Modular control-flow analysis with rank 2 intersection types

Abstract

We show how the principal typing property of the rank 2 intersection type system enables the specification of a modular and polyvariant control-flow analysis. † Partially supported by postdoctoral fellowships at technique uses a system of constraints to specify control-flow analysis so that flow information is obtained as the minimal solution of the constraint system (Palsberg 1995). Both techniques require whole-program analysis. For control-flow analysis of program fragments containing free variables, the above techniques usually assume an environment that associates a property with each free variable or assume that only trivial properties hold for the free variables. Neither assumption is satisfactory: the former requires reanalysis whenever the environment changes; the latter leads to poor analysis results and the rejection of program fragments that require functions as inputs.We describe an algorithm for modular and polyvariant control-flow analysis of simply typed program fragments. The result of analysing a program fragment P is a pair containing a property and an environment: the pair describes a relation between the properties of the free variables of P and the property of the entire program fragment P . The environment provides a summary of the minimum set of constraints that must be satisfied by any other program fragment that may link to P . Our algorithm computes a 'principal solution': the environment and property of any other program fragment that links to P can be obtained as an instance of the environment and property computed for P (see Theorem 6.4 for the precise statement). Thus, no re-analysis of P is required.Recently, there has been much interest in using annotated type systems for program analysis. The intuition is that types and expressions can be annotated with the properties of interest, for exampleso on, so that if an expression e has the annotated type τ, then evaluation of the expression exhibits the properties described by the annotation of τ. Static analysis of the expression e is then synonymous with the calculation, via an annotated-type inference algorithm, of its property annotations. For control-flow analysis, we annotate every function in an expression with a label, and associate a set of function labels ϕ with every function type τ. The intuition is that if e evaluates to a closure, then the text of the closure is a function whose label is in ϕ. The static determination of the set of function labels that e can possibly evaluate to is thus synonymous with the calculation, via an inference algorithm, of its flow annotations.An advantage of the type-based approach is that it provides a method for performing compositional and modular program analysis. 'Compositional' means that the analysis of an expression is derived through the composition of the analyses of its proper subparts. We say that an analysis is 'modular' if it can analyse program fragments containing free variables in isolation, and if the linking of fragments does not require their re-analysis. A modular program an...

Relating complexity and precision in control flow analysis

“…It also seems likely that the linear logic based investigation into CFA presented here can be coupled with that of Neergaard and Mairson (2004) to provide the foundation for complexity results for the control flow analysis of rank-2 bounded intersection typed programs (Banerjee and Jensen 2003).…”

Stable relations and abstract interpretation of higher-order programs

“…This has been solved either by forgetting the environment part of a closure [Heintze 1994;Jensen 2008, 2009]Ðwhich leads to variants of 0CFAÐor by creating an indirection through the naming of environments . At the opposite end of the spectrum, [Banerjee and Jensen 2003] define a modular type-based analysis that infers control flow information. The collecting semantics we have defined can undoubtedly be used to derive relational control flow analyses.…”

Control-flow analysis of functional programs

“…In a follow-up paper, Banerjee and Jensen [18] formulated a modular and polyvariant control-flow analysis for simply-typed programs. Both analyses are based on intersection types, in particular they rely on the principal typing property of rank 2 intersection types.…”