Heterogeneous Fixed Points with Application to Points-To Analysis

Kanade, Aditya; Khedker, Uday P.; Sanyal, Amitabha

doi:10.1007/11575467_20

Cited by 6 publications

(9 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In future we propose to explore this idea in detail. We would also like to extend the proposed ideas to non-bit-vector frameworks like points-to analysis [Emami et al 1994;Kanade et al 2005]. …”

Section: Discussionmentioning

confidence: 99%

An improved bound for call strings based interprocedural analysis of bit vector frameworks

Karkare

Khedker

2007

ACM Trans. Program. Lang. Syst.

View full text Add to dashboard Cite

Interprocedural data flow analysis extends the scope of analysis across procedure boundaries in search of increased optimization opportunities. Call strings based approach is a general approach for performing flow and context sensitive interprocedural analysis. It maintains a history of calls along with the data flow information in the form of call strings, which are sequences of unfinished calls. Recursive programs may need infinite call strings for interprocedural data flow analysis. For bit vector frameworks this method is believed to require all call strings of lengths up to 3K , where K is the maximum number of distinct call sites in any call chain.We combine the nature of information flows in bit-vector data flow analysis with the structure of interprocedurally valid paths to bound the call strings. Instead of bounding the length of call strings, we bound the number of occurrences of any call site in a call string. We show that the call strings in which a call site appears at most three times, are sufficient for convergence on interprocedural maximum fixed point solution. Though this results in the same worst case length of call strings, it does not require constructing all call strings up to length 3K . Our empirical measurements on recursive programs show that our bound reduces the lengths and the number of call strings, and hence the analysis time, significantly.

show abstract

Section: Discussionmentioning

confidence: 99%

An improved bound for call strings based interprocedural analysis of bit vector frameworks

Karkare

Khedker

2007

ACM Trans. Program. Lang. Syst.

View full text Add to dashboard Cite

show abstract

“…If there are m atomic propositions in M ′ then we get a system of m simultaneous equations. If the system is h-monotonic [KKS05] or simply monotonic then a solution to the equations can be computed iteratively and it completely determines the labeling of the transformed Kripke structure.…”

Section: Transformations Of Kripke Structuresmentioning

confidence: 99%

A Logic for Correlating Temporal Properties across Program Transformations

Kanade¹,

Sanyal²,

Khedker³

2012

Preprint

Self Cite

View full text Add to dashboard Cite

Program transformations are widely used in synthesis, optimization, and maintenance of software. Correctness of program transformations depends on preservation of some important properties of the input program. By regarding programs as Kripke structures, many interesting properties of programs can be expressed in temporal logics. In temporal logic, a formula is interpreted on a single program. However, to prove correctness of transformations, we encounter formulae which contain some subformulae interpreted on the input program and some on the transformed program. An example where such a situation arises is verification of optimizing program transformations applied by compilers.In this paper, we present a logic called Temporal Transformation Logic (TTL) to reason about such formulae. We consider different types of primitive transformations and present TTL inference rules for them. Our definitions of program transformations and temporal logic operators are novel in their use of the boolean matrix algebra. This results in specifications that are succinct and constructive. Further, we use the boolean matrix algebra in a uniform manner to prove soundness of the TTL inference rules.

show abstract

“…Points-to relations are computed by identifying locations corresponding to the leftand right-hand sides of a pointer assignment and taking their cartesian product [10,11]. The points-to pairs of locations that are modified are removed.…”

mentioning

confidence: 99%

“…The points-to pairs of locations that are modified are removed. May-points-to information at n contains the points-to pairs that hold along some path reaching n whereas must-points-to information contains the pairs that hold along every path reaching n (hence a pointer can have at most one pointee) [11]. Fig.…”

mentioning

confidence: 99%

Lazy Pointer Analysis

Khedker,

Mycroft,

Rawat

2011

Preprint

View full text Add to dashboard Cite

Flow-and context-sensitive pointer analysis is generally considered too expensive for large programs; most tools relax one or both of the requirements for scalability. We formulate a flow-and context-sensitive points-to analysis that is lazy in the following sense: points-to information is computed only for live pointers and its propagation is sparse (restricted to live ranges of respective pointers). Our analysis also: (i) uses strong liveness, effectively including dead code elimination; (ii) afterwards calculates must-points-to information from may-points-to information instead of using a mutual fixed-point; (iii) uses valuebased termination of call strings during interprocedural analysis (which reduces the number of call strings significantly). A naive implementation of our analysis within GCC-4.6.0 gave analysis time and size of points-to measurements for SPEC2006. Using liveness reduced the amount of points-to information by an order of magnitude with no loss of precision. For all programs under 30kLoC we found that the results were much more precise than gcc's analysis. What comes as a pleasant surprise however, is the fact that below this cross-over point, our naive linked-list implementation is faster than a flow-and context-insensitive analysis which is primarily used for efficiency. We speculate that lazy flow-and context-sensitive analyses may be not only more precise, but also more efficient, than current approaches.

show abstract

Heterogeneous Fixed Points with Application to Points-To Analysis

Cited by 6 publications

References 6 publications

An improved bound for call strings based interprocedural analysis of bit vector frameworks

An improved bound for call strings based interprocedural analysis of bit vector frameworks

A Logic for Correlating Temporal Properties across Program Transformations

Lazy Pointer Analysis

Contact Info

Product

Resources

About