Provide a brief example of a data-flow analysis

This commit is contained in:
Camelid 2020-11-11 12:48:15 -08:00 committed by Joshua Nelson
parent 79b3788fd7
commit 25016aeb3b
1 changed files with 26 additions and 0 deletions

View File

@ -109,6 +109,32 @@ longer change (the fixpoint will be top).
state. Each basic block's entry state is initialized to bottom before the state. Each basic block's entry state is initialized to bottom before the
analysis starts. analysis starts.
## A Brief Example
This section provides a brief example of a simple data-flow analysis at a high
level. It doesn't explain everything you need to know, but hopefully it will
make the rest of this page clearer.
Let's say we want to do a simple analysis to find if `mem::transmute` may have
been called by a certain point in the program. Our analysis domain will just
be a `bool` that records whether `transmute` has been called so far. The bottom
value will be `false`, since by default `transmute` has not been called. The top
value will be `true`, since our analysis is done as soon as we determine that
`transmute` has been called. Our join operator will just be the boolean OR (`||`)
operator. We use OR and not AND because of this case:
```
let x = if some_cond {
std::mem::transmute<i32, u32>(0_i32); // transmute was called!
} else {
1_u32; // transmute was not called
};
// Has transmute been called by this point? We conservatively approximate that
// as yes, and that is why we use the OR operator.
println!("x: {}", x);
```
## Inspecting the Results of a Dataflow Analysis ## Inspecting the Results of a Dataflow Analysis
Once you have constructed an analysis, you must pass it to an [`Engine`], which Once you have constructed an analysis, you must pass it to an [`Engine`], which