Importance of heap specialization in pointer analysis

Abstract

Specialization of heap objects is critical for pointer analysis to effectively analyze complex memory activity. This paper discusses heap specialization with respect to call chains. Due to the sheer number of distinct call chains, exhaustive specialization can be cumbersome. On the other hand, insufficient specialization can miss valuable opportunities to prevent spurious data flow, which results in not only reduced accuracy but also increased overhead.In determining whether further specialization will be fruitful, an object's escape information can be exploited. From empirical study, we found that restriction based on escape information is often, but not always, sufficient at prohibiting the explosive nature of specialization.For in-depth case study, four representative benchmarks are selected. For each benchmark, we vary the degree of heap specialization and examine its impact on analysis results and time. To provide better visibility into the impact, we present the points-to set and pointed-to-by set sizes in the form of histograms.

Efficient field-sensitive pointer analysis for C

“…Much work has also been done on context-sensitive analyses which, unlike the analysis studied in this paper, consider a function separately for each calling context (see e.g. [Wilson 1997;Chatterjee et al 1999;Cheng and Hwu 2000;Foster et al 2000;Fähndrich et al 2000;Das et al 2001;Liang et al 2001;Whaley and Lam 2004;Nystrom et al 2004b]). While this can greatly improve precision, it is equivalent to fully inlining each function before performing the analysis and is, generally speaking, impractical for analysing large programs [Whaley and Lam 2004;Nystrom et al 2004a].…”

“…However, this could be done with only minor modification (i.e. using actual offsets instead of field numbers) and, in fact, Nystrom et al claim to have done just this, although they do not discuss exact details [Nystrom et al 2004b]. …”

FESA: Fold- and Expand-Based Shape Analysis

“…Our work shows how points-to analysis can be enriched with summaries of heap structures, thereby giving a new answer to the question of how to merge the regions created at call sites of malloc [14]. Moreover, our analysis could replace ad-hoc forms of shape analysis such as summarizing all heap cells but the last one allocated [1].…”

Query-directed adaptive heap cloning for optimizing compilers

“…In [22], the authors introduced FULCRA as a context-sensitive Andersen's analysis by promoting the side-effect-causing statements from a calee to its callsites. Earlier [23], they showed empirically on top of their analysis that full heap cloning can improve the analysis precision, but can also incur uncontrollable overhead. In this paper, QUDA makes full heap cloning significantly more scalably for Andersen's analysis by being query-quided.…”

“…As k increases, pointer analysis becomes strictly no less precise but more costly to compute. With full heap cloning, the precision for some programs can be significantly improved but the analysis can be prohibitively expensive or even does not terminate [22,23]. Steensgarrd's unification-based and Andersen's inclusionbased pointer analyses are commonly used in modern compilers.…”