Static Single Assignment (SSA) Form

Jaeho Shin <netj@ropas.snu.ac.kr>

2005-03-11 16:00ROPAS Weekly Show & Tell

2/32

Outline

1. Preliminaries2. Concept and definition of SSA form3. Algorithm for computing SSA form4. Relation with

– functional programming– continuation passing style

5. Flow sensitivity of analyses with SSA

3/32

Preliminaries

• Control flow graph– predecessor, successor

• Dominators, strict dominators• Immediate dominator• Dominator tree

– parent, children

• Continuation passing style

4/32

Definition of SSA form

• Static Single Assignment Form is a transformed program– Whose variables are renamed

• e.g. x --> xi

– Having only one definition for each variable– Without changing the semantics of the

original program• i.e. every renamed variable xi of x must have

the same value for every possible control flow path

5/32

Why SSA form?

• More compact def-use chain• Control flow becomes explicit on

variable names• Improves performance of many data-

flow analyses

6/32

Example 1

a = x + yb = a - 1a = y + bb = x * 4a = a + b

a1 = x + yb1 = a1 - 1a2 = y + b1b2 = x * 4a3 = a2 + b2

It’s so easy! Isn’t it?

Well… not in general!

7/32

Example 2

o = 0e = 0i = 0while (i<100) if (i % 2 == 0) e = e + i else o = o + i i = i + 1print i, o, e

8/32

o = 0e = 0i = 0

if i < 100

e = e + i o = o + i

print i, o, e

if i % 2 == 0

i = i + 1

Example 2as a CFG

9/32

Example 2What’s the matter?

o1 = 0e1 = 0i1 = 0o2 = ?

e2 = ?i2 = ?if i2 < 100

e3 = e2 + i2

o3 = o2 + i2

print i2, o2, e2

if i2 % 2 == 0

i3 = i2 + 1

e3, o3, i3

e1, o1, i1

10/32

We need -function

• -function:– a function that is defined to magically choose t

he correct variable from incoming control flow edges

• But, where should we place ’s?

11/32

Example 2How about this?

o1 = 0e1 = 0i1 = 0

o2 = (o1,o7)e2 = (e1,e7)i2 = (i1,i7)if i2 < 100

o8 = (o2)e8 = (e2)i8 = (i2)print i8, o8, e8

o3 = (o2)e3 = (e2)i3 = (i2)if i3 % 2 == 0

o4 = (o3)e4 = (e3)i4 = (i3)e6 = e4 + i4

o5 = (o3)e5 = (e3)i5 = (i3)o6 = o5 + i5

o7 = (o4,o6)e7 = (e6,e5)i6 = (i4,i5)i7 = i6 + 1

12/32

Dominance Frontiers

• Dominance frontier of a CFG node X:– The set of all CFG nodes Y such that

X dominates a predecessor of Ybut does not strictly dominate Y

13/32

Dominance Frontiers (cont’d)

• Dominance frontiers of node X form the boundary between following nodes of X that X dominates and does not

X

Z

Y

nodes dominated by

X

dominance frontiers of X

W

14/32

Placing ’s at DF

• Definitions other than those in X may flow into Y, Z or W

• We need to place ’s for each variable defined in Xat the dominance frontiers of X

X

Z

Y

x = 1

x = 2

y = x * 2

W

a = x + 1

15/32

Example 2in minimal SSA form

o1 = 0e1 = 0i1 = 0

o2 = (o1,o4)e2 = (e1,e4)i2 = (i1,i3)if i2 < 100

e3 = e2 + i2 o3 = o2 + i2

print i2, o2, e2

if i2 % 2 == 0

o4 = (o2,o3)e4 = (e2,e3)i3 = i2 + 1

16/32

SSA form algorithm

• R. Cytron, et al. [1] presented an efficient algorithm computing SSA form using dominance frontiers– For each variable v

• Place -function for v at each nodes in DF+ of nodes defining vwhere DF+(S) = least fix point (T.DF(T) U S) {}

– Traversing the dominator tree in pre-order,for each node X using the parent’s last map(*)

• For each assignments in X– Rename used variables v --> vmap(v)

– Rename defined variables u --> ucount(u)

– replace map(u) = count(u) and count(u) = count(u) + 1• For each successor Y of X, and for each -function for v in Y

– Replace vmap(v) for corresponding argument

19/32

SSA is FP

• A. Appel [2] has shown converting to SSA is actually functional programming

• We can rewrite example 2 in a functional programming language

20/32

SSA is FPnumbering BBs in example 2

o1 = 0e1 = 0i1 = 0

o2 = (o1,o7)e2 = (e1,e7)i2 = (i1,i7)if i2 < 100

o8 = (o2)e8 = (e2)i8 = (i2)print i8, o8, e8

o3 = (o2)e3 = (e2)i3 = (i2)if i3 % 2 == 0

o4 = (o3)e4 = (e3)i4 = (i3)e6 = e4 + i4

o5 = (o3)e5 = (e3)i5 = (i3)o6 = o5 + i5

o7 = (o4,o6)e7 = (e6,e5)i6 = (i4,i5)i7 = i6 + 1

1

2

3

4

5

67

21/32

SSA is FPtranslating BBs into ftns

fun f1() = let val o1 = 0 and e1 = 0 and i1 =

0 in f2(o1, e1, i1)

fun f2(o2, e2, i2) = if i2 < 100 then f3(o2, e2, i2) else f7(o2, e2, i2)

fun f3(o3, e3, i3) = if i3 % 2 == 0 then f4(o3, e3, i3) else f5(o3, e3, i3)

fun f7(o8, e8, i8) = print(i8, o8, e8)

fun f4(o4, e4, i4) = let val e6 = e4 + i4 in f6(o4, e6, i4)

fun f5(o5, e5, i5) = let val o6 = o5 + i5 in f6(o6, e5, i5)

fun f6(o7, e7, i6) = let val i7 = i6 + 1 in f2(o7, e7, i7)

Still ugly, right?

22/32

SSA is FPmaking use of nested scopes

let val o1 = 0 and e1 = 0 and i1 = 0 fun f2(o2, e2, i2) = if i2 < 100 then let fun f6(o4, e4) = let val i3 = i2 + 1 in f2(o4, e4, i3) in if i2 % 2 == 0 then let val e3 = e2 + i2 in f6(o2, e3) else let val o3 = o2 + i2 in f6(o3, e2) else print(i2, o2, e2)in f2(o1, e1, i1)

• This is the SSA form of example 2!

• The algorithm for converting programs to SSA form can be used for nesting functions to eliminate unnecessary argument passing

23/32

Relation withcontinuation passing style

• R. Kelsey [3] claims that CPS can be written into SSA and vice versa

• SSA --> CPS is possible since SSA is FP• But, is CPS --> SSA generally possible?

• What’s the intuition?

24/32

Improving accuracy offlow-insensitive analyses

• Flow-insensitive analyses– Analysis which can’t distinguish control

flow

• SSA makes control flow soak into names of variables (however, with some limitations)

25/32

Example 3Set-based string analysis for C

char *s = “”;strcat(s, “begin ”);for (i=0; i<10; i++) { sprintf(tmp, “%d ”, i); strcat(s, tmp);}strcat(s, “end”);printf(s); What string does s have here?

26/32

Example 3Using intermediate language

s = “”;s = s @ “begin ”;for (i=0; i<10; i=i+1) { tmp = i @ “ ”; s = s @ tmp;}s = s @ “end”;printf(s); What string does s have here?

27/32

Example 3Derived set-constraints

{ Vs ⊇ “”, Vs ⊇ Vs @ “begin ”, Vi ⊇ 0, Vi ⊇ Vi + 1, Vtmp ⊇ Vi @ “ ”, Vs ⊇ Vs @ Vtmp, Vs ⊇ Vs @ “end”, X ⊇ Vprintf(Vs)}

• Vs ⊇ { “”, “begin ”, “begin 0”, “begin 0 1 2 3 4 5 6 7 8 9 end”, …, “end0 ”, “begin 100”, “endbegin ”, … }

• Vs which represents the set of strings that variable s may contain is too large

• Too inaccurate!

28/32

Example 3into SSA form

s1 = “”;s2 = s1 @ “begin ”;s3 = s2;for (i1=0, i2=i1; i2<10; i3=i2+1, i2 = i3) { tmp1 = i2 @ “ ”; s4 = s3 @ tmp1; s3 = s4;}s5 = s3 @ “end”;printf(s5); What string does s5 have?

29/32

Example 3Constraints from SSA form

{ Vs1 ⊇ “”, Vs2 ⊇ Vs1 @ “begin ”, Vs3 ⊇ Vs2, Vi1 ⊇ 0, Vi2 ⊇ Vi1, Vi3 ⊇ Vi2 + 1, Vi2 ⊇ Vi3, Vtmp1 ⊇ Vi2 @ “ ”, Vs4 ⊇ Vs3 @ Vtmp1, Vs3 ⊇ Vs4 Vs5 ⊇ Vs3 @ “end”, X ⊇ Vprintf(Vs5)}

Vtmp1 ⊇ { “0 ”,“1 ”,“2 ”, … }

Vs3 ⊇ { “begin ” } Vs3 @ Vtmp1Vs5 ⊇ Vs3 @ “end”

• Vs5 ⊇ { “begin end”, “begin 0 end”, “begin 0 1 2 3 4 5 6 7 8 9 end”, “begin 9 8 2 1 end”, “begin 100 10 37 end”, … }

• Better than before :-)

30/32

Problems for SSA form

• How should we handle– Global variables?– Arrays and pointers?

• We sometimes need to turn SSA form back to programs without -functions– Handling critical edges– Reducing redundant assignments

31/32

Conclusions

• SSA form is a transformed program where every variable has one definition

• Minimal SSA form can be computed with dominance frontiers

• With SSA form we can improve the accuracy of flow-insensitive analyses without modifying the analysis itself

• Converting to SSA form is similar to nesting functions in functional programs

32/32

References

[1] R. Cytron, et al., “An efficient method of computing static single assignment form”, POPL, 1989.

[2] A. Appel, “SSA is functional programming”, ACM SIGPLAN Notices, 1998.

[3] R. Kelsey, “A correspondence between continuation passing style and static single assignment form”, ACM SIGPLAN Notices, 1993.