Data-Flow Analysis

How to Generate Control-Flow Graph

Recall Control-Flow Graph Definition from the end of Lecture 10

In Scala:

DiGraphs.scala
SimpleCFG.scala

Translation of syntax trees to control-flow graphs is (at a high-level) similar to translation from regular expressions to finite-state machines (see closure properties of finite state machines).

Decomposing Complex Expressions

If Statements to CFG

While Statements to CFG

Source and Target CFG Vertices

In Scala:

SimpleAST.scala
SimpleTranslate.scala

Interpreting CFG

Sets of States at Each Program Point

Idea of Data Flow Analysis for Variable Ranges

Range Analysis Example

Lattices

Partial order

Lattices

Products of Lattices

Source code:

Lattices.scala
ConcreteAnalysis.scala

References

Lecture notes on static analysis by Michael Schwartzbach
Tiger book, chapters 10, 17
Abstract Interpretation in a Nutshell by Patrick Cousot (also a course at MIT)
Lecture 7 in Software Analysis and Verification 2009