静态分析 第三课 Data Flow Analysis(1)

Data Flow Analysis – Applications

1. Overview of DFA
2. Preliminaries of DFA
3. Reaching Definitions Analysis
4. Live Variables Analysis
5. Available Expressions Analysis

Overview

How Data Flows on CFG?
How application-specific Data <- Abstraction
Flows through the <- Over-approximation(for most static analyses(may analysis))
Nodes(BBs/statements) and <- Transfer function
Edges(control flows) of <- Control-flow handling
CFG(a program)

may analysis:
outputs information that may be true(over approximation)

must analysis:
outputs information that must be true(under-approximation)

Both over- and under-approximations are for safety of analysis

Preliminaries of Data FLow Analysis

Input and Output States

Each execution of an IR statement transforms an input state to a new output state
The input(output) satate is associated with the program point before(after) the statement

---

In each data-flow analysis application, we associate with every program point a data-flow value that represents an abstraction of the set of all possible program states that can be observed for that point.

The set of possible data-flow values is the domain for this application

Data-flow analysis is to find a solution to a set of safe-approximation-directed constraints on the IN(s)'s and OUT(s)'s, for all statements
(transfer function or flows of control)

Notations for Transfer Function’s Constraints and Control Flow Constraints

• Transfer Analysis
  Forward Analysis: OUT(s) = f(IN(s))
  Backward Analysis: IN(s) = f(OUT(s))

+Control flow within BB or among BBs
$IN[s_{i+1}$