Understanding Uncertainty in Static Pointer Analysis

Flow-and context-sensitive pointer analysis is generally considered too expensive for large programs; most tools relax one or both of the requirements for scalability. We formulate a flow-and context-sensitive points-to analysis that is lazy in the following sense: points-to information is computed only for live pointers and its propagation is sparse (restricted to live ranges of respective pointers). Our analysis also: (i) uses strong liveness, effectively including dead code elimination; (ii) afterwards calculates must-points-to information from may-points-to information instead of using a mutual fixed-point; (iii) uses valuebased termination of call strings during interprocedural analysis (which reduces the number of call strings significantly). A naive implementation of our analysis within GCC-4.6.0 gave analysis time and size of points-to measurements for SPEC2006. Using liveness reduced the amount of points-to information by an order of magnitude with no loss of precision. For all programs under 30kLoC we found that the results were much more precise than gcc's analysis. What comes as a pleasant surprise however, is the fact that below this cross-over point, our naive linked-list implementation is faster than a flow-and context-insensitive analysis which is primarily used for efficiency. We speculate that lazy flow-and context-sensitive analyses may be not only more precise, but also more efficient, than current approaches.

IEEE Transactions on Software Engineering

We present SUPA, a value-flow-based demand-driven flow-and context-sensitive pointer analysis with strong updates for C and C++ programs. SUPA enables computing points-to information via value-flow refinement, in environments with small time and memory budgets. We formulate SUPA by solving a graph-reachability problem on an inter-procedural value-flow graph representing a program's defuse chains, which are pre-computed efficiently but over-approximately. To answer a client query (a request for a variable's points-to set), SUPA reasons about the flow of values along the pre-computed defuse chains sparsely (rather than across all program points), by performing only the work necessary for the query (rather than analyzing the whole program). In particular, strong updates are performed to filter out spurious defuse chains through value-flow refinement as long as the total budget is not exhausted. We have implemented SUPA on top of LLVM (4.0.0) together with a comprehensive micro-benchmark suite after a years-long effort (consisting of around 400 test cases, including handwritten ones and the ones extracted from real programs). We have evaluated SUPA by choosing uninitialized pointer detection and C++ virtual table resolution as two major clients, using 24 real-world programs including 18 open-source C programs and 6 large CPU2000/2006 C++ benchmarks. For uninitialized pointer client, SUPA achieves improved precision as the analysis budget increases, with its flow-sensitive (context-insensitive) analysis reaching 97.4% of that achieved by whole-program Sparse Flow-Sensitive analysis (SFS) by consuming about 0.18 seconds and 65KB of memory per query, on average (with a budget of at most 10000 value-flow edges per query). With context-sensitivity also considered, SUPA becomes more precise for some programs but also incurs more analysis times. To further demonstrate the effectiveness of SUPA, we have also evaluated SUPA in resolving C++ virtual tables by querying the function pointers at every virtual callsite. Compared to analysis without strong updates for heap objects, SUPA's demand-driven context-sensitive strong update analysis reduces 7.35% spurious virtual table targets with only 0.4 secs per query, on average.

Lecture Notes in Computer Science, 2002

In recent years, static analysis has increasingly been applied to the problem of program verification. Systems for program verification typically use precise and expensive interprocedural dataflow algorithms that are difficult to scale to large programs. An attractive way to scale these analyses is to use a preprocessing step to reduce the number of dataflow facts propagated by the analysis and/or the number of statements to be processed, before the dataflow analysis is run. This paper describes an approach that achieves this effect. We first run a scalable, control-flow-insensitive pointer analysis to produce a conservative representation of value flow in the program. We query the value flow representation at the program points where a dataflow solution is required, in order to obtain a conservative over-approximation of the dataflow facts and the statements that must be processed by the analysis. We then run the dataflow analysis on this "slice" of the program. We present experimental evidence in support of our approach by considering two client dataflow analyses for program verification: typestate analysis, and software model checking. We show that in both cases, our approach leads to dramatic speedups.

1999

Pointer aliasing analysis is used to determine if two object names containing dereferences and/or field selectors, (e.g., *p,q->t), may refer to the same location during execution. Such information is necessary for applications such as dataflow-based testers, program understanding tools, and debuggers, but is expensive to calculate with acceptable precision. Incremental algorithms update data flow information after a program change rather than recomputing it from scratch, under the assumption that the change impact will be limited. Two versions of a practical incremental pointer aliaaing algorithm have been developed, based on Land&Ryder flow-and context-sensitive alias analysis. Empirical results attest to the time savings over exhaustive analysis (a six-fold speedup on average), and the precision of the approximate solution obtained (on average same solution as exhaustive algorithm for 75% of the tests.) Keywords Interprocedural pointer al&zing, incremental analysis, interprocedural side effect analysis.

Proceedings of the ACM on programming languages, 2019

Object-sensitivity is widely used as a context abstraction for computing the points-to information contextsensitively for object-oriented languages like Java. Due to the combinatorial explosion of contexts in large programs, k-object-sensitive pointer analysis (under k-limiting), denoted k-obj, is scalable only for small values of k, where k ⩽ 2 typically. A few recent solutions attempt to improve its efficiency by instructing k-obj to analyze only some methods in the program context-sensitively, determined heuristically by a preanalysis. While already effective, these heuristics-based pre-analyses do not provide precision guarantees, and consequently, are limited in the efficiency gains achieved. We introduce a radically different approach, Eagle, that makes k-obj run significantly faster than the prior art while maintaining its precision. The novelty of Eagle is to enable k-obj to analyze a method with partial context-sensitivity, i.e., context-sensitively for only some of its selected variables/allocation sites. Eagle makes these selections during a lightweight pre-analysis by reasoning about context-free-language (CFL) reachability at the level of variables/objects in the program, based on a new CFL-reachability formulation of k-obj. We demonstrate the advances made by Eagle by comparing it with the prior art in terms of a set of popular Java benchmarks and applications. CCS Concepts: • Theory of computation → Program analysis.

2006

Pointer analysis is a critical compiler analysis used to disambiguate the indirect memory references that result from the use of pointers and pointer-based data structures. A conventional pointer analysis deduces for every pair of pointers, at any program point, whether a points-to relation between them (i) definitely exists, (ii) definitely does not exist, or (iii) maybe exists.

2007

Abstract Pointer analyses enable many subsequent program analyses and transformations, since they enable compilers to statically disambiguate references to the heap. Extra precision enables pointer analysis clients to draw stronger conclusions about programs. Flow-sensitive pointer analyses are typically quite precise. Unfortunately, flow-sensitive pointer analyses are also often too expensive to run on whole programs.

2007

We propose a new abstraction for pointer analysis based on the principle of matching pointer dereferences or “memory fetches” with pointer assignments. Our abstraction, the Assign-Fetch Graph (AFG), has several advantages over traditional points-to graphs. It leads to concise procedure summaries for pointer analysis and similar computations; each procedure’s summary information can be used effectively in arbitrary calling contexts. Different analysis variations can be formulated on the AFG— we present two possible variations. One is based on a standard flow-insensitive view of the program; the other takes some statement ordering into account and produces results that are both more precise and more quickly computed. Our abstraction also facilitates incremental summary-based pointer analysis, which is not generally possible with conventional points-to graphs. We show how the AFG simplifies certain steps in updating pointer graphs and computing procedure summaries. For efficiency and c...

ACM Transactions on Programming Languages and Systems, 2003

This paper presents a novel interprocedural, flow-sensitive, and context-sensitive pointer analysis algorithm for multithreaded programs that may concurrently update shared pointers. The algorithm is designed to handle programs with structured parallel constructs, including fork-join constructs, parallel loops, and conditionally spawned threads. For each pointer and each program point, the algorithm computes a conservative approximation of the memory locations to which that pointer may point. The algorithm correctly handles a wide range of programming language constructs, including recursive functions, recursively generated parallelism, function pointers, structures, arrays, nested structures and arrays, pointer arithmetic, casts between different pointer types, heap and stack allocated memory, shared global variables, and thread-private global variables. We have implemented the algorithm in the SUIF compiler system and used the implementation to analyze a set of multithreaded programs written in the Cilk programming language. Our experimental results show that the analysis has good precision and converges quickly for our set of Cilk programs.