Citation Context

...aught the undergraduate course on Compilers. In preparing for this course, I read a number of papers on data-flow analysis including: – G. Killdall, A Unified Approach to Global Program Optimization, =-=[Kil73]-=-. 1 I was unaware of the work by Basu and Yeh [BY75] until I saw it cited in Emerson’s paper in this volume. The paper shows that the weakest precondition for total correctness is the least fixed poin...

Citation Context

...ind precise solutions to a large class of interprocedural dataflow-analysis problems in polynomial time. In contrast with intraprocedural dataflow analysis, where “precise” means “meet-over-all-paths”=-=[20]-=-, a precise interprocedural dataflow-analysis algorithm must provide the “meet-over-all-valid-paths” solution. (A path is valid if it respects the fact that when a procedure finishes it returns to the...

Citation Context

...f thousands of boolean variables (not counting hundreds of thousands of program points) is still a real challenge. Moreover very simple static program analyzes, such as Kildall’s constant propagation =-=[24]-=-, involve an infinite abstract domain which cannot be encoded using finite boolean vectors thus requiring the user to provide beforehand all predicates that will be indispensable to the static analysi...

Citation Context

...tactic predicates that, for simplicity, we choose to be Boolean ex-pressions P ⊆ B. We define var�P� ∆ = ⋃ p∈P var�p�. The set P may be infinite as e.g. in the case of Kildall’s constant propagation =-=[16]-=- for which P ∆ = {tt, ff} ∪ ⋃ ⋃ X∈var�C� v∈D {X = v}. Predicate abstraction uses a prover to prove theorems t ∈T with interpretation I ∈T↦→ ℘(M) assigning an interpretation I�t� to all syntactic predi...

Citation Context

...they are crucial for the interprocedural caching described in the next section. Our algorithm computes a fixed point that is similar to the meet-over-paths solution in a traditional dataflow analysis =-=[16]-=-. The analysis stops when the block summary (i.e., cache) at each block contains all state tuples that can reach that block along any control path (i.e., the maximal fixedpoint solution). The algorith...

Citation Context

...ecurity holes. Koved et al. study the complementary problem of statically determining the access rights required for a program or a component to run on a client machine [21] using a dataflow analysis =-=[16, 18]-=-. 7.4 Meta-Programming To be put in a broader context, our research can be viewed as an instance of providing runtime safety guarantee for meta-programming [39]. Macros are a very old and established ...

Citation Context

...cepted by a Turing machine which may or may not halt on all inputs. Static Analysis originally concentrated on FORTRAN, and was predominately confined to a single procedure (intraprocedural analysis) =-=[7, 9, 15]-=-. However, even this simple form of Static Analysis is not recursive. The difficulty lies in conditionals. There are, in general, many paths through a procedure, but not all paths correspond to an exe...

Citation Context

...work in this area. Program analysis. We use many static analysis techniques such as symbolic execution [31], abstract interpretation [18], model checking [15], theorem proving [20], dataflow analysis =-=[29]-=-, and program slicing [57]. Each of thesesareas is an active research area in which we can benefit from new or more advanced techniques. It would be impossible to note all related work in static analy...