A CIL Tutorial - Department of Computer Science - ETH Zürich

CHAPTER 3. DATAFLOW ANALYSIS 33
test/tut3.c:19:
test/tut3.c:19:
(c, Even)
(d, Even)
Since the program is small, we can check by inspection that the results of the analysis are correct.
Note, however, that for the variable a at line 19, the result is Top. This occurs because the analysis
made no attempt to interpret the guard of the if-statement on that line. Thus, at the join point
after the if-statement, as far as this analysis knows, a could be either Even or Odd.
3.3 Exercises
1. Create an option in src/ciltutoptions.ml that controls whether debugging information for
the analysis is printed.
2. We could represent the mapping from variables to oekinds many other ways. If the analysis
had to be super-fast, we could use bitsets. Then, the abstract state would be four bitsets,
one for each oekind, with each local variable of integral type belonging to exactly one of the
bitsets. Note the Bitmap module in cil/ocamlutil/bitmap.ml.
3. In oekind of unop for the LNot case, there are two cases e = 0 and e ≠ 0. If we know
that e will be zero, then !e will be 1 and therefore Odd. If we know that e will be non-zero,
then !e will be zero and therefore Even. If we don't know anything about e, then !e is Top as
we have here. Modify this analysis to also track whether variables are zero or non-zero. (Such
an analysis can have wider applications. Think about pointers.)
4. There are a number of other binary operations. Figure out how to handle them in oekind of binop.
item Modify the analysis to handle not only local variables, but also global variables. What
should their initial state be? How would the analysis change in the presence of multiple
threads?
5. Implement the doGuard function of OddEvenDF so that the analysis may conclude that a is
Even at line 19.
Project: Add another layer of generalization on top of CIL's Dataflow functors
so that one must only dene the functions operating on the abstract state
(and possibly also a function for giving the initial state for a function.) One
should then get a function for invoking the analysis and a visitor class for visiting
the AST with the results of the analysis. (Essentially everything from
the module OddEvenDF and down to the end of vmlVisitorClass, except for
collectVars, should be automatic).