Precise Null Pointer Analysis Through Global Value Numbering

Software: Practice and Experience, 2015

SummaryTo improve the ability of compilers to determine alias relations in a program, the C standard restricts the types of expressions that may access objects in memory. In practice, however, many existing C programs do not conform to these restrictions, making type‐based alias analysis unsound for those programs. As a result, type‐based alias analysis is frequently disabled. Existing approaches for verifying type safety exist within larger frameworks designed to verify overall memory safety, requiring both static analysis and runtime checks. This paper describes the motivation for analyzing the safety of type‐based alias analysis independently; presents SafeType, a purely static approach to detection of violations of the C standard's restrictions on memory accesses; describes an implementation of SafeType in the IBM XL C compiler, with flow‐sensitive and context‐sensitive queries to handle variables with type void *; evaluates that implementation, showing that it scales to pro...

Proceedings of the ACM on programming languages, 2019

Object-sensitivity is widely used as a context abstraction for computing the points-to information contextsensitively for object-oriented languages like Java. Due to the combinatorial explosion of contexts in large programs, k-object-sensitive pointer analysis (under k-limiting), denoted k-obj, is scalable only for small values of k, where k ⩽ 2 typically. A few recent solutions attempt to improve its efficiency by instructing k-obj to analyze only some methods in the program context-sensitively, determined heuristically by a preanalysis. While already effective, these heuristics-based pre-analyses do not provide precision guarantees, and consequently, are limited in the efficiency gains achieved. We introduce a radically different approach, Eagle, that makes k-obj run significantly faster than the prior art while maintaining its precision. The novelty of Eagle is to enable k-obj to analyze a method with partial context-sensitivity, i.e., context-sensitively for only some of its selected variables/allocation sites. Eagle makes these selections during a lightweight pre-analysis by reasoning about context-free-language (CFL) reachability at the level of variables/objects in the program, based on a new CFL-reachability formulation of k-obj. We demonstrate the advances made by Eagle by comparing it with the prior art in terms of a set of popular Java benchmarks and applications. CCS Concepts: • Theory of computation → Program analysis.

Abstract Most errors in computer programs are only found once they are run, which results in critical errors being missed due to inadequate testing. If additional static analysis is performed, then the possibility exists for detecting such errors, and correcting them. This helps to improve the quality of the resulting code, increasing reliability.

Lecture Notes in Computer Science, 2013

We present a high-level survey of state-of-the-art alias analyses for object-oriented programs, based on a years-long effort developing industrial-strength static analyses for Java. We first present common variants of points-to analysis, including a discussion of key implementation techniques. We then describe flow-sensitive techniques based on tracking of access paths, which can yield greater precision for certain clients. We also discuss how whole-program alias analysis has become less useful for modern Java programs, due to increasing use of reflection in libraries and frameworks. We have found that for real-world programs, an under-approximate alias analysis based on access-path tracking often provides the best results for a variety of practical clients. 2 Motivating Analyses Many program analyses for object-oriented languages rely on an effective alias analysis. Here we illustrate a number of alias analysis concerns in the context of an analysis for detecting resource leaks in Java programs, and discuss how these concerns also pertain to other analyses. 2.1 Resource Leaks 1 public void test(File file, String enc) throws IOException { 2

Proceedings.International Conference on Parallel Architectures and Compilation Techniques, 2002

Optimizations performed at link time or directly applied to final program executables have received increased attention in recent years. Such low-level optimizations can benefit greatly from pointer alias information. However, as almost all existing alias analyses are formulated in terms of source language constructs, they turn out to be of limited utility at the machine code level. This paper describes two different approaches to highquality, low-cost, speculative may-alias analysis, to be applied in the context of link-time or executable code optimizers. The key idea behind our proposals is the introduction of unsafe speculations at analysis-time, which increases alias precision on important portions of code, and keeps the analysis reasonably cost-efficient. Experimental results indicate that introducing speculation at analysis-time is clearly beneficial: precision increases up to 83% in average, against a baseline precision of 16%. Furthermore, the percentage of dynamic misspeculations is typically about 2%, which shows that our technique can be used even for scenarios where speculation recovery is expensive.

2019 IEEE/ACM 27th International Conference on Program Comprehension (ICPC)

A lightweight pointer-analysis framework, srcPtr, is presented to support the implementation and comparison of points-to analysis algorithms. It differentiates itself from existing tools by performing the analysis directly on the abstract syntax tree, as opposed to an intermediate representation (e.g., LLVM IR), by using srcML, an XML representation of source code. Working with srcML and the abstract syntax allows easy access to the actual source code as the programmer views it, thus better supporting comprehension. Currently the framework provides example implementations for both Andersen's and Steensgaard's pointer-analysis algorithms. It also allows for easy integration of other points-to algorithms for comparison of accuracy/speed. The approach is very scalable and can generate pointer dependencies for a 750 KLOC program in less than a minute.

SafeTSA is a new type safe intermediate representation for mobile code based on static single assignment form. We developed SafeTSA as an alternative to the Java Virtual Machine. Programs in SafeTSA contain explicit null-and bounds-check instructions, allowing their elimination. Type safety is maintained by enforcing the use of only null-and bounds-checked values in dereference and index operations. Currently, our compiler produces SafeTSA code from programs written in Java. As a proof of concept we implemented constant propagation, dead code elimination, and common subexpression elimination. These opimizations resulted in the elimination of, on average, 30% of the null-checks and 17% of the bounds-checks. 3rd Workshop on Feedback-Directed and Dynamic Optimization (FDDO-3). Monterey, California. December 2000.

Flow-and context-sensitive pointer analysis is generally considered too expensive for large programs; most tools relax one or both of the requirements for scalability. We formulate a flow-and context-sensitive points-to analysis that is lazy in the following sense: points-to information is computed only for live pointers and its propagation is sparse (restricted to live ranges of respective pointers). Our analysis also: (i) uses strong liveness, effectively including dead code elimination; (ii) afterwards calculates must-points-to information from may-points-to information instead of using a mutual fixed-point; (iii) uses valuebased termination of call strings during interprocedural analysis (which reduces the number of call strings significantly). A naive implementation of our analysis within GCC-4.6.0 gave analysis time and size of points-to measurements for SPEC2006. Using liveness reduced the amount of points-to information by an order of magnitude with no loss of precision. For all programs under 30kLoC we found that the results were much more precise than gcc's analysis. What comes as a pleasant surprise however, is the fact that below this cross-over point, our naive linked-list implementation is faster than a flow-and context-insensitive analysis which is primarily used for efficiency. We speculate that lazy flow-and context-sensitive analyses may be not only more precise, but also more efficient, than current approaches.

2005

Pointer analysis is a well known, widely used and very important static program analyzing technique. After having studied the literature in this field of research we found that most of the methods approach the problem in a flow-insensitive way, i.e. they omit the use of the control-flow information. Our goal was to develop a technique that is flow-sensitive and can be used in the analysis of large programs. During this process we have found that our method can give more accurate results if we build the call graph and compute the pointer information at the same time. In this paper we present two of our algorithms for pointer analysis and give some examples to help their comprehension. In the future these algorithms are planed to form the basis of a flow-and context-sensitive method used in the impact analysis of real life applications.

2009

For programs that make extensive use of pointers, pointer analysis is often critical for the effectiveness of optimising compilers and tools for reasoning about program behaviour and correctness. Static pointer analysis has been extensively studied and several algorithms have been proposed, but these only provide approximate solutions. As such inaccuracy may hinder further optimisations, it is important to understand how short these algorithms come of providing accurate information about the points-to relations. This thesis attempts to quantify the amount of uncertainty of the points-to relations that remains after a state-of-the-art contextand flow-sensitive pointer analysis algorithm is applied to a collection of programs from two well-known benchmark suites: SPEC integer and MediaBench. This remaining static uncertainty is then compared to the run-time behaviour. Unlike previous work that compared run-time behaviour against less accurate contextand flow-insensitive algorithms, th...