PREP print SRW POPL paper EXAMPLE // x points to a list y := nil while (x != nil) do t := y y := x x := x.cdr y.cdr := t t := nil CORE IDEAS track possible aliases by creating nodes named with aliased vars track (possible) edges between those nodes summarize all nodes not directly held in a variable with a single abstract node GRAPH AT HEAD OF LOOP VERSION 1 x -> nx -> 0 -> 0 VERSION 2 y -> ny x -> nx -> 0 -> 0 VERSION 3 t -> nt y -> ny -> nt x -> nx -> 0 -> 0 VERSION 4 (fixed point) t -> nt -> 0 y -> ny -> nt x -> nx -> 0 -> 0 LANGUAGE x := nil x.sel0 := nil x := new x := y x := y.sel0 x.sel0 := y assume any non-nil variable assignment is proceeded by a nil assignment (separates out clearing a memory location from re-assigning it) SHAPE GRAPH later we'll extend this to (Ev, Es, shared) Ev is a set of variable edges [x, n] Es is a set of selector edges FLOW FUNCTIONS go through by example! SSG([x := nil], ) = with n_X -> n_(X-x) SSG([x.sel0 := nil], ) = | x in n_X}> SSG([x := new], ) = // first, add x to all the groups that had y in them SSG([x := y], ) = let = with n_Z -> n_{Z U x} if y in Z // then, x points to all those groups in n_Y | [y,n_Y] in Ev'}, Es'> SSG([x := y.sel0], ) = where // materialize a new node from the (possibly abstract) node that y.sel pointed to Ev' = Ev U [x, n_(Z U {x})] U [z, n_(Z U {x})] for all Y such that y in Y, for all Z such that in Es, for all z such that [z, n_Z] in Ev Es' = Es // the node y.sel points to must have x in its var set // so we remove all old such nodes and add them in - { | y in Y} // y.sel points to the new node with x in its var set U {} // the new node points to everything the old version did U { | in Es} // preserve self pointers U { | in Es} // preserve other pointers to the materialized node U { | in Es} for all Y such that y in Y, for all Z such that in Es SSG([x.sel0 := y], ) = where Es' = Es U { | [x, n_X] and [y, n_Y] in Ev } TRACKING SHARED NODES when we materialize 0 -> 0, how do we know if 0 can point to the materialized node? role of set of shared nodes n_X in shared iff two pointers *in the heap* can refer to a particular run-time node in n_X (aliasing by stack pointers x,y doesn't count, only fields sel) update all the rules - beyond scope of this lecture but critical to many kinds of analysis INTERESTING BITS summarization and materialization strong updates for x.sel = y because we always model the node x precisely sharing/circularity tracking for linked lists