this article, we present a general framework for developing demand-driven interprocedural data flow analyzers and report our experience in evaluating the performance of this approach. A demand for data flow information is modeled as a set of queries. The framework includes a generic demand-driven algorithm that determines the response to a query by iteratively applying a system of query propagation rules. The propagation rules yield precise responses for the class of distributive finite data flow problems. We also describe a two-phase framework variation to accurately handle nondistributive problems. A performance evaluation of our demand-driven approach is presented for two data flow problems, namely, reaching-definitions and copy constant propagation. Our experiments show that demand-driven analysis performs well in practice, reducing both time and space requirements when compared with exhaustive analysis.

Traditional interprocedural data-flow analysis is performed on whole programs; however, such whoZe-program analysis is not feasible for large or incomplete programs. We propose fragment data-flow analy-sis as an alternative approach which computes data-flow information for a specific program fragment. The analysis is parameterized by the addi-tional information available about the rest of the program. We describe two frameworks for interprocedural flow-sensitive fragment analysis, the relationship between fragment analysis and whole-program analysis, and the requirements ensuring fragment analysis safety and feasibility. We propose an application of fragment analysis as a second analysis phase after an inexpensive flow-insensitive whole-program analysis, in order to obtain better information for important program fragments. We also describe the design of two fragment analyses derived from an already existing whole-program flow- and context-sensitive pointer alias analysis for C programs and present empirical evaluation of their cost and pre-cision. Our experiments show evidence of dramatically better precision obtainable at a practical cost.

Software systems are increasing in size and complexity and, subsequently, are becoming ever more difficult to validate. Finite State Verification (FSV) has been gaining credibility and attention as an alternative to testing and to formal verification approaches based on theorem proving. There has recently been a great deal of excitement about the potential for FSV approaches to prove properties about hardware descriptions but, for the most part, these approaches do not scale adequately to handle the complexity usually found in software. In this paper, we describe an FSV approach that creates a compact and conservative, but imprecise, model of the system being analyzed, and then assists the analyst in adding additional details as guided by previous analysis results. This paper describes this approach and a prototype implementation, called FLAVERS, presents a detailed example, and then provides some experimental results demonstrating scalability.

The widespread use of the continuation-passing style (CPS) transformation in compilers, optimizers, abstract interpreters, and partial evaluators reflects a common belief that the transformation has a positive effect on the analysis of programs. Investigations by Nielson [13] and Burn/Filho [5, 6] support, to some degree, this belief with theoretical results. However, they do not pinpoint the source of increased abstract information and do not explain the observation of many people that continuation-passing confuses some conventional data flow analyses. To study the impact of the CPS transformation on program analysis, we derive three canonical data flow analyzers for the core of an applicative higher-order programming language. The first analyzer is based on a direct semantics of the language, the second on a continuation-semantics of the language, and the last on the direct semantics of CPS terms. All analyzers compute the control flow graph of the source program and hence our result...

The purpose of this paper is to introduce frameworks based on data-flow equations which provide for estimating the worst-case execution time (WCET) of (real-time) programs. These frameworks allow several different WCET analysis techniques, which range from nave approaches to exact analysis, provided exact knowledge on the program behaviour is available. However, data-flow frameworks can also be used for symbolic analysis based on information derived automatically from the source code of the program. As a byproduct we show that slightly modified elimination methods can be employed for solving WCET data-flow equations, while iteration algorithms cannot be used for this purpose.

Data flow analysis is a process for collecting run-time information about data in programs without actually executing them. In this paper, we focus at the use of data flow analysis to support program understanding and reverse engineering. Data flow analysis is beneficial for these applications since the information obtained can be used to compute relationships between data objects in programs. These relations play a key role, for example, in the determination of the logical components of a system and their interaction. The general support of program understanding and reverse engineering requires the ability to analyse a variety of source languages and the ability to combine the results of analysing multiple languages. We present a flexible and generic software architecture for describing and performing language-independent data flow analysis which allows such transparent multi-language analysis. All components of this architecture were formally specified. 1 Introduction Data flow anal...

OF THE DISSERTATION Modular Data-flow Analysis of Statically Typed Object-oriented Programming Languages by Ramkrishna Chatterjee Dissertation Director: Barbara Gershon Ryder Abstract The solution of data-flow analysis of object-oriented programming languages such as C++/Java is needed for many important applications: aggressive code optimization, side-e#ect analysis, program specialization, program slicing and data-flow-based testing. However, data-flow analysis of object-oriented programming languages is di#cult due to a large number of heap-allocated objects whose fields point to other heap-allocated objects (recursive structures), dynamic dispatch, frequent method invocations, a large number of methods, many invocation contexts per method and exceptions. In this thesis we present a new data-flow analysis technique called Relevant Context Inference (RCI) for modular, flow- and context-sensitive data-flow analysis of statically typed object-oriented programming languages such ...

We present a comprehensive approach to performing data flow analysis in parallel. We identify three types of parallelism inherent in the data flow solution process: independent-problem parallelism, separate-unit parallelism and algorithmic parallelism; and describe a unified framework to exploit them. Our investigations of typical Fortran programs reveal an abundance of the last two types of parallelism. In particular, we illustrate the exploitation of algorithmic parallelism in the design of our parallel hybrid data flow analysis algorithms. We report on the empirical performance of the parallel hybrid algorithm for the Reaching Definitions problem and the structural characteristics of the program flow graphs that affect algorithm performance. Keywords. Data flow analysis, parallel algorithms, parallel data flow analysis. 1 Introduction 1.1 Motivation Data flow analysis is a compile-time analysis technique that gathers information about the flow of data in the program. Data flow i...

A data-flow framework for symbolic reaching definitions analysis is presented. It produces a more accurate solution of the reaching definitions problem than can be achieved with "classic" data-flow analysis.

ion Language 19 4.1 Data types : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 19 4.2 Language structure : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 20 4.2.1 Procedures : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 20 4.3 Language features : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 20 4.3.1 Elementary constructs : : : : : : : : : : : : : : : : : : : : : : : : : : : 21 4.3.2 Control constructs : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 23 4.4 Language definitions : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 24 4.4.1 Dhal : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 25 4.4.2 sDhal : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 25 4.4.3 pDhal : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 25 5 Control Flow Normalization 27 5.1 Motivation : : : : : : : : : : : : : : : : : : : : : : : : ...