A CIL Tutorial - Department of Computer Science - ETH Zürich

Chapter 3
Dataow Analysis
Dataow Analyses can be used to calculate an abstraction of the program state at each program
location. Dataow analysis is a ow-sensitive analysis, meaning that, unlike ow-insensitive analysis,
the order of the statements in the program is taken into account when calculating the abstraction
of the state.
Traditionally, compiler writers use dataow analyses extensively in performing compiler optimizations.
For example, an available expressions dataow analysis can eliminate redundant computation.
Most compiler textbooks discuss dataow analysis in detail [2, 3]. A more formal treatment
can be found in the textbook by Nielson et al. [4].
CIL has a number of useful dataow analyses built-in, which you can nd in the directory
cil/src/ext. They include a liveness analysis, an available expressions analysis, a reaching denitions
analysis, and others. The utility of even a simple liveness analysis cannot be underestimated.
Consider the following code snippet:
int *x = calloc(n, sizeof int);
f(x);
// x is never mentioned again
Since x does not escape the function, and since it is not live after the call to f, even a simple liveness
analysis can conclude that f is taking ownership of the memory allocated on the rst line.
In this tutorial we explore CIL's dataow analysis features. In particular, we employ the following
functor from CIL's Dataflow module found in cil/src/ext/dataflow.ml:
module ForwardsDataFlow (T : ForwardsTransfer) = struct ...,
which yields a module containing only a function called compute, which performs the dataow analysis
using the standard worklist algorithm. The functor is documented in detail in cil/src/ext/dataflow.mli
and in the CIL documentation.
In order to use this functor, we must create an OCaml module implementing the ForwardsTransfer
signature, which denes operations over the abstract state along with the transfer functions for the
21