flow control 97 - Cornell University · Open loop flow control Two phases to flow Call setup
Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is...
Transcript of Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is...
![Page 1: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/1.jpg)
Lecture 4. Control Flow Analysis
Wei Le
2014.10
![Page 2: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/2.jpg)
Research in General
I Identifying and defining problems is as important as finding asolution
I Formulate the problemI Why it is importantI Why the solution potentially worksI What are the tradeoffs
I Where to find important problems:I Internet of things: device is resource constrained, connected to the
InternetI Big dataI Obsolete data format
![Page 3: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/3.jpg)
Status Check
I Install Soot and LLVM
I Read the tutorial
I Try running some examples
I Start writing your own analysis
![Page 4: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/4.jpg)
SOOT and LLVM Exercise: Weeks 6-7 (Due Oct 10)Assignment
I Generate Callgraphs, CFGs, and Dependence Graphs for 2 programsof Java and 2 programs of C/C++
I Visualization using Dotty (recommended)
Deliverables
I Soot and LLVM code
I A report (within 2 page) on:I Your experience with SOOT and LLVM, what you like, what you
don’t like, how long it takes you to learn, what are the mostchallenges
I Data collected from the graph, see the following table.I Examples: part of the graph
benchmark size (LOC) node edge
![Page 5: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/5.jpg)
The History of Control Flow Analysis
I 1970, Frances Allen, Control Flow Analysis – CFG
I Turing award for pioneering contributions to the theory and practiceof optimizing compiler techniques, awarded 2006
![Page 6: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/6.jpg)
What is Control Flow Analysis (CFA)?
I Determining the execution order of program statements orinstructions
I Control flow graph (CFG) specifies all possible execution paths
I Important control flow constructs (program constructs important tocontrol flow)
I basic block: a basic block is a maximal sequence of consecutivestatements with a single entry point, a single exit point, and nointernal branches
I loopsI method calls: program analysis to identify the receiver of the
function calls – e.g., virtual functions, function pointers: abstractinterpretation, type systems and constraint solving
I exception handling
![Page 7: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/7.jpg)
What CFG implies?
I CFGs are commonly used to propagate information between nodes(Dataflow analysis)
I The existence of back edges / cycles in flow graphs indicates that wemay need to traverse the graph more than once:
I Iterative algorithms: when to stop? How quickly can we stop?
![Page 8: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/8.jpg)
Dominance
Node d of a CFG dominates node n if every path from the entry node ofthe graph to n passes through d , noted as d dom n
I Dom(n): the set of dominators of node n
I Every node dominates itself: n ∈ Dom(n)
I Node d strictly dominates n if d ∈ Dom(n) and d 6= n
I Dominance’ based loop recognition: entry of a loop dominates allnodes in the loop
I Each node n has a unique immediate dominator m which is the lastdominator of n on any path from the entry to n (m idom n), m 6= n
I The immediate dominator m of n is the strict dominator of n that isclosest to n
![Page 9: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/9.jpg)
Dominator Example
![Page 10: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/10.jpg)
Dominator Tree
![Page 11: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/11.jpg)
Post-Dominance
I Node d of a CFG post dominates node n if every path from n to theexit node passes through d (d pdom n)
I Pdom(n): the set of post dominators of node n
I Every node post dominates itself: n ∈ Pdom(n)
I Each node n has a unique immediate post dominator
![Page 12: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/12.jpg)
Post-Dominator Example
![Page 13: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/13.jpg)
Natural Loops
Use dominators to discover loops for optimization, implemented incurrent compiler optimizations
I A back edge is an edge a → b whose head b dominates its tail a.
I A loop must have a single entry point called header. This entry nodedominates all nodes in the loop.
I There must be a back edge that enters the loop header. Otherwise,it is not possible for the flow of control to return to the headerdirectly from the ”loop”.
I a natural loop consisting of all nodes x , where b dom x and there isa path from x to b not containing b
![Page 14: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/14.jpg)
Natural Loop Example
![Page 15: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/15.jpg)
Inner Loop
An inner loop is a loop that contains no other loops
I Good optimization candidate
I The inner loop of the previous example: 7,8,10
![Page 16: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/16.jpg)
Dynamic Dispatch problems
I Function pointers
I Object oriented languages
I Functional languages
Problem: which implementation of the function will be invoked at thecallsite
![Page 17: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/17.jpg)
Dynamic Dispatch Problems in C++
To which implementation the call f bound to? Dynamic dispatch: thebinding is determined at runtime, based on the input of the program andexecution paths.
![Page 18: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/18.jpg)
Compared to Static Dispatch
Static dispatch: the binding is determined at the compiler time.
![Page 19: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/19.jpg)
Function Pointers
Control flow analysis: determining dataflow or values of variables
![Page 20: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/20.jpg)
An Overview of Research
Between 1990-2000:
I Class hierarchy analysis (newly defined types) and rapid typeanalysis (RTA) (analyzing instantiation of the object) – resolve 71%virtual function calls [1]
I Theoretical framework for call graph constructions forobject-oriented programs [2]
I Pointer target tracking [4]
I Callgraph analysis [3]
I Variable type and declared type analysis [6] ...
![Page 21: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/21.jpg)
An Example - Class Hierarchy Analysis
![Page 22: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/22.jpg)
An Example - Rapid Type Analysis
![Page 23: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/23.jpg)
An Example - Variable Type Analysis
![Page 24: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/24.jpg)
Exceptional Handling: C++
![Page 25: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/25.jpg)
Exceptional Handling: Java
![Page 26: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/26.jpg)
Exceptional Handling: Java
![Page 27: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/27.jpg)
Frequency of Occurrence of Exception HandlingStatements in Java [5]
![Page 28: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/28.jpg)
Analysis and Testing Program With Exception HandlingConstructs [5]
![Page 29: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/29.jpg)
Analysis and Testing Program With Exception HandlingConstructs [5]
![Page 30: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/30.jpg)
![Page 31: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/31.jpg)
![Page 32: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/32.jpg)
David F. Bacon and Peter F. Sweeney.Fast static analysis of c++ virtual function calls.SIGPLAN Not., 31(10):324–341, October 1996.
David Grove, Greg DeFouw, Jeffrey Dean, and Craig Chambers.Call graph construction in object-oriented languages.In Proceedings of the 12th ACM SIGPLAN Conference onObject-oriented Programming, Systems, Languages, andApplications, OOPSLA ’97, pages 108–124, New York, NY, USA,1997. ACM.
Mary W. Hall and Ken Kennedy.Efficient call graph analysis.ACM Lett. Program. Lang. Syst., 1(3):227–242, September 1992.
Jon Loeliger, Robert Metzger, Mark Seligman, and Sean Stroud.Pointer target tracking—an empirical study.In Proceedings of the 1991 ACM/IEEE Conference onSupercomputing, Supercomputing ’91, pages 14–23, New York, NY,USA, 1991. ACM.
Saurabh Sinha and Mary Jean Harrold.Analysis and testing of programs with exception handling constructs.IEEE Trans. Softw. Eng., 26(9):849–871, September 2000.
![Page 33: Lecture 4. Control Flow Analysis - Iowa State Universityweile/cs641/4.ControlFlowAnalysis.pdfWhat is Control Flow Analysis (CFA)? I Determining the execution order of program statements](https://reader034.fdocuments.net/reader034/viewer/2022042911/5f43059e225f0e634759a260/html5/thumbnails/33.jpg)
Vijay Sundaresan, Laurie Hendren, Chrislain Razafimahefa, RajaVallee-Rai, Patrick Lam, Etienne Gagnon, and Charles Godin.Practical virtual method call resolution for java.SIGPLAN Not., 35(10):264–280, October 2000.