Interprocedural pointer alias analysis

Abstract

We present practical approximation methods for computing and representing interprocedural aliases for a program written in a language that includes pointers, reference parameters, and recursion. We present the following contributions: (1) a framework for interprocedural pointer alias analysis that handles function pointers by constructing the program call graph while alias analysis is being performed; (2) a flow-sensitive interprocedural pointer alias analysis algorithm;(3) a flow-insensitive interprocedural pointer alias analysis algorithm; (4) a flow-insensitive interprocedural pointer alias analysis algorithm that incorporates kill information to improve precision; (5) empirical measurements of the efficiency and precision of the three interprocedural alias analysis algorithms.

Flow-sensitive pointer analysis for millions of lines of code

“…Hind and Pioli [19], [20] use a weaker form of sparsity in the form of the sparse evaluation graph (SEG) [7], which is a graph that is derived from the CFG by eliding nodes that are irrelevant to pointer analysis (i.e., they do not manipulate pointer information) while at the same time maintaining the control-flow relations among the remaining nodes. Hind and Pioli [19], [20] also introduce the notion of filtered forward binding, which recognizes that when passing pointer information to the target of a function call, it is only necessary to pass pointer information that the callee can access from a global variable or from one of the function parameters.…”

Region-Based Selective Flow-Sensitive Pointer Analysis

“…Initially, sparsity was experimented with in [16,17] on a Sparse Evaluation Graph [5,26], a refined CFG with irrelevant nodes being removed. On various SSA form representations (e.g., factored SSA [6], HSSA [7] and partial SSA [20]), further progress was made later.…”

A Smooth Combination of Linear and Herbrand Equalities for Polynomial Time Must-Alias Analysis

“…If the analysis can infer that a 1 is definitely equal to some statically allocated structure c, a pattern for access to the elements of c is obtained. Otherwise, may-alias analysis [7] is called upon to divide the set of all pointer variables into equivalence classes. The simplest such approach, which suffices for some applications [11], equates all pointers of the same type.…”