flow insensitivity and imprecision
DESCRIPTION
Flow insensitivity and imprecision. If you ignore flow, then you lose precision. main() { x := &y; ... x := &z; }. Flow insensitive analysis tells us that x may point to z here!. But, insensitivity may alleviate two bottlenecks: (1) space : mem exhausted by large programs - PowerPoint PPT PresentationTRANSCRIPT
![Page 1: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/1.jpg)
Flow insensitivity and imprecision
If you ignore flow, then you lose precision.
main() { x := &y;
...
x := &z;}
Flow insensitive analysis tells us that x may point to z here!
But, insensitivity may alleviate two bottlenecks:
(1) space : mem exhausted by large programs
(2) time : need speed for JIT or edit , compile loop
![Page 2: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/2.jpg)
Andersen’s : worst case complexity
*x = yx
a b c
y
d e f
x
a b c
y
d e f
Worst case:
N2 per statement
at least N3 for the whole program
Andersen’s is in fact O(N3)
![Page 3: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/3.jpg)
New idea: one successor per node
Each node can point to at most one “thing”.
“Thing” : everything a var may point to.
x
a,b,c
y
d,e,f
*x = yx
a,b,c
y
d,e,f
![Page 4: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/4.jpg)
x
*x = y
y
More general case for *x = y
![Page 5: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/5.jpg)
x
*x = y
y x y
More general case for *x = y
![Page 6: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/6.jpg)
x
*x = y
y x y x y
More general case for *x = y
![Page 7: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/7.jpg)
x
x = *y
y
Handling: x = *y
More general case for x = *y
![Page 8: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/8.jpg)
x
x = *y
y x y
Handling: x = *y
More general case for x = *y
![Page 9: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/9.jpg)
x
x = *y
y x y x y
Handling: x = *y
More general case for x = *y
![Page 10: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/10.jpg)
x
x = y
y
Handling: x = y
More general case for x = y
![Page 11: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/11.jpg)
x
x = y
y x y
Handling: x = y
More general case for x = y
![Page 12: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/12.jpg)
x
x = y
y x y x y
Handling: x = y
More general case for x = y
![Page 13: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/13.jpg)
x
x = y
y x y x y
Handling: x = y (what about y = x?)
More general case for x = y
![Page 14: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/14.jpg)
x
x = y
y x y x y
Handling: x = y (what about y = x?)
same result for y = x !
More general case for x = y
![Page 15: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/15.jpg)
x = &y
x y
Handling: x = &y
More general case for x = &y
![Page 16: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/16.jpg)
x = &y
x yx y
Handling: x = &y
More general case for x = &y
![Page 17: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/17.jpg)
x = &y
x y x
y,…
x y
Handling: x = &y
More general case for x = &y
![Page 18: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/18.jpg)
Our favorite example, once more!
S1: l := new Cons
p := l
S2: t := new Cons
*p := t
p := t
1
2
3
4
5
![Page 19: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/19.jpg)
Our favorite example, once more!
S1: l := new Cons
p := l
S2: t := new Cons
*p := t
p := t
l
S1
t
S2
p
l
S1
l
S1
p
l
S1
t
S2
p
l
S1,S2
tp
1
2
3
4
5
1 2
3
l
S1
t
S2
p
4
5
![Page 20: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/20.jpg)
Flow insensitive loss of precision
S1: l := new Cons
p := l
S2: t := new Cons
*p := t
p := t
l
t
S1
p
S2
l
t
S1
p
S2
l
t
S1
p
S2
l
t
S1
p
S2
Flow-sensitiveSubset-based
Flow-insensitiveSubset-based
l
t
S1
p
S2
l
S1,S2
tp
Flow-insensitiveUnification-based
![Page 21: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/21.jpg)
bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i := ...;}
void foo(int* p) { printf(“%d”,*p);}
1234
Another example
![Page 22: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/22.jpg)
bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i := ...;}
void foo(int* p) { printf(“%d”,*p);}
i
a
j
b
p
i
a
i
a
j
b
i
a
j
b
p
i,j
a,b
p
1234
1 2
Another example
4
3
![Page 23: Flow insensitivity and imprecision](https://reader036.vdocuments.us/reader036/viewer/2022062518/56814a79550346895db7907a/html5/thumbnails/23.jpg)
Steensgaard and beyond
Well engineered implementation of Steensgaard:
2.1 MLOC in 1 minute (Word97)
One Level Flow (Das PLDI 00)
extension to Steensgaard
achieves higher precision
2.1 MLOC in 2 minutes (Word 97)