On Thu, Jun 25, 2009 at 9:08 PM, Nuno Lopes<nlopess@php.net> wrote:
So we do whole program analysis. We start at the first statement in
global scope, model it, then add all its successor to a queue, and
keep modelling until we get to the end of the program. When we get to
a method call, we start modelling the execution of the method. At the
end of the method, we propagate the results back to the caller, model
the return value, and carry on modelling the caller.
This is just an outline. I imagine this description can be applied to
a lot of compilers and a lot of analysis algorithms.
uhm, not many. Usually compilers consider each function independently, and do not consider the calling contexts.
it sounds like this algorithm:
Precise interprocedural dataflow analysis via graph reachability, POPL'95
http://portal.acm.org/citation.cfm?id=199462
I'm not familiar with this paper. However, from the abstract, it looks
like it wouldn't handle alias analysis (thats not to say it couldnt be
extended to do it). More importantly though, PHP's semantics are truly
special, so most analyses for "traditional" languages don't apply
well. Of course, many of the techniques do.
This paper describes a framework for dataflow analysis. It doesn't impose any such constraint. For example, I'm currently using this algorithm to build an analysis that takes aliasing into account.
Anyway, I didn't want to disturb this nice discussion :) I just wanted to point you out this paper, which should be interesting for your thesis (to help you formalize your analysis).
Nuno