i2
print i2, o2, e2
if i2 % 2 == 0
o4 = (o2,o3)e4 = (e2,e3)i3 = i2 + 1
16/32
SSA form algorithm
• R. Cytron, et al. [1] presented an efficient algorithm computing SSA form using dominance frontiers– For each variable v
• Place -function for v at each nodes in DF+ of nodes defining vwhere DF+(S) = least fix point (T.DF(T) U S) {}
– Traversing the dominator tree in pre-order,for each node X using the parent’s last map(*)
• For each assignments in X– Rename used variables v --> vmap(v)
– Rename defined variables u --> ucount(u)
– replace map(u) = count(u) and count(u) = count(u) + 1• For each successor Y of X, and for each -function for v in Y
– Replace vmap(v) for corresponding argument
19/32
SSA is FP
• A. Appel [2] has shown converting to SSA is actually functional programming
• We can rewrite example 2 in a functional programming language
20/32
SSA is FPnumbering BBs in example 2
o1 = 0e1 = 0i1 = 0
o2 = (o1,o7)e2 = (e1,e7)i2 = (i1,i7)if i2 < 100
o8 = (o2)e8 = (e2)i8 = (i2)print i8, o8, e8
o3 = (o2)e3 = (e2)i3 = (i2)if i3 % 2 == 0
o4 = (o3)e4 = (e3)i4 = (i3)e6 = e4 + i4
o5 = (o3)e5 = (e3)i5 = (i3)o6 = o5 + i5
o7 = (o4,o6)e7 = (e6,e5)i6 = (i4,i5)i7 = i6 + 1
1
2
3
4
5
67
21/32
SSA is FPtranslating BBs into ftns
fun f1() = let val o1 = 0 and e1 = 0 and i1 =
0 in f2(o1, e1, i1)
fun f2(o2, e2, i2) = if i2 < 100 then f3(o2, e2, i2) else f7(o2, e2, i2)
fun f3(o3, e3, i3) = if i3 % 2 == 0 then f4(o3, e3, i3) else f5(o3, e3, i3)
fun f7(o8, e8, i8) = print(i8, o8, e8)
fun f4(o4, e4, i4) = let val e6 = e4 + i4 in f6(o4, e6, i4)
fun f5(o5, e5, i5) = let val o6 = o5 + i5 in f6(o6, e5, i5)
fun f6(o7, e7, i6) = let val i7 = i6 + 1 in f2(o7, e7, i7)
Still ugly, right?
22/32
SSA is FPmaking use of nested scopes
let val o1 = 0 and e1 = 0 and i1 = 0 fun f2(o2, e2, i2) = if i2 < 100 then let fun f6(o4, e4) = let val i3 = i2 + 1 in f2(o4, e4, i3) in if i2 % 2 == 0 then let val e3 = e2 + i2 in f6(o2, e3) else let val o3 = o2 + i2 in f6(o3, e2) else print(i2, o2, e2)in f2(o1, e1, i1)
• This is the SSA form of example 2!
• The algorithm for converting programs to SSA form can be used for nesting functions to eliminate unnecessary argument passing
23/32
Relation withcontinuation passing style
• R. Kelsey [3] claims that CPS can be written into SSA and vice versa
• SSA --> CPS is possible since SSA is FP• But, is CPS --> SSA generally possible?
• What’s the intuition?
24/32
Improving accuracy offlow-insensitive analyses
• Flow-insensitive analyses– Analysis which can’t distinguish control
flow
• SSA makes control flow soak into names of variables (however, with some limitations)
25/32
Example 3Set-based string analysis for C
char *s = “”;strcat(s, “begin ”);for (i=0; i<10; i++) { sprintf(tmp, “%d ”, i); strcat(s, tmp);}strcat(s, “end”);printf(s); What string does s have here?
26/32
Example 3Using intermediate language
s = “”;s = s @ “begin ”;for (i=0; i<10; i=i+1) { tmp = i @ “ ”; s = s @ tmp;}s = s @ “end”;printf(s); What string does s have here?
27/32
Example 3Derived set-constraints
{ Vs ⊇ “”, Vs ⊇ Vs @ “begin ”, Vi ⊇ 0, Vi ⊇ Vi + 1, Vtmp ⊇ Vi @ “ ”, Vs ⊇ Vs @ Vtmp, Vs ⊇ Vs @ “end”, X ⊇ Vprintf(Vs)}
• Vs ⊇ { “”, “begin ”, “begin 0”, “begin 0 1 2 3 4 5 6 7 8 9 end”, …, “end0 ”, “begin 100”, “endbegin ”, … }
• Vs which represents the set of strings that variable s may contain is too large
• Too inaccurate!
28/32
Example 3into SSA form
s1 = “”;s2 = s1 @ “begin ”;s3 = s2;for (i1=0, i2=i1; i2<10; i3=i2+1, i2 = i3) { tmp1 = i2 @ “ ”; s4 = s3 @ tmp1; s3 = s4;}s5 = s3 @ “end”;printf(s5); What string does s5 have?
29/32
Example 3Constraints from SSA form
{ Vs1 ⊇ “”, Vs2 ⊇ Vs1 @ “begin ”, Vs3 ⊇ Vs2, Vi1 ⊇ 0, Vi2 ⊇ Vi1, Vi3 ⊇ Vi2 + 1, Vi2 ⊇ Vi3, Vtmp1 ⊇ Vi2 @ “ ”, Vs4 ⊇ Vs3 @ Vtmp1, Vs3 ⊇ Vs4 Vs5 ⊇ Vs3 @ “end”, X ⊇ Vprintf(Vs5)}
Vtmp1 ⊇ { “0 ”,“1 ”,“2 ”, … }
Vs3 ⊇ { “begin ” } Vs3 @ Vtmp1Vs5 ⊇ Vs3 @ “end”
• Vs5 ⊇ { “begin end”, “begin 0 end”, “begin 0 1 2 3 4 5 6 7 8 9 end”, “begin 9 8 2 1 end”, “begin 100 10 37 end”, … }
• Better than before :-)
30/32
Problems for SSA form
• How should we handle– Global variables?– Arrays and pointers?
• We sometimes need to turn SSA form back to programs without -functions– Handling critical edges– Reducing redundant assignments
31/32
Conclusions
• SSA form is a transformed program where every variable has one definition
• Minimal SSA form can be computed with dominance frontiers
• With SSA form we can improve the accuracy of flow-insensitive analyses without modifying the analysis itself
• Converting to SSA form is similar to nesting functions in functional programs
32/32
References
[1] R. Cytron, et al., “An efficient method of computing static single assignment form”, POPL, 1989.
[2] A. Appel, “SSA is functional programming”, ACM SIGPLAN Notices, 1998.
[3] R. Kelsey, “A correspondence between continuation passing style and static single assignment form”, ACM SIGPLAN Notices, 1993.
top related