Lian Li
ABSTRACT
Points-to analysis is a fundamental static analysis technique which computes the set of memory objects that a pointer may point to. Many different applications, such as security-related program analyses, bug checking, and analyses of multi-threaded programs, require precise points-to information to be effective. Recent work has focused on improving the precision of points-to analysis through flow-sensitivity and great progress has been made. However, even with all recent progress, flow-sensitive points-to analysis can still be much slower than a flow-insensitive analysis.
In this paper, we propose a novel method that simplifies flow-sensitive points-to analysis to a general graph reachability problem in a value flow graph. The value flow graph summarizes dependencies between pointer variables, including those memory dependencies via pointer dereferences. The points-to set for each pointer variable can then be computed as the set of memory objects that can reach it in the graph. We develop an algorithm to build the value flow graph efficiently by examining the pointed-to-by set of a memory object, i.e., the set of pointers that point to an object. The pointed-to-by information of memory objects is very useful for applications such as escape analysis, and information flow analysis.
Our approach is intuitive, easy to implement and very efficient. The implementation is around 2000 lines of code and it is more efficient than existing flow-sensitive points-to analyses. The runtime is comparable with the state-of-the-art flow-insensitive points-to analysis.
- M. Berndl, O. Lhoták, F. Qian, L. Hendren, and N. Umanee. Points-to analysis using bdds. In Proceedings of the ACM SIGPLAN 2003 conference on Programming language design and implementation, PLDI '03, pages 103--114, New York, NY, USA, 2003. ACM. Google Scholar
Digital Library
- R. Bodik. Path-sensitive, value-flow optimizations of programs. PhD thesis, Pittsburgh, PA, USA, 1999. Google ScholarDigital Library
- R. Bodik and S. Anik. Path-sensitive value-flow analysis. In Proceedings of the 25th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, POPL '98, pages 237--251, New York, NY, USA, 1998. ACM. Google ScholarDigital Library
- D. R. Chase, M. Wegman, and F. K. Zadeck. Analysis of pointers and structures. In Proceedings of the ACM SIGPLAN 1990 conference on Programming language design and implementation, PLDI '90, pages 296--310, New York, NY, USA, 1990. ACM. Google ScholarDigital Library
- R. Chatterjee, B. G. Ryder, and W. A. Landi. Relevant context inference. In Proceedings of the 26th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, POPL '99, pages 133--146, New York, NY, USA, 1999. ACM. Google ScholarDigital Library
- S. Cherem, L. Princehouse, and R. Rugina. Practical memory leak detection using guarded value-flow analysis. In Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation, PLDI '07, pages 480--491, New York, NY, USA, 2007. ACM. Google ScholarDigital Library
- J.-D. Choi, R. Cytron, and J. Ferrante. Automatic construction of sparse data flow evaluation graphs. In Proceedings of the 18th ACM SIGPLAN-SIGACT symposium on Principles of programming languages, POPL '91, pages 55--66, New York, NY, USA, 1991. ACM. Google ScholarDigital Library
- F. C. Chow, S. Chan, S.-M. Liu, R. Lo, and M. Streich. Effective representation of aliases and indirect memory operations in ssa form. In Proceedings of the 6th International Conference on Compiler Construction, pages 253--267, London, UK, 1996. Springer-Verlag. Google ScholarDigital Library
- R. Cytron, J. Ferrante, B. K. Rosen, M. N. Wegman, and F. K. Zadeck. Efficiently computing static single assignment form and the control dependence graph. ACM Transactions on Programming Languages and Systems, 13(4):451--490, October 1991. Google ScholarDigital Library
- N. Dor, S. Adams, M. Das, and Z. Yang. Software validation via scalable path-sensitive value flow analysis. In Proceedings of the 2004 ACM SIGSOFT international symposium on Software testing and analysis, ISSTA '04, pages 12--22, New York, NY, USA, 2004. ACM. Google ScholarDigital Library
- M. Fähndrich, J. S. Foster, Z. Su, and A. Aiken. Partial online cycle elimination in inclusion constraint graphs. In Proceedings of the ACM SIGPLAN 1998 conference on Programming language design and implementation, PLDI '98, pages 85--96, New York, NY, USA, 1998. ACM. Google ScholarDigital Library
- S. J. Fink, E. Yahav, N. Dor, G. Ramalingam, and E. Geay. Effective typestate verification in the presence of aliasing. ACM Trans. Softw. Eng. Methodol., 17:9:1--9:34, May 2008. Google ScholarDigital Library
- D. Goyal. Transformational derivation of an improved alias analysis algorithm. Higher Order Symbol. Comput., 18:15--49, June 2005. Google ScholarDigital Library
- B. Hackett and A. Aiken. How is aliasing used in systems software? In Proceedings of the 14th ACM SIGSOFT international symposium on Foundations of software engineering, SIGSOFT '06/FSE-14, pages 69--80, New York, NY, USA, 2006. ACM. Google ScholarDigital Library
- B. Hardekopf and C. Lin. The ant and the grasshopper: fast and accurate pointer analysis for millions of lines of code. In Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation, PLDI '07, pages 290--299, New York, NY, USA, 2007. ACM. Google ScholarDigital Library
- B. Hardekopf and C. Lin. Exploiting pointer and location equivalence to optimize pointer analysis. In In International Static Analysis Symposium (SAS), pages 265--280, 2007. Google ScholarDigital Library
- B. Hardekopf and C. Lin. Semi-sparse flow-sensitive pointer analysis. In Proceedings of the 36th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, POPL '09, pages 226--238, New York, NY, USA, 2009. ACM. Google ScholarDigital Library
- B. C. Hardekopf. Pointer analysis: building a foundation for effective program analysis. PhD thesis, Austin, TX, USA, 2009. Google ScholarDigital Library
- R. Hasti and S. Horwitz. Using static single assignment form to improve flow-insensitive pointer analysis. In Proceedings of the ACM SIGPLAN 1998 conference on Programming language design and implementation, PLDI '98, pages 97--105, New York, NY, USA, 1998. ACM. Google ScholarDigital Library
- M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Trans. Program. Lang. Syst., 21:848--894, July 1999. Google ScholarDigital Library
- M. Hind and A. Pioli. Assessing the effects of flow-sensitivity on pointer alias analyses. In Proceedings of the 5th International Symposium on Static Analysis, SAS '98, pages 57--81, London, UK, 1998. Springer-Verlag. Google ScholarDigital Library
- V. Kahlon. Bootstrapping: a technique for scalable flow and context-sensitive pointer alias analysis. In Proceedings of the 2008 ACM SIGPLAN conference on Programming language design and implementation, PLDI '08, pages 249--259, New York, NY, USA, 2008. ACM. Google ScholarDigital Library
- C. Lattner, A. Lenharth, and V. Adve. Making context-sensitive points-to analysis with heap cloning practical for the real world. In Proceedings of the 2007 ACM SIGPLAN conference on Programming language design and implementation, PLDI '07, pages 278--289, New York, NY, USA, 2007. ACM. Google ScholarDigital Library
- O. Lhoták and K.-C. A. Chung. Points-to analysis with efficient strong updates. In Proceedings of the 38th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, POPL '11, pages 3--16, New York, NY, USA, 2011. ACM. Google ScholarDigital Library
- L. Li, C. Cifuentes, and N. Keynes. Practical and effective symbolic analysis for buffer overflow detection. In Proceedings of the eighteenth ACM SIGSOFT international symposium on Foundations of software engineering, FSE '10, pages 317--326, New York, NY, USA, 2010. ACM. Google ScholarDigital Library
- LLVM. Low Level Virtual Machine. http://www.llvm.org, detail on website.Google Scholar
- E. M. Nystrom, H.-S. Kim, and W. mei W. Hwu. Bottom-up and top-down context-sensitive summary-based pointer analysis. In SAS'04, pages 165--180, 2004.Google ScholarCross Ref
- J. H. Reif and H. R. Lewis. Symbolic evaluation and the global value graph. In Proceedings of the 4th ACM SIGACT-SIGPLAN symposium on Principles of programming languages, POPL '77, pages 104--118, New York, NY, USA, 1977. ACM. Google ScholarDigital Library
- A. Salcianu and M. Rinard. Pointer and escape analysis for multithreaded programs. In Proceedings of the eighth ACM SIGPLAN symposium on Principles and practices of parallel programming, PPoPP '01, pages 12--23, New York, NY, USA, 2001. ACM. Google ScholarDigital Library
- M. Sridharan and R. Bodík. Refinement-based context-sensitive points-to analysis for java. In Proceedings of the 2006 ACM SIGPLAN conference on Programming language design and implementation, PLDI '06, pages 387--400, New York, NY, USA, 2006. ACM. Google ScholarDigital Library
- S. Staiger-Stöhr. Implementing sparse flow-sensitive andersen analysis. Technical report, Universität Stuttgart, 2009.Google Scholar
- B. Steensgaard. Points-to analysis in almost linear time. In Proceedings of the 23rd ACM SIGPLAN-SIGACT symposium on Principles of programming languages, POPL '96, pages 32--41, New York, NY, USA, 1996. ACM. Google ScholarDigital Library
- T. B. Tok, S. Z. Guyer, and C. Lin. Efficient flow-sensitive interprocedural data-flow analysis in the presence of pointers. In 15th International Conference on Compiler Construction, pages 17--31. Springer, 2006. Google ScholarDigital Library
- J. Whaley and M. S. Lam. Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In Proceedings of the ACM SIGPLAN 2004 conference on Programming language design and implementation, PLDI '04, pages 131--144, New York, NY, USA, 2004. ACM. Google ScholarDigital Library
- D. A. Wheeler. SLOC Count User Guide. http://www.dwheeler.com/sloccount/. Last accessed: 16 March 2009.Google Scholar
- H. Yu, J. Xue, W. Huo, X. Feng, and Z. Zhang. Level by level: making flow- and context-sensitive pointer analysis scalable for millions of lines of code. In Proceedings of the 8th annual IEEE/ACM international symposium on Code generation and optimization, CGO '10, pages 218--229, New York, NY, USA, 2010. ACM. Google ScholarDigital Library
- B. Zheng and P. chung Yew. A hierarchical approach to context-sensitive interprocedural alias analysis, 1999.Google Scholar
- J. Zhu. Towards scalable flow and context sensitive pointer analysis. In Proceedings of the 42nd annual Design Automation Conference, DAC '05, pages 831--836, New York, NY, USA, 2005. ACM. Google ScholarDigital Library
- J. Zhu and S. Calman. Symbolic pointer analysis revisited. In Proceedings of the ACM SIGPLAN 2004 conference on Programming language design and implementation, PLDI '04, pages 145--157, New York, NY, USA, 2004. ACM. Google ScholarDigital Library
Index Terms
- Boosting the performance of flow-sensitive points-to analysis using value flow
Recommendations
Precise and scalable context-sensitive pointer analysis via value flow graph
ISMM '13In this paper, we propose a novel method for context-sensitive pointer analysis using the value flow graph (VFG) formulation. We achieve context-sensitivity by simultaneously applying function cloning and computing context-free language reachability (...
Comprehensive path-sensitive data-flow analysis
CGO '08: Proceedings of the 6th annual IEEE/ACM international symposium on Code generation and optimizationData-flow analysis is an integral part of any aggressive optimizing compiler. We propose a framework for improving the precision of data-flow analysis in the presence of complex control-flow. We initially perform data-flow analysis to determine those ...
Semi-sparse flow-sensitive pointer analysis
POPL '09Pointer analysis is a prerequisite for many program analyses, and the effectiveness of these analyses depends on the precision of the pointer information they receive. Two major axes of pointer analysis precision are flow-sensitivity and context-...
Comments