A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 3. DATAFLOW ANALYSIS 22
static analysis. Now is a good time to take a look in dataflow.mli at the signature of the module
that we'll be implementing, and what the functions of the module mean. Additionally, the Dataflow
module is well documented in the main CIL documentation.
3.1 tut3.ml
The dataow analysis here is a common textbook example for abstract interpretation, an even/odd
analysis. First, we'll dene types and operations over the abstract state of the program. Then, we'll
apply the functor. Following this, we'll write some boilerplate code for accessing the results of the
analysis in an AST visitor. It should be straightforward to repurpose the code in this tutorial for
many other kinds of dataow analysis, so feel free to use it as a starting point. For dataow analysis
in the backwards direction, there is also a BackwardsDataFlow functor in the Dataflow module.
module IH = Inthash (∗ An int → α hashtable library ∗)
module DF = Dataflow (∗ CIL's dataow analysis library ∗)
When debug is true, the dataow library emints out lots of debugging information.
let debug = ref false
3.1.1 Type Denitions
The abstract state for the analysis is a mapping from local variables of integral type to one of the
oekind constructors. When a variable is mapped to one of these kinds, it has the following meaning:
• Top The variable could be either odd or even.
• Even The variable is an even integer.
• Odd The variable is an odd integer.
• Bottom The variable is uninitialized.
type oekind = Top | Odd | Even | Bottom
We'll use association lists to represent the mapping. An element of the mapping for a variable
vi : varinfo is like: (vi.vid, (vi, kind)). We'll also need some utility functions for examining
and manipulating the mappings.