This paper shows howalarge class of interprocedural dataflow-analysis problems can be solved precisely in polynomial time. The only restrictions are that the set of dataflowfacts is a finite set, and that the dataflowfunctions distribute overthe confluence operator (either union or intersection). This class of problems includes---but is not limited to---the classical separable problems (also known as "gen/kill" or "bit-vector" problems)---e.g.,reaching definitions, available expressions, and live variables. In addition, the class of problems that our techniques handle includes manynon-separable problems, including trulylive variables, copyconstant propagation, and possibly-uninitialized variables. Anovelaspect of our approach is that an interprocedural dataflow-analysis problem is transformed into a special kind of graph-reachability problem (reachability along interprocedurally realizable paths). The paper presents three polynomial-time algorithms for the realizable-path reachability problem: an exhaustive version, a second exhaustive version that may be more appropriate in the incremental and/or interactive context, and a demand version. The first and third of these algorithms are asymptotically faster than the best previously known realizable-path reachability algorithm. An additional benefit of our techniques is that theylead to improvedalgorithms for twoother kinds of interproceduralanalysis problems: interprocedural flow-sensitive side-effect problems (as studied by Callahan) and interprocedural program slicing (as studied by Horwitz, Reps, and Binkley). CR Categories and Subject Descriptors: D.3.4 [Programming Languages]: Processors - compilers, optimization;E.1 [Data

We describe novel techniques used for efficient simulation of memory in SimICS, an instruction level simulator developed at SICS. The design has focused on efficiently supporting the simulation of multiprocessors, analyzing complex memory hierarchies and running large binaries with a mixture of system-level and user-level code. A software caching

Object-oriented applications may contain data members that can be removed from the application without affecting program behavior. Such "dead" data members may occur due to unused functionality in class libraries, or due to the programmer losing track of member usage as the application changes over time. We present a simple and efficient algorithm for detecting dead data members in C++ applications. This algorithm has been implemented using a prototype version of the IBM VisualAge C++ compiler, and applied to a number of realistic benchmark programs ranging from 600 to 58,000 lines of code. For the non-trivial benchmarks, we found that up to 27.3% of the data members in the benchmarks are dead (average 12.5%), and that up to 11.6% of the object space of these applications may be occupied by dead data members at run-time (average 4.4%). 1 Introduction Object-oriented applications may contain data members (instance variables) that can be removed from the application without affecting p...

Cetus is a compiler infrastructure for the source-to-source transformation of programs. We created Cetus out of the need for a compiler research environment that facilitates the development of interprocedural analysis and parallelization techniques for C, C++, and Java programs. We will describe our rationale for creating a new compiler infrastructure and give an overview of the Cetus architecture. The design is intended to be extensible for multiple languages and will become more flexible as we incorporate feedback from any di#culties we encounter introducing other languages. We will characterize Cetus' runtime behavior of parsing and IR generation in terms of execution time, memory usage, and parallel speedup of parsing, as well as motivate its usefulness through examples of projects that use Cetus. We will then compare these results with those of the Polaris Fortran translator.

Mutation testing is a technique for testing software units that has great potential for improving the quality of testing, and thereby increasing our ability to assure the high reliability of critical software. It will be shown that recent advances in mutation research have brought a practical mutation testing system closer to reality. One recent advance is a partial solution to the problem of automatically detecting equivalent mutant programs. Equivalent mutants are currently detected by hand, which makes it very expensive and time-consuming. The problem of detecting equivalent mutants is a specific instance of a more general problem, commonly called the feasible path problem, which says that for certain structural testing criteria some of the test requirements are infeasible in the sense that the semantics of the program imply that no test case satis es the test requirements. Equivalent mutants, unreachable statements in path testing techniques, and infeasible DU-pairs in dataflow testing are all instances of the feasible path problem. This paper presents a technique that uses mathematical constraints, originally developed for test data generation, to automatically detect some equivalent mutants and infeasible paths.

Abstract. Constant propagation aims at identifying expressions that always yield a unique constant value at run-time. It is well-known that constant propagation is undecidable for programs working on integers even if guards are ignored as in non-deterministic flow graphs. We show that polynomial constants are decidable in non-deterministic flow graphs. In polynomial constant propagation, assignment statements that use the operators +, −, ∗ are interpreted exactly but all assignments that use other operators are conservatively interpreted as non-deterministic assignments. We present a generic algorithm for constant propagation via a symbolic weakest precondition computation and show how this generic algorithm can be instantiated for polynomial constant propagation by exploiting techniques from computable ring theory. 1

Mutation analysis is a software testing technique that requires the tester to generate test data that will find specific, well-defined errors. Mutation testing executes many slightly differing versions, called mutants, of the same program to evaluate the quality of the data used to test the program. Although these mutants are generated and executed efficiently by automated methods, many of the mutants are functionally equivalent to the original program and are not useful for testing. Recognizing and eliminating equivalent mutants is currently done by hand, a time-consuming and arduous task. This problem is currently a major obstacle to the practical application of mutation testing. This paper presents extensions to previous work in detecting equivalent mutants; specifically, algorithms for determining several classes of equivalent mutants are presented, discuss an implementation of these algorithms, and present results from using this implementation. These algorithms are based on data flow analysis and six compiler optimization techniques. Each of these techniques is described and how they are used to detect equivalent mutants. The design of the tool and some experimental results using it are also presented. Keywords---compiler optimizations, software testing, mutation testing, experimental software engineering. The Journal of Software Testing, Verification, and Reliability, Wiley, vol 4, no 3, September 1994, pp. 131--154. 1

This paper shows how to achieve, under certain conditions, abstract-interpretation algorithms that enjoy the best possible precision for a given abstraction. The key idea is a simple process of successive approximation that makes repeated calls to a decision procedure, and obtains the best abstract value for a set of concrete stores that are represented symbolically, using a logical formula.

This paper describes our implementation of the Static Single Assignment (SSA) form of intermediate program representation in our parallelizing Fortran 90 compiler, Nascent. Although the traditional SSA form algorithm renames variables uniquely at every definition point, it is not practical to add new names to the symbol table at all assignments. Thus, most implementations actually provide def-use chains for each definition. In contrast, we provide use-def chains, so that in the intermediate representation the link at each use points to its unique reaching definition. We discuss how our approach improves the implementation and efficiency of optimization and analysis techniques such as induction variable recognition and scalar dependence identification, used in the detection of parallelism. We also support parallelism by extending the traditional SSA form into languages with parallel constructs. 1 Introduction The Static Single Assignment (SSA) form for intermediate program flow represe...

Data Types and Software Validation ," Communications of the ACM, Vol. 21, No. 12, 1978, pp. 1048-1064.