\chapter{Conclusions and Perspective}

\section{Contributions}

Flow analysis is a fundamental static analysis of functional,
object-oriented, and other higher-order programming languages; it is a
ubiquitous and much-studied component of compiler technology with
nearly thirty years of research on the topic.
%
This dissertation has investigated the computational complexity of
flow analysis in higher-order programming languages, yielding novel
insights into the fundamental limitations on the cost of performing
flow analysis.

Monovariant flow analysis, such as 0CFA, is complete for polynomial
time.
%
Moreover, many further approximations to 0CFA from the literature,
such as Henglein's simple closure analysis, remain complete for
polynomial time.
%
These theorems rely on the fact that when a program is linear (each
bound variable occurs exactly once), the analysis makes no
approximation; abstract and concrete interpretation coincide.
%
More generally, we conjecture {\em any} abstract and concrete
interpretation will have some sublanguage of coincidence, and this
sublanguage may be useful in proving lower bounds.

The linear $\lambda$-calculus has been identified as an important
language subset to study in order to understand flow analysis.
%
Linearity is an equalizer among variants of static analysis, and a
powerful tool in proving lower bounds.
%
Analysis of linear programs coincide under both equality and
inclusion-based flow constraints, and moreover, concrete and abstract
interpretation coincide for this core language.
%
The inherently sequential nature of flow analysis can be understood as
a consequence of a lack of abstraction on this language subset.

Since linearity plays such a fruitful role in the study of program
analysis, we developed connections with linear logic and the
technology of sharing graphs.
%
Monovariant analysis can be formulated graphically, and the technology
of graph reduction and optimal evaluation can be applied to flow
analysis.
%
The explicit control representation of sharing graphs makes it easy to
extend flow analysis to languages with first-class control.

Simply-typed, $\eta$-expanded programs have a potentially simpler 0CFA
problem, which is complete for logarithmic space.
%
This discovery is based on analogies with proof normalization for
multiplicative linear logic with {\em atomic} axioms.

Shivers' polyvariant $k$CFA, for any $k>0$, is complete for
deterministic exponential time.
%
This theorem validates empirical observations that such control flow
analysis is intractable. 
%
A fairly straightforward calculation shows that $k$CFA can be computed
in exponential time.  We show that the naive algorithm is essentially
the best one.  There is, in the worst case---and plausibly, in
practice---no way to tame the cost of the analysis.  Exponential time
is required.


Collectively, these results provide general insight into the
complexity of abstract interpretation and program analysis.

\section{Future Work}

We end by outlining some new directions and open problems worth
pursuing, in approximately ascending order of ambition and import.

\subsection{Completing the Pointer Analysis Complexity Story}

Compared with flow analysis, pointer analysis has received a much more
thorough complexity investigation.  A series of important refinements
have been made by \citet{landi-ryder-popl91,
  landi-phd92,landi-loplas92,choi-etal-popl93,
  horwitz-toplas97,muth-debray-popl00,chaterjee-etal-tse01,
  chakaravarthy-popl03}, yet open problems persist.
%
\citet{chakaravarthy-popl03} leaves open the lower bound on the
complexity of pointer analysis with well-defined types with less than
two levels of dereference.  We believe our insights into linearity and
circuit construction can lead to an answer to this remaining problem.

\subsection{Polyvariant, Polynomial Flow Analyses}

To echo the remark of \citet{bravenboer-smaragdakis-oopsla09}, only
adapted to the setting of flow analysis rather than pointer analysis,
there is an ongoing search for polyvariant, or context-sensitive,
analyses that provide precise flow information without causing massive
redundant computation.
%
There has been important work in this area
\cite{jagannathan-weeks-popl95,nielson-nielson-popl97}, but the
landscape of tractable, context-sensitive flow analyses is mostly open
and in need of development.

The ingredients, detailed in \autoref{chapter-kcfa}, that combine to
make $k$CFA hard, when $k > 0$, should provide guidance in designing new
abstractions that avoid computationally expensive components of
analysis.
%
A lesson learned has been that {\em closures}, as they exist when
$k>0$, result in an exponential value space that can be harnessed for
the \exptime\ lower-bound construction.
%
It should be possible to design alternative closure abstractions while
remaining both polyvariant and polynomial (more below).

\subsection{An Expressive Hierarchy of Flow Analyses}

From the perspective of computational complexity, the $k$CFA hierarchy
is flat (for any fixed $k$, $k$CFA is in \exptime; see
\autoref{sec-kcfa-in-exptime}).  On the other hand, there are far more
powerful analyses such as those of \citet{burn-hankin-abramsky} and
\citet{mossin-njc98}.  How can we systematically bridge the gap
between these analyses to obtain a real expressivity hierarchy?

Flow analyses based on rank-bounded intersection types offers one
approach.  
%
It should also be possible to design such analyses by composing
notions of precise but bounded computation---such as partial
evaluation or a series of complete developments---followed by course
analysis of residual programs.  
%
The idea is to stage analysis into two phases: the first eliminates
the need for polyvariance in analysis by transforming the original
program into an equivalent, potentially larger, residual program.
%
The subsequent stage performs a course (monovariant) analysis of the
residual program.
%
By staging the analysis in this manner---first computing a precise but
bounded program evaluation, {\em then} an imprecise evaluation
approximation---the ``ever-worsening feedback loop''
\cite{might-shivers-icfp06} is avoided.
%
By using a sufficiently powerful notion of bounded evaluation, it
should be possible to construct flow analyses that form a true
hierarchy from a complexity perspective.
%
By using a sufficiently weak notion of bounded evaluation, it should
be possible to construct flow analyses that are arbitrarily
polyvariant, but computable in polynomial time.

\subsection{Truly Subcubic Inclusion-Based Flow Analysis}

This dissertation has focused on lower bounds, however recent upper
bound improvements have been made on the ``cubic bottleneck'' of
inclusion-based flow analyses such as 0CFA
\cite{midtgaard-vanhorn-tr09}.  These results have shown known set
compression techniques can be applied to obtain direct 0CFA algorithms
that run in $O(n^3 / \log n)$ time on a unit cost random-access memory
model machine.  While these results do provide a logarithmic
improvement, it is natural to wonder if there is a $O(n^c)$ algorithm
for 0CFA and related analyses, where $c < 3$.

At the same time, there have been recent algorithmic breakthroughs on
the all-pairs shortest path problem resulting in truly subcubic
algorithms.  Perhaps the graphical formulation of flow analysis from
\autoref{chap:linear-logic} can be adapted to exploit these
breakthroughs.

\subsection{Toward a Fundamental Theorem of Static Analysis}

A theorem due to \citet{statman79} says this: let {\bf P} be a
property of simply-typed $\lambda$-terms that we would like to detect
by static analysis, where {\bf P} is invariant under reduction
(normalization), and is computable in elementary time (polynomial, or
exponential, or doubly-exponential, or\dots).  Then {\bf P} is a {\em
  trivial} property: for any type $\tau$, {\bf P} is satisfied by {\em
  all} or {\em none} of the programs of type $\tau$.
\citet{henglein-mairson-popl91} have complemented these results,
showing that if a property is invariant under $\beta$-reduction for a
class of programs that can encode all Turing Machines solving problems
of complexity class {\sc{f}} using reductions from complexity class
{\sc{g}}, then any superset is either {\sc{f}}-complete or trivial.
Simple typability has this property for linear and linear affine
$\lambda$-terms \cite{henglein-mairson-popl91,mairson-jfp04}, and
these terms are sufficient to code all polynomial-time Turing
Machines.

We would like to prove some analogs of these theorems, with or without
the typing condition, but weakening the condition of ``invariant under
reduction'' to ``invariant under abstract interpretation.''


