formal methods program slicing & dataflow analysis february 2015
TRANSCRIPT
Formal Methods
Program Slicing & Dataflow Analysis
February 2015
Program Analysis
• Automatic analysis of a program
• Two main objectives– Correctness: program verification– Efficiency: code optimization (compilers)– Security: understand code vulnerabilities
• Two types of analysis– Static Analysis:
• do not execute program; reason over all inputs– Dynamic Analysis:
• Execute program; reason over specific input
Static Analysis
• Based upon source code analysis• Useful for: – Semantic Analysis of Programs
e.g. Type Inference, etc. – Optimizations and Transformations
e.g. Dataflow/Control-flow Analysis
– Program Verificatione.g. Dijkstra’s Weakest Precondition Methods
Dynamic Analysis
• Based upon one or more runs of the program on given inputs
• Useful for: – Performance Analysis – Dynamic Slicing – Program Debugging
Static Analysis Techniques
• Type Inference– Check or infer types for program expressions
• Data Flow Analysis – Analyze variable and other dependencies• Program Slicing
– Construct reduced program WRT variables of interest
• Model checking– Check temporal properties of programs
• Theorem proving– Use logical deduction to prove facts
References
Hiralal Agrawal and Joseph Horgan, Dynamic Program Slicing, ACM SIGPLAN Conf. on Programming Language Design and Implementation; also in SIGPLAN Notices, 25(6): 246-256, 1990
H. Agrawal, Richard A. DeMillo, Eugene H. Spafford: Dynamic Slicing in the Presence of Unconstrained Pointers. Proceedings of Symposium on Testing, Analysis, and Verification, 1991: 60-73
Frank Tip, A Survey on Program Slicing Techniques, Journal of Programming Languages, (3):121-189, 1995
Mark Weiser: Program Slicing. IEEE Transactions on Software Engineering. 10(4): 352-357 (1984)
Static and Dynamic Program
Slicing
Static Program Slicing
• Computing a reduced program with respect to a criterion: <stmt, vars>
• Helps understand dependencies in programs and helps program debugging
• Other applications: • software testing• software maintenance• parallelization
#define YES 1#define NO 0main() {
int c, nl, nw, nc, inword;inword = NO;nl = 0; nw = 0; nc = 0;c = getchar();while (c != EOF) {
nc = nc + 1;if (c == ‘\n’) nl = nl + 1;if (c == ‘ ‘ || c == ‘\n’ || c == ‘\t’) inword = NO;else if (inword == NO) {
inword = YES;nw = nw + 1;}
c = getchar();}
printf(“%d \n”, nl);printf(“%d \n”, nw);printf(“%d \n”, nc);}
Example: Char, Line, and Word Counter
while (c != EOF)
nc = nc + 1
if (c == ‘\n’)
if (c == ‘ ‘ || c == ‘\n’ || c == ‘\t’)
nl = nl + 1
if (inword == NO)
inword = YESnw = nw + 1
inword = NO; nl = 0; nw = 0; nc = 0;c = getchar();
TRUE
TRUE
TRUE
TRUE
printf(“%d \n”, nl);printf(“%d \n”, nw);printf(“%d \n”, nc);
inword == NO
c = getchar();
#define YES 1#define NO 0main() {
int c, nw, inword;inword = NO;nw = 0; c = getchar();while (c != EOF) {
if (c == ‘ ‘ || c == ‘\n’ || c == ‘\t’) inword = NO;else if (inword == NO) {
inword = YES;nw = nw + 1;}
c = getchar();}
printf(“%d \n”, nw);}
Program Slice: Word Counter
#define YES 1#define NO 0main() {
int c, nl;nl = 0; c = getchar();while (c != EOF) {
if (c == ‘\n’) nl = nl + 1;c = getchar();}
printf(“%d \n”, nl);}
Program Slice: Line Counter
#define YES 1#define NO 0main() {
int c, nc;nc = 0;c = getchar();while (c != EOF) {
nc = nc + 1;c = getchar();}
printf(“%d \n”, nc);}
Program Slice: Character Counter
Slicing OO Programs: Example
Ohm’s Lawclass component { attributes Real V, I, R; constraints V = I * R; constructor component(V1, I1, R1) { V = V1; I = I1; R = R1; }}
class parallel extends component {attributes component [ ] C; constraints forall X in C: (X.V = V); (sum X in C: X.I) = I; (sum X in C: 1/X.R) = 1/R; constructor parallel(P) { C = P; }}
Slice WRT Resistance
class parallel extends component {attributes component [ ] C; constraints forall X in C: (X.V = V); (sum X in C: X.I) = I; (sum X in C: 1/X.R) = 1/R; constructor parallel(P) { C = P; }}
class parallel extends component {attributes component [ ] C; constraints (sum X in C: 1/X.R) = 1/R; constructor parallel(P) { C = P; }}
Slice WRT Resistance
class component { attributes Real V, I, R; constraints V = I * R; constructor component(V1, I1, R1) { V = V1; I = I1; R = R1; }}
class component { attributes Real R; constraints
constructor component(R1) { R = R1; }}
Static Slicing Classification
• Forward vs Backward• Intra vs Inter Procedural• Procedural vs OO Languages
OO Slicing is a good topic for presentation.
Slicing is based upon Dataflow Analysis, and hence will examine this topic first.
Data Flow Analysis
• Compiler does data flow analysis for various reasons: detect common subexpressions, loop invariant operations, uninitialized variables, etc.
• Two forms of data flow analysis:– Forward Flow– Backward Flow
• Characterized by Data Flow Constraints
Examples of Data Flow Analysis
• Forward Flow– Reaching Definitions (U)– Available Expressions (ח)
• Backward Flow– Live Variables (U)– Very Busy Expressions (Π)
Summary of DF Analyses
Forward
Backward
ReachingDefinitions
Available Expressio
ns
Live Variables
Very BusyExpressio
ns
U (LFP) Π (GFP)
KILL(B) and GEN(B) sets
x := y + 1; z := w + x; v := z + u; x := x + v;
d1:d2:d3:d4:
B
KILL(B) = {d5} GEN(B) = {d2,d3,d4}
IN = { d5: v := 10; d6: y:= 20; d7: w := 30; d8: u := 40;}
KILL(B) eliminates each definition whose variable is re-assigned within B.
GEN(B) adds (the last) definition for each variable that is assigned in B.
Reaching Definitions
OUT(B) = (IN(B) – KILL(B)) U GEN(B)
B
… …
OUT(B)
IN(B)
IN(B) = U {OUT(P) | P B in the graph}
Illustrating the equations
x := y + 1; z := w + x; v := z + u; x := x + v;
d1:d2:d3:d4:
B
KILL(B) = {d5} GEN(B) = {d2,d3,d4}
IN = { d5: v := 10; d6: y:= 20; d7: w := 30; d8: u := 40;}
OUT(B) = IN(B) – KILL(B) U GEN(B)= {d2,d3,d4,d6,d7,d8}
Least Fixed Point
Theorem: Every Monotonic Function on a Finite Lattice has a Least Fixed Point.
For Reaching Definitions, the lattice of interest is P(S), the powerset of S, the set of all definition points, ordered by the ≤ (subset or equal) relation.
Note that S is finite.
The least upper bound and greatest lower bound are set union and set intersection respectively.
More on Monotonicity
• OUT(B) = (IN(B) – KILL(B)) U GEN(B)• U is monotonic in both arguments• X – Y is monotonic in X but not Y• Since KILL(B) is a constant for each B,
its use does not violate monotonicity
Fixed point iteration will converge only if the functions are monotonic. Note: The composition of monotonic functions is monotonic.
Example: Non-Monotonic Function
x = not(y)y = not(x)
Boolean Lattice: <{T,F}, F ≤ T, and, or>
There are two fixed points:
1. x = T, y = F2. x = F, y = T
No unique solution!
Sketch of Algorithm:Least Fixed Point Iteration
• Forall basic blocks B Do { IN(B) := {}; OUT(B) := GEN(B)
}• While no more changes Do {
Forall B Do { IN(B) := U { OUT(P) | P B in the
graph}; } Forall B Do {
OUT(B) := IN(B) – KILL(B) U GEN(B);
} }
Control Flow Graph
From Aho & Ullman, Principles of Compiler Design, 1977
KILL(B) and GEN(B)
{d1, d2}
{d3}
{d4}
{d5}
{}
{d3,d4,d5}
{d1}
{d2,d5}
{d2,d4}
{}
Initialize: IN(B) = {} and OUT(B) = GEN(B)
{d1, d2}
{d3}
{d4}
{d5}
{}
Iteration 1: IN(B) = U {OUT(P) | P B}
{d3}
{d1, d2}
{d3}
{d4}
{d4,d5}
OUT(B) = IN(B) – KILL(B) U GEN(B)
{d1, d2}
{d2, d3}
{d3, d4}
{d5}
{d4,d5}
IN(B) = U {OUT(P) | P B}
{d2,d3}
{d1, d2, d4, d5}
{d2, d3}
{d3, d4}
{d3, d4,d5}
Iteration 2:
OUT(B) = IN(B) – KILL(B) U GEN(B)
{d1,d2}
{d2,d3,d4,d5}
{d3,d4}
{d3,d5}
{d3,d4,d5}
IN(B) = U {OUT(P) | P B}
{d2,d3,d4,d5}
{d1,d2,d3,d4,d5}
{d2,d3,d4,d5}
{d3, d4}
{d3, d4,d5}
Iteration 3:
OUT(B) = IN(B) – KILL(B) U GEN(B)
{d1,d2}
{d2,d3,d4,d5}
{d3, d4}
{d3, d5}
{d3,d4,d5}
IN(B) = U {OUT(P) | P B}
{d2,d3,d4,d5}
{d1,d2,d3,d4,d5}
{d2,d3,d4,d5}
{d3,d4}
{d3,d4,d5}
Iteration 4:
OUT(B) = IN(B) – KILL(B) U GEN(B)
{d1,d2}
{d2,d3,d4,d5}
{d3, d4}
{d3, d5}
{d3,d4,d5}
Uses of Reaching Definitions
• Uninitialized Variables: Add a dummy ass’t for all variables at start of the program and check where they “reach”.
• Loop Invariant Operations: An expr ‘X op Y’ in a loop is invariant if all definitions for X and Y are outside the loop.
• Static Program Slicing: We will examine the technique in more detail in the next class.
Analysis is Approximate
From Aho & Ullman, Principles of Compiler Design, 1977
this statement will not ever be executed
A := 2 and A := 3 reach point p
Algorithm Efficiencies
• Can represent sets by bit vectors, so that U and Π become logical \/ and /\.
• The number of iterations bounded by number of nodes in graph.
• By visiting the nodes B1, …, Bk in “depth-first order” the number iterations can be minimized. In practice, the number <= 5.
(Reverse) Depth-first Traversal Order
TraversalSequence:
IN(B1)OUT(B1)
IN(B2)OUT(B2)
IN(B3)OUT(B3)
…
IN(B10)OUT(B10)
The path of “back edges”
10 7 4 3
determinesnumber
of iterations
Global Common Subexpressions
… … …
…
:= X * Y := X * Y:= X * Y
… …
p:= X * Y
X and Ydo not change
here
Global Common Subexpressions
… … …
…
T := X * Y T := X * YT := X * Y
… …
p:= T
X and Ydo not change
here
Available Expression
X op Y is said to be ‘available’ at a point p if every path from the start of the program to p evaluates X op Y and after the last such evaluation prior to p, there are no subsequent assignments to X or Y.
OUT(B) = (IN(B) – KILLe(B)) U GENe(B)
IN(B) = Π {OUT(P) | P B in the graph}
Algorithmic Sketch:Greatest Fixed Point
ComputationForall basic blocks B except initial block Do {
IN(B) := E (set of all exprs in program);
OUT(B) := E – KILLe(B) }While no more changes Do {
Forall B Do { IN(B) := Π { OUT(P) | P B in the graph}; } Forall B Do { OUT(B) := IN(B) – KILLe(B) U GENe(B); }
}
Greatest Fixed Point Iteration
Theorem: Every Monotonic Function on a Finite Lattice has a Greatest Fixed Point.
For Available Expressions, the lattice of interest here is the P(S), the powerset of S, the set of all expressions appearing in the program ordered by the ≤ (subset or equal) relation.
Note that S is finite.
The least upper bound and greatest lower bound are set union and intersection respectively.
Live Variables
A variable X is live at p if X will be referenced in some path starting from p to the end of the program
IN(B) = (OUT(B) – DEF(B)) U USE(B)
OUT(B) = U {IN(S) | B S in the graph}
DEF(B) = variables that are assigned in B before they are used
USE(B) = variables that are used in B before any assignment to them in B
Live Variable Analysis
• Example of a Backward Flow Analysis.• Useful in register
allocation/deallocation• The role of IN and OUT are reversed
compared with reaching definitions and available expressions
• This is a least fixed point iteration due to the use of the U in defining OUT(B).
Very Busy Expressions
X op Y is said to be ‘very busy’ at a point p if every path from p encounters X op Y before any assignment to X or Y.
DEF(B) = expressions X op Y in B in which X or Y is defined beforecomputing X op Y USE(B) = expressions X op Y in B in which neither X nor Y is defined beforecomputing X op Y
IN(B) = (OUT(B) – DEFvb(B)) U USEvb(B)
OUT(B) = Π {IN(P) | P B in the graph}
Code Hoisting• Very Busy expressions are useful
in “code hoisting”• Example of backward flow
analysis. p
A := B op C D := B op C
:= A := A := D := D
B and C do notchange here
After Code Hoisting
p
:= T := T := T := T
T := B op C
Assumes that B op C does not
Programming with Partial Orders and Lattices
Terms and Exprs
LUB and GLB are basic operations
Pattern Matching with Sets
Program Flow Analysis:Reaching Definitions
Program Flow Analysis:Very Busy Expressions
Note: E is the set of all expressions in the program being analyzed.
Conditional Clauses:Shortest Distance
Conditional Clauses:Shortest Distance
function short/total