Lecture Notes: A Dataflow Analysis Framework for WHILE3ADDR

Program analysis tools typically work on a representation of code as a control-flow graph (CFG), which is a graph-based representation of the flow of control through the program. It connects simple instructions in a way that statically captures all possible execution paths through the program and defines the execution order of instructions in the program. When control could flow in more than one direction, depending on program values, the graph branches. An example is the representation of an if or while statement. At the end of the instructions in each branch of an if statement, the branches merge together to point to the single instruction that comes afterward. Historically, this arises from the use of program analysis to optimize programs. More precisely, a control flow graph consists of a set of nodes and edges. The nodes N correspond to basic blocks: Sequences of program instructions with no jumps in or out (no gotos, no labeled targets). The edges E represent the flow of control between basic blocks. We use Pred(n) to denote the set of all predecessors of the node n, and Succ(n) the set of all successors. A CFG has a start node, and a set of final nodes, corresponding to return or other termination of a function. Finally, for the purposes of dataflow analysis, we say that a program point exists before and after each node. Note that there exists considerable flexibility in these definitions, and the precision of the representation can vary based on the desired precision of the resulting analysis as well as the peculiarities of the language. Further defining and learning how to construct CFGs is a subject best left to a compilers course; this discussion should get us started for the purposes of dataflow analysis. We will discuss control flow graphs further, with examples, together in class.