Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

A control-flow graph (CFG) is a directed graph that shows the possible ways execution can move through a function or procedure. Its nodes are basic blocks—straight-line sequences of code—and its arrows show possible transfers between those blocks.

What does a control-flow graph represent?

A CFG maps the possible execution flow of a procedure or function. Each directed edge represents a possible transition from one basic block to another, including a transition back to the same block. It describes what may happen, not which path a particular run will take.

LLVM Flang describes a CFG as basic blocks containing straight-line actions, connected by directed edges for possible control-flow transitions. LLVM Flang’s CFG documentation also notes that a block with multiple successors ends with an action that selects which successor execution follows.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What are the nodes and edges?

Nodes: basic blocks

A node represents a basic block: an ordered sequence of statements or instructions that executes without branching to another block partway through. LLVM defines a basic block as a single-entry, single-exit section of code whose final instruction is a terminator. LLVM’s Programmer’s Manual explains this structure.

Within a block, the statements’ order captures straight-line execution. In Clang’s source-level CFG, conditional control flow is represented by edges between blocks rather than by statement order alone. Clang’s CFE Internals Manual describes this representation.

Edges: possible transfers

A directed edge points from the block that may transfer control to the block that may execute next. A conditional branch can have multiple outgoing edges, one for each possible outcome. A loop appears as an edge that returns to an earlier block, creating a cycle in the graph.

How do branches and loops appear in a CFG?

Consider a function that checks a condition, runs one of two actions, and then continues. Its graph has a block ending at the condition, edges to the two alternative blocks, and edges from those blocks to a later shared block. If one alternative repeats the condition, an edge returns to that block and represents the loop.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The terminator at the end of a block determines how execution continues. A block with one successor has a single possible next block; a block with multiple successors needs a branch or other selection action to choose among them. The graph records the alternatives without claiming that every alternative will occur in a given execution.

Why do compilers use CFGs?

A CFG gives compiler analyses a structure for reasoning about which statements might execute next and how information moves through a function. Clang describes its CFG as useful for flow-sensitive and path-sensitive analysis. Clang’s internals documentation discusses those uses.

For example, data-flow analysis can propagate facts about a program along CFG edges. When paths meet, an analysis combines information at the join; it can repeat this propagation until reaching a fixed point, where further passes no longer change the results. Clang’s data-flow introduction explains this approach.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Are entry and exit blocks part of every CFG?

Not necessarily. Some CFG representations add explicit entry and exit blocks as a convention. Clang’s function CFG uses an empty entry block with no incoming edges and an empty exit block with no outgoing edges. Other representations may organize entry points differently; LLVM Flang notes that Fortran subprograms can have multiple entry points through the ENTRY statement. For that reason, entry and exit nodes should be understood as features of a particular CFG representation, not requirements of every graph.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.