Calvin Lin The University of Texas at Austin Interprocedural Analysis Last time – Introduction to alias analysis Today – Interprocedural analysis March 4, 2015 Interprocedural Analysis 1 Motivation Procedural abstraction – Cornerstone of programming – Introduces barriers to analysis Example Example x = 5; void f(int x) foo(p); Does foo() { modify x? y = x+1; if (x) foo(); else bar(); } What is the calling . context of f()? f(0); f(1); March 4, 2015 Interprocedural Analysis 2 CS380 C Compilers 1 Calvin Lin The University of Texas at Austin Function Calls and Pointers Recall – Function calls can affect our points-to sets e.g., p1 = &x; p2 = &p1; ... {(p1x), (p2p1)} foo(); ??? Be conservative – Lose a lot of information March 4, 2015 Interprocedural Analysis 3 Interprocedural Analysis Goal – Avoid making conservative assumptions about the effects of procedures and the state at call sites Terminology int a, e; // Globals void foo(int &b, &c) // Formal parameters { b = c; } main() { int d; // Local variables foo(a, d); // Actual parameters } March 4, 2015 Interprocedural Analysis 4 CS380 C Compilers 2 Calvin Lin The University of Texas at Austin Interprocedural Analysis vs. Interprocedural Optimization Interprocedural analysis – Gather information across multiple procedures (typically across the entire program) – Use this information to improve intra-procedural analyses and optimization (e.g., CSE) Interprocedural optimizations – Optimizations that involve multiple procedures e.g., Inlining, procedure cloning, interprocedural register allocation – Optimizations that use interprocedural analysis March 4, 2015 Interprocedural Analysis 5 Dimensions of Interprocedural Analysis Flow-sensitive vs. flow-insensitive Context-sensitive vs. context-insensitive Path-sensitive vs. path-insensitive March 4, 2015 Interprocedural Analysis 6 CS380 C Compilers 3 Calvin Lin The University of Texas at Austin Flow Sensitivity Flow-sensitive analysis – Computes one answer for every program point – Requires iterative data-flow analysis or similar technique Flow-insensitive analysis – Ignores control flow – Computes one answer for every procedure – Faster but less accurate than flow-sensitive analysis March 4, 2015 Interprocedural Analysis 7 Flow Sensitivity Example Is x constant? Flow-sensitive analysis void f(int x) – Computes an answer at every program { point: x = 4; – x is 4 after the first assignment . – x is 5 after the second assignment x = 5; } Flow-insensitive analysis – Computes one answer for the entire procedure: – x is not constant Where have we seen examples of flow-insensitive analysis? – Address Taken pointer analysis March 4, 2015 Interprocedural Analysis 8 CS380 C Compilers 4 Calvin Lin The University of Texas at Austin Context Sensitivity Context-sensitive analysis – Re-analyzes callee for each caller – Also known as polyvariant analysis Context-insensitive analysis – Perform one analysis independent of callers – Also known as monovariant analysis March 4, 2015 Interprocedural Analysis 9 Context Sensitivity Example Is x constant? Context-sensitive analysis – Computes an answer for every callsite: a = id(4); b = id(5); – x is 4 in the first call 4 5 – x is 5 in the second call id(x) { return x; } Context-insensitive analysis – Computes one answer for all callsites: – x is not constant – Suffers from unrealizable paths: a = id(4); b = id(5); – Can mistakenly conclude that 4,5 4,5 id(4) can return 5 because we id(x) { return x; } merge (smear) information from all callsites March 4, 2015 Interprocedural Analysis 10 CS380 C Compilers 5 Calvin Lin The University of Texas at Austin Path Sensitivity Path-sensitive analysis – Computes one answer for every execution path – Subsumes flow-sensitivity and context-sensitivity – Extremely expensive Path-insensitive – Not path-sensitive March 4, 2015 Interprocedural Analysis 11 Path Sensitivity Example Is x constant? Path-sensitive analysis if (x==0) – Computes an answer for every path: – x is 4 at the end of the left path – x is 5 at the end of the right path x = 4; x = 5; Path-insensitive analysis 4 5 – Computes one answer for all paths: print(x) – x is not constant March 4, 2015 Interprocedural Analysis 12 CS380 C Compilers 6 Calvin Lin The University of Texas at Austin Dimensions of Interprocedural Analysis (cont) Flow-insensitive context-insensitive (FICI) int** foo(int **p, **q) { int **x; p {b, d} x = p; . q {f, g} x = q; x {b, d, f, g} return x; } int main() a b d f g { { , , , } int **a, *b, *d, *f, b {c, e} c, e; d {c, e} a = foo(&b, &f); f {c, e} *a = &c; a = foo(&d, &g); g {c, e} *a = &e; } March 4, 2015 Interprocedural Analysis 13 Dimensions of Interprocedural Analysis (cont) Flow-sensitive context-insensitive (FSCI) int** foo(int **p, **q) { int **x; FICI FSCI p {b, d} p {b, d} x = p; . q {f, g} q {f, g} x = q; x {b, d, f, g} x {b, d} return x; 1 } x2 {f, g} int main() a b d f g a f g { { , , , } 1 { , } int **a, *b, *d, *f, b {c, e} a2 {f, g} c, e; d {c, e} f1 {c} a = foo(&b, &f); f {c, e} g {c} *a = &c; 1 a = foo(&d, &g); g {c, e} f2 {c, e} Weak update *a = &e; g {c, e} } 2 March 4, 2015 Interprocedural Analysis 14 CS380 C Compilers 7 Calvin Lin The University of Texas at Austin Interprocedural Analysis: Supergraphs Compose the CFGs for all procedures via the call graph – Connect call nodes to entry nodes of callees x=3 – Connect return nodes of callees back to calls foo() – Called control-flow supergraph foo(x) y=x+1 . foo(1) Pros return – Simple – Intraprocedural analysis algorithms work unchanged – Reasonably effective March 4, 2015 Interprocedural Analysis 15 Monday’s Example Revisited { foo (int *p) int x, y, a; { int *p; return p; } p = &a; x = 5; Is x constant? foo(&x); – With a supergraph, run our same IDFA y = x + 1; algorithm } – Determine that x = 5 March 4, 2015 Interprocedural Analysis 16 CS380 C Compilers 8 Calvin Lin The University of Texas at Austin Supergraphs (cont) Compose the CFGs for all procedures via the call graph – Connect call nodes to entry nodes of callees x=3 – Connect return nodes of callees back to calls foo() – Called control-flow supergraph foo(x) y=x+1 . foo(1) return Cons – Accuracy? Smears information from different contexts. – Performance? IDFA is O(n4), graphs can be huge – No separate compilation IDFA converges in d+2 iterations, where d is the Number of nested loops [Kam & Ullman ’76]. Graphs will have many cycles (one per callsite) March 4, 2015 Interprocedural Analysis 17 Brute Force: Full Context-Sensitive Interprocedural Analysis Invocation Graph [Emami94] – Use an invocation graph, which distinguishes all calling chains – Re-analyze callee for each distinct calling paths void foo(int b) main Pros { hoo(b); } – Precise void goo(int c) foo goo { hoo(c); } Cons – Exponentially expensive main() – Recursion is tricky { hoo hoo int x, y; foo(x); goo(y); } March 4, 2015 Interprocedural Analysis 18 CS380 C Compilers 9 Calvin Lin The University of Texas at Austin Middle Ground: Use Call Graph and Compute Summaries 1 procedure f() 2 begin Goal f 3 call g() – Represent procedure 4 call g() 3,4 5 5 call h() call relationships 9 6 end g h 7 procedure g() 8 begin 10 9 call h() 20 10 call i() 11 end i j 21 12 procedure h() Definition 13 begin – If program P consists of n procedures: p , . ., p 14 end 1 n 15 procedure i() – Static call graph of P is GP = (N,S,E,r) 16 procedure j() – N = {p , . ., p } 17 begin 1 n 18 end – S = {call-site labels} 19 begin – E N N S 20 call g() 21 call j() – r N is start node 22 end March 4, 2015 Interprocedural Analysis 19 Interprocedural Analysis: Summaries Compute summary information for each procedure – Summarize effect of called procedure for callers – Summarize effect of callers for called procedure Store summaries in database – Use later when optimizing procedures Pros – Concise – Can be fast to compute and use – Separate compilation practical Cons – Imprecise if there’s only have one summary per procedure March 4, 2015 Interprocedural Analysis 20 CS380 C Compilers 10 Calvin Lin The University of Texas at Austin Two Types of Information Track information that flows into a procedure – Sometimes known as propagation problems e.g., What formals are constant? e.g., Which formals are aliased to globals? – Useful for optimizing the body of a procedure proc (x,y) { Track information that flows out of a procedure . } – Sometimes known as side effect problems e.g., Which globals are def’d/used by a procedure? e.g., Which locals are def’d/used by a procedure? e.g., Which actual parameters are def’d by a procedure? – Useful for optimizing the code that calls a procedure March 4, 2015 Interprocedural Analysis 21 Examples Propagation Summaries – May-Alias: The set of formals that may be aliased to globals and to each other – Must-Alias: The set of formals that are definitely aliased to globals and to each other – Constant: The set of formals that have constant value Side-effect Summaries – Mod: The set of variables possibly modified (defined) by a call to a procedure – Ref: The set of variables possibly read by a call to a procedure – Kill: The set of variables that are definitely killed by a procedure (e.g., in the liveness sense) March 4, 2015 Interprocedural Analysis 22 CS380 C Compilers 11 Calvin Lin The University of Texas at Austin Computing Interprocedural Summaries Top-down – Summarize information about the caller (May-Alias, Must-Alias) – Use this information inside the procedure body int a; void foo(int &b, &c){ . } foo(a,a); Bottom-up – Summarize the effects of a call (Mod, Ref, Kill)