Lecture Notes on Static Analysis
Thanks to Michael I.Schwartzbach. We will read his paper Lecture Notes on Static Analysis.
Lecture Notes on Static Analysis Michael I. Schwartzbach BRICS, Department of Computer Science University of Aarhus, Denmark [email protected]
There are many interesting questions that can be asked about a given program:
does the program terminate?
how large can the heap become during execution?
what is the possible output?
Other questions concern individual program points in the source code:
does the variable x always have the same value?
will the value of x be read in the future?
can the pointer p be null?
which variables can p point to?
is the variable x initialized before it is read?
is the value of the integer variable x always positive?
what is a lower and upper bound on the value of the integer variable x?
at which program points could x be assigned its current value?
do p and q point to disjoint structures in the heap?
Rice's theorem is a general result from 1953 that informally can be paraphrased as stating that all interesting questions about the behavior of programs are undecidable.
The solution is to settle for approximative answers that are still precise enough to fuel our applications.
Consider again the problem of determining if a variable has a constant value.
If our intended application is to perform constant propagation, then the analysis may only answer yes if the variable really is a constant and must answer no if the variable may or may not be a constant. The trivial solution is of course to answer no all the time, so we are facing the engineering challenge of answering yes as often as possible while obtaining a reasonable performance.
Lecture Notes on Static Analysis Michael I. Schwartzbach BRICS, Department of Computer Science University of Aarhus, Denmark [email protected]
There are many interesting questions that can be asked about a given program:
does the program terminate?
how large can the heap become during execution?
what is the possible output?
Other questions concern individual program points in the source code:
does the variable x always have the same value?
will the value of x be read in the future?
can the pointer p be null?
which variables can p point to?
is the variable x initialized before it is read?
is the value of the integer variable x always positive?
what is a lower and upper bound on the value of the integer variable x?
at which program points could x be assigned its current value?
do p and q point to disjoint structures in the heap?
Rice's theorem is a general result from 1953 that informally can be paraphrased as stating that all interesting questions about the behavior of programs are undecidable.
The solution is to settle for approximative answers that are still precise enough to fuel our applications.
Consider again the problem of determining if a variable has a constant value.
If our intended application is to perform constant propagation, then the analysis may only answer yes if the variable really is a constant and must answer no if the variable may or may not be a constant. The trivial solution is of course to answer no all the time, so we are facing the engineering challenge of answering yes as often as possible while obtaining a reasonable performance.