Theoretical Abstractions in Data Flow Analysis
3.3 Data Flow Assignments
Given an instance of a data flow framework, the desired data flow information is represented by the values of data flow variables Innfor every node n. We define
†A more precise definition of Kill (X) would include all those pairs in X, one of whose components has a prefix that is must aliased to ∗x.
f1
f2 f3
f4
f5
d1 d2
d1� d2 d1� d2
(a) Example CFG (b) Merging information at a join node FIGURE 3.7
Example to illustrate MOP assignment value and fixed point assignment.
a data flow assignment (or simply assignment) as a mapping from each data flow variable Innto a data flow value.
3.3.1 Meet Over Paths Assignment
Let paths(p) denote the set of paths from Start to p. Given a path ρ ∈ paths(p) consisting of basic blocks (n1,n2. . .ni), let fρ denote the composition of functions corresponding to the blocks in ρ, i.e., fρ=fni−1◦ . . . ◦ f2◦ f1. If ρ is a path (n) con-sisting of a single block, fρis the identity function.
DEFINITION 3.19 An assignment represented by the values of data flow variables Inn is safe iff
∀n ∈ Nodes: Inn�
ρ ∈paths(n) fρ(BI) (3.6)
Observe that the informal definitions of analyses (2.1), (2.2) and (2.3) inChapter 2 have been given in terms of paths from Start to p.
DEFINITION 3.20 A Meet Over Paths assignment, denoted MOP , is the maximum safe assignment.
∀n ∈ Nodes: MOPn=
ρ ∈paths(n)fρ(BI) (3.7)
The existence of a MOP assignment follows from the closure and monotonicity properties of flow functions and the descending chain condition of the lattice of data flow values. A safe assignment is an approximation of the MOP assignment.
3.3.2 Fixed Point Assignment
Observe that the definition of the MOP assignment as the desired data flow informa-tion is a path-based definiinforma-tion whereas the data flow equainforma-tions such as (3.5) form an edge-based specification: Data flow information of a node is computed from the data flow information at the predecessors.
Example 3.9
Consider Figure 3.7(a). The data flow information at the beginning of node 5 can be characterized by the following equations.
In1=BI In2= f1(In1)
In3= f1(In1) � f3(In3) In4= f2(In2) � f3(In3) In5= f4(In4)
Unfolding the right hand side of In5 partially, we get:
f4( f2( f1(BI)) � ( f3( f1(BI) � f3(In3)))) (3.8) The expression, represented as a tree in Figure 3.8(a), gives an idea of the nature of the solution of the equations. The solution computed by data flow equations at p consider all paths to p starting from the Start block and computes the data flow information along all these paths. However it merges the information at join nodes as shown in part (b) of Figure 3.7 on the previous page. The data flow information d1 and d2 is merged at the join node and the merged information d1� d2is propagated along all edges beyond the join node.
In contrast, the computation of MOP assignment does not involve merging values at intermediate points as shown in part (b) of Figure 3.8 on the facing page.
As we shall see, merging is important for the existence of an algorithm for obtain-ing a solution. However it can also imply a potential loss of information.
To investigate whether the system of equations described by (3.5) have a solution, we first convert it into a single equation. The equations are of the form:
In1 = f1(In1, . . . ,InN) In2 = f2(In1, . . . ,InN)
. . .
InN = fN(In1, . . . ,InN)
where Ini∈ Li. Let the product lattice L1× L2× . . . LNbe denoted by→−
L . Observe the difference between fiand fi. fi∈ F: Li�→ Liis a flow function, whereas fi:→−
L �→ Li
f4
(a) Expression tree for MFP (b) Expression tree for MOP FIGURE 3.8
Unfoldings of In5.
is formed by composing flow functions and the meet operator. The system of simul-taneous equations can be rewritten as the single equation
−
A solution of Equation (3.9) represents the data flow information computed by solv-ing data flow equations.
DEFINITION 3.21 A fixed point of a function f : L �→ L is a value v ∈ L that satisfies f (v) = v.
A fixed point assignment is a solution of the data flow equations represented by (3.9). For a fixed point assignment FP , we denote the value of variable Innby FPn. The maximum fixed point assignment is a fixed point assignment MFP such that for any fixed point assignment FP ,
∀n ∈ Nodes: FPn�MFPn
3.3.3 Existence of Fixed Point Assignment
The set of all fixed points of f is denoted by fix( f ). We are interested in the existence and structure of fix(→−
f ) where→−
f is the function used for defining Equation (3.9). We
require→−
f to be monotonic; this in turn depends on the monotonicity of the flow functions in the data flow framework.
The desired properties of fix(→−
f ) follow from the Knaster-Tarski fixed point theo-rem which we present below in a general setting.
DEFINITION 3.22 Consider a monotonic function f : L �→ L. A value v ∈ Lis a reductive point of f iff f (v) � v. A value v is an extensive point of f iff f (v) � v.
The set of all reductive points of a function is denoted as red( f ) and the set of all extensive points of a function is denoted as ext( f ).
THEOREM 3.1 (Knaster-Tarski fixed point theorem)
Let f : L �→ L be a monotonic function on a complete lattice L. Then 1. red( f ) ∈ fix( f )and fix( f ) = red( f ).
2. ext( f ) ∈ fix( f )and fix( f ) = ext( f ).
3. fix( f ) is a complete lattice.
PROOF
1. Let red( f )be l. We first prove that l is a fixed point, i.e., f (l) = l. To show f (l) � l, consider any element x ∈ red( f ). Since l � x, f (l) � f (x) be-cause of monotonicity of f . Further, since x ∈ red( f ), f (x) � x. Therefore f(l) � x. Since x was an arbitrary element in red( f ), f (l) � l by Observa-tion 3.2.
We now show l � f (l). Interestingly, this can be derived from f (l) � l.
Because of monotonicity, f ( f (l)) � f (l). Thus f (l) is a reductive point of red( f ). Since l is red( f ), we have l � f (l).
Since fix( f ) ⊆ red( f ), red( f ) is a lower bound of fix( f ). Further, since red( f ) ∈ fix( f ), red( f ) = fix( f ).
2. Similar to 1.
3. Consider any arbitrary subset Y of fix( f ). It is enough to show that Y exists in fix( f ). Let X = {x | x � Y, x ∈ L}. Since L is a complete lattice, it is easy to see that X is a complete lattice with Yas the top element and the bottom of L as the bottom element of X. Now consider a restriction of f to X called f�. f� is a monotonic function on the complete lattice X. Clearly fix( f�) ⊆ fix( f ). Further, fix( f�) ⊆ X. Thus every fixed point of f� is weaker than Y. Since fix( f�) ⊆ fix( f ), Y is contained in fix( f ).
function to which MGmaps a node n is denoted as fn. The Start node is numbered 0. The rest of the nodes are arbitrarily ordered from 1 to N − 1.
Output:Ink,0 ≤ k ≤ N − 1 giving the output of the data flow analysis for each node.
Algorithm:
0 functiondfaMain() 1 { In0=BI
2 forall j, j � 0 do Inj=� 3 change = true
4 whilechange do 5 { change = false 6 for j =1 to N − 1 do
7 { temp =
p∈pred( j) fp(Inp) 8 iftemp � Injthen
9 { Inj=temp
10 change = true
11 }
12 }
13 }
14 } FIGURE 3.9
Round-robin iterative algorithm for computing MFP assignment for frameworks with a complete lattice.