Alias analysis of executable code

Abstract

Recent years have seen increasing interest in systems that reason about and manipulate executable code. Such systems can generally bene t from information about aliasing. Unfortunately, most existing alias analyses are formulated in terms of high-level language features, and are unable to cope with features, such as pointer arithmetic, that pervade executable programs. This paper describes a simple algorithm that can be used to obtain aliasing information for executable code. In order to be practical, the algorithm is careful to keep its memory requirements low, sacri cing precision where necessary to achieve this goal. Experimental results indicate that it is nevertheless able to provide a reasonable amount of information about memory references across a variety of benchmark programs.

Polymorphic versus Monomorphic Flow-Insensitive Points-To Analysis for C

“…Andersen's [4] and Steensgaard's [29] points-to analyses are only two choices in a vast array of possible alias analyses, among them [5,6,7,8,9,10,11,15,19,20,27,28,31,33,34]. As our results suggest, the benefit of polymorphism (more generally, context-sensitivity) may vary greatly with the particular analysis.…”

Using Inter-Procedural Side-Effect Information in JIT Optimizations

“…Debray, Muth and Weippert [DMW98] presented an alias analysis and evaluated their algorithm by measuring the percentage reduction in dynamic loads when using this analysis in a redundant load elimination optimization. However, they did not provide execution time measurements.…”

DIVINE: DIscovering Variables IN Executables

“…This is crucial for analyzing executables because numeric values and addresses are indistinguishable at runtime. Moreover, unlike earlier algorithms that analyze executables [8,11], VSA takes into account data manipulations involving memory locations also. To track the contents of memory locations, the initial run of VSA uses the variables recovered via the Semi-Naïve approach from §3.1.…”

“…Previous techniques deal with memory accesses very conservatively; generally, if a register is assigned a value from memory, it is assumed to take on any value. For instance, although the basic goal of the algorithm proposed by Debray et al [11] is similar to that of VSA, their goal is to find an over-approximation of the set of values that each register can hold at each program point; for us, it is to find an over-approximation of the set of values that each (abstract) data object can hold at each program point, where data objects include global, stack-allocated, and heap-allocated memory locations in addition to registers. In the analysis proposed by Debray et al, a set of addresses is approximated by a set of congruence values: they keep track of only the low-order bits of addresses.…”