Alias Analysis Aliasing Last time What is aliasing? – Midterm – When two expressions denote the same mutable memory location – e.g., p = new Object; Today q = p; ⇒ * p and * q alias – Alias analysis (pointer analysis) How do aliases arise? Next time – Pointers – More alias analysis (pointer analysis) – Call by reference (parameters can alias each other or non-locals) – Array indexing – C union , Pascal variant records, Fortran EQUIVALENCE and COMMON blocks CS553 Lecture Alias Analysis I 2 CS553 Lecture Alias Analysis I 3 Aliasing Examples What Can Alias? Pointers ( e.g., in C) Stack storage and globals *p and i alias void fun(int p1) { int *p, i; do i, j, or temp alias? p = &i; int i, j, temp; ... } Parameter passing by reference ( e.g., in Pascal) Heap allocated objects procedure proc1(var a:integer; var b:integer); do n and n->next alias? . . . n = new Node; a and b alias in body of proc1 proc1(x,x); n->data = x; proc1(x,glob); n->next = new Node; b and glob alias in body of proc1 ... Array indexing ( e.g., in C) int i,j, a[128]; i = j; a[i] and a[j] alias CS553 Lecture Alias Analysis I 4 CS553 Lecture Alias Analysis I 5 1
What Can Alias? (cont) Alias Analysis Arrays Goal: Statically identify aliases do b[c[i 1 ]] and – Can memory reference m and n access the same state at program point p? for (i=1; i<=n; i++) { b[c[i 2 ]] alias for any two – What program state can memory reference m access? b[c[i]] = a[i]; interations i 1 and i 2 ? } Why is alias analysis important? – Many analyses need to know what storage is read and written Can c[i 1 ] and c[i 2 ] alias? e.g., available expressions (CSE) *p = a + b; If *p aliases a or b , the second y = a + b; expression is not redundant (CSE fails) Fortran Java – e.g., Reaching definitions (constant propagation) c 7 1 4 2 3 1 9 0 c d 1 : x = 3; d 2 : *p = 4; If *p aliases x, d 2 reaches this point; d 3 : y = x; otherwise, both d 1 and d 2 reach Otherwise we must be very conservative CS553 Lecture Alias Analysis I 6 CS553 Lecture Alias Analysis I 7 How hard is this problem? Trivial Alias Analyses Easiest approach Undecidable – Assume that nothing must alias – Landi 1992 – Assume that everything may alias everything else – Ramalingan 1994 – Yuck! Address taken: A slightly better approach (for C) All solutions are conservative approximations – Assume that nothing must alias – Assume that all pointer dereferences may alias each other Is this problem solved? – Assume that variables whose addresses are taken (and globals) may alias all – Why haven’t we solved this problem? [Hind 2001] pointer dereferences e.g., – Next week we will look at some open issues p = &a; . . . *q and a may alias, so a may be 3 or 5, but a = 3; b = 4; *q does not alias b , so b is 4 *q = 5; Enhance with type information? CS553 Lecture Alias Analysis I 8 CS553 Lecture Alias Analysis I 9 2
Properties of Alias Analysis Representations of Aliasing Scope: Intraprocedural (per procedure) or Interprocedural (whole program) Equivalence sets – All memory references in the same set are aliases Representation – e.g., {*a,b}, {*b,c,**a} – Alias pairs? – Points-to sets? [Shapiro & Horwitz 97] Alias pairs – Others. . .? – Pairs that refer to the same memory int **a, *b, c, *d, e; Flow sensitivity: Sensitive versus insensitive? e.g., ( *a,b ), ( *b,c), (**a,c) 1: a = &b; 2: b = &c; – Completely general Context sensitivity: Sensitive versus insensitive? Points-to pairs [Emami94] Definiteness: May versus must? – Pairs where the first member points to the second e.g., ( a -> b ), ( b -> c ) Heap Modeling? – Possibly more compact than alias pairs Aggregate Modeling? CS553 Lecture Alias Analysis I 10 CS553 Lecture Alias Analysis I 11 Flow Sensitivity of Alias Analysis Definiteness of Alias Information Flow-sensitive alias analysis May (possible) alias information – Compute aliasing information at each program point – Indicates what might be true e.g., e.g., *p and i may alias *p and x alias here if (c) p = &i; p = &x; ... *p and y alias here p = &y; Must (definite) alias information – Indicates what is definitely true *p and i must alias Flow-insensitive alias analysis e.g., – Compute aliasing information for entire procedure p = &i; e.g., *p may alias x or y p = &x; Recall: in[s] = use[s] ∪ (out[s] – def[s]) Often need both in this procedure ... – e.g., Consider liveness analysis p = &y; (1) *p must alias v ⇒ def[s] = kill[s] = { v } (2) *q may alias v ⇒ use[s] = gen[s] = { v } s: *p = *q+4; Suppose out[s] = { v } CS553 Lecture Alias Analysis I 12 CS553 Lecture Alias Analysis I 13 3
Flow-sensitive May Points-To Analysis Must Points-To Analysis Analogous flow functions Analogous flow functions – ⊓ is ∪ – ⊓ is ∩ – s: p = &x; – s: p = &x; out must [s] = {( p → x )} ∪ (in must [s] – {( p → x ) ∀ x }) out[s] = {( p → x )} ∪ (in[s] – {( p → y ) ∀ y }) – s: p = q; – s: p = q; out must [s] = {( p → t ) | ( q → t ) ∈ in must [s]} ∪ (in must [s] – {( p → x ) ∀ x )}) out[s] = {( p → t ) | ( q → t ) ∈ in[s]} ∪ (in[s] – {( p → y ) ∀ y )}) – s: p = *q; – s: p = *q; out must [s] = {( p → t ) | ( q → r ) ∈ in must [s] & ( r → t ) ∈ in must [s]} ∪ out[s] = {( p → t ) | ( q → r ) ∈ in[s] & ( r → t ) ∈ in[s]} ∪ (in must [s] – {( p → x ) ∀ x )}) (in[s] –{( p → x ) ∀ x }) – s: *p = q; – s: *p = q; out must [s] = {( r → t ) | ( p → r ) ∈ in must [s] & ( q → t ) ∈ in must [s]} ∪ out[s] = {( r → t ) | ( p → r ) ∈ in[s] & ( q → t ) ∈ in[s]} ∪ (in must [s] – {( r → *) | ( p → r ) ∈ in must [s]}) (in[s] – {( r → x ) ∀ x | ( p → r ) ∈ in must [s]}) Compute along with may analysis CS553 Lecture Alias Analysis I 14 CS553 Lecture Alias Analysis I 15 Other Issues (Modeling the Heap) Modeling the Heap (cont) Issue Simple solution – Each allocation creates a new piece of storage – Create a summary “variable” (node) for each allocation statement e.g ., p = new T – Domain: 2 (Var ∪ Stmt) × (Var ∪ Stmt) rather than 2 Var × Var – Monotonic flow function Proposal? s: p = new T; – Generate (at compile-time) a new “variable” to stand for new storage out[s] = {( p → stmt s )} ∪ (in[s] – {( p → x ) ∀ x }) – newvar : Creates a new variable – Less precise (but finite) Flow function Alternatives – s: p = new T; – Summary node for entire heap out[s] = {( p → newvar )} ∪ (in[s] – {( p → x ) ∀ x }) – Summary node for each type Problem – K-limited summary – Domain is unbounded! – Maintain distinct nodes up to k links removed from root variables – Iterative data-flow analysis may not converge CS553 Lecture Alias Analysis I 16 CS553 Lecture Alias Analysis I 17 4
Using Alias Information Function Calls Example: reaching definitions Question – Compute at each point in the program a set of ( s,v ) pairs, indicating that – How do function calls affect our points-to sets? statement s may define variable v e.g ., p1 = &x; p2 = &p1; {( p1 → x ), ( p2 → p1 )} ... Flow functions foo(); – s: * p = x; ??? out reach [s] = {(s, z ) | ( p → z ) ∈ in may-pt [s]} ∪ Be conservative (in reach [s] – {(t, y ) ∀ t | ( p → y ) ∈ in must-pt [s]} – Assume that any reachable pointer may be changed – s: x = *p; – Pointers can be “reached” via globals and parameters out reach [s] = {(s, x )} ∪ (in reach [s] – {(t, x ) ∀ t} – May pass through objects in the heap – . . . – Can be changed to anything reachable or something else – Can we prune aliases using types? Problem – Lose a lot of information CS553 Lecture Alias Analysis I 18 CS553 Lecture Alias Analysis I 19 Concepts Next Time What is aliasing and how does it arise Reading – [Emami94] Properties of alias analyses – Definiteness: may or must Lecture – Flow sensitivity: sensitive or insensitive – Interprocedural analysis – Context sensitivity: sensitive or insensitive (interprocedural only) – Representation: alias pairs, points-to sets Function calls degrade alias information – Context-sensitive interprocedural analysis CS553 Lecture Alias Analysis I 20 CS553 Lecture Alias Analysis I 21 5
Recommend
More recommend
