(Last modified Thu Apr 17 22:42 2008)

home teaching site map schedule

ICS 215
Software Analysis and Testing
Spring 2008
Data flow analysis

Definitions

definition of variable x
A statement that assigns or may assign a value to x. 

Examples: 

reaches
A definition of x reaches a statement S if the value of x at S could still be the one given by that definition.
gen[S]
The set of definitions generated by statement S.  For example, an assignment generates a definition. 
kill[S]
The set of definitions killed by statement S; that is, the set of definitions that S renders ineffective.  For example, if S generated a definition of variable y, then S kills any earlier definitions of y. 
in[S]
The set of definitions reaching the beginning of S, taking the entire program and its context into account.

The in set of the first statement in a program is empty.  The in set of every other statement in a program is the union of the out sets of all statements that can immediately precede it. 

out[S]
The set of definitions reaching the end of S, taking the entire program and its context into account.

gen, kill, and out for some statements

Definition S — "d: a=expression"

  1. gen[S] = {d}
  2. kill[S] = {all definitions of a} - {d}
  3. out[S] = gen[S] ∪ (in[S] - kill[S])

Sequence S — "Q then R"

  1. gen[S] = gen[R] ∪ (gen[Q] - kill[R])
  2. kill[S] = kill[R] ∪ (kill[Q] - gen[R])
  3. out[S] = out[R]

Alternation S — "Q or R"

  1. gen[S] = gen[Q] ∪ gen[R]
  2. kill[S] = kill[Q] ∩ kill[R]
  3. out[S] = out[Q] ∪ out[R]

Iteration S — "Q 1 or more times"

  1. gen[S] = gen[Q]
  2. kill[S] = kill[Q]
  3. out[S] = out[Q]

Dwyer and Clarke's framework

Dwyer and Clarke's framework consists of five mathematical objects:

The mathematical objectsAn example from dataflow analysis
A lattice The powerset of the definitions
A flow graphThe control flow graph of the program (definitions only)
A set of transfer functions How the out set is calculated for each kind of statement
A function map binding flow graph
entities to transfer functions
Which calculation is used for each statement of the program
A confluence map binding flow
graph entities to "meet" (GLB) or "join" (LUB)
"Join" (union of the inputs). 
Share-Alike Made with jEdit Valid CSS! Valid HTML 4.01! UC Irvine Thomas A. Alspaugh
Assistant Professor, Informatics Dept.
School of Information and Computer Sciences