Scalable context-sensitive flow analysis using instantiation constraints

Fähndrich, Manuel; Rehof, Jakob; Das, Manuvir

doi:10.1145/349299.349332

Cited by 99 publications

(52 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Andersen's [4] and Steensgaard's [29] points-to analyses are only two choices in a vast array of possible alias analyses, among them [5,6,7,8,9,10,11,15,19,20,27,28,31,33,34]. As our results suggest, the benefit of polymorphism (more generally, context-sensitivity) may vary greatly with the particular analysis.…”

Section: Related Workmentioning

confidence: 75%

“…The only direct applications of Hindley-Milner polymorphism to C of which we are aware are the analyses in this paper, the polymorphic recursive analysis proposed in [15] (see below), and the Lackwit system [23]. Lackwit, a software engineering tool, computes ML-style types for C and appears to scale very well to large programs.…”

Section: Related Workmentioning

confidence: 99%

“…Mossin's system starts with a typeannotated program and infers atomic flow constraints, whereas we infer the type and flow annotations simultaneously and do not have an atomic subtyping system. [15] develops an efficient algorithm for both subtyping and equality-based polymorphic recursive flow analyses, and shows how to construct a polymorphic recursive version of Steensgaard's analysis. (In contrast, in this paper we use Hindley-Milner style polymorphism, which can be less precise.)…”

Section: Related Workmentioning

confidence: 99%

“…Section 5 details our choices for these parameters. Also, Hindley-Milner style polymorphism is only one way to add context-sensitivity to a points-to analysis, and other approaches (e.g., polymorphic recursion [15]) may yield different tradeoffs.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Polymorphic versus Monomorphic Flow-Insensitive Points-To Analysis for C

2000

Self Cite

View full text Add to dashboard Cite

We carry out an experimental analysis for two of the design dimensions of flow-insensitive points-to analysis for C: polymorphic versus monomorphic and equality-based versus inclusion-based. Holding other analysis parameters fixed, we measure the precision of the four design points on a suite of benchmarks of up to 90,000 abstract syntax tree nodes. Our experiments show that the benefit of polymorphism varies significantly with the underlying monomorphic analysis. For our equalitybased analysis, adding polymorphism greatly increases precision, while for our inclusion-based analysis, adding polymorphism hardly makes any difference. We also gain some insight into the nature of polymorphism in points-to analysis of C. In particular, we find considerable polymorphism available in function parameters, but little or no polymorphism in function results, and we show how this observation explains our results.

show abstract

Section: Related Workmentioning

confidence: 75%

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Polymorphic versus Monomorphic Flow-Insensitive Points-To Analysis for C

2000

Self Cite

View full text Add to dashboard Cite

show abstract

“…This may limit their applicability to large programs, which have very large (quadratic sized) call graphs due to indirect calls. On the other hand, [FRD00] appears to scale well, but it does not provide any degree of subtyping, which is important for larger programs.…”

Section: Performance and Precision Of Golfmentioning

confidence: 97%

Estimating the Impact of Scalable Pointer Analysis on Optimization

et al. 2001

Self Cite

View full text Add to dashboard Cite

Abstract. This paper addresses the following question: Do scalable control-flow-insensitive pointer analyses provide the level of precision required to make them useful in compiler optimizations? We first describe alias frequency, a metric that measures the ability of a pointer analysis to determine that pairs of memory accesses in C programs cannot be aliases. We believe that this kind of information is useful for a variety of optimizations, while remaining independent of a particular optimization. We show that control-flow and context insensitive analyses provide the same answer as the best possible pointer analysis on at least 95% of all statically generated alias queries. In order to understand the potential run-time impact of the remaining 5% queries, we weight the alias queries by dynamic execution counts obtained from profile data. Flow-insensitive pointer analyses are accurate on at least 95% of the weighted alias queries as well. We then examine whether scalable pointer analyses are inaccurate on the remaining 5% alias queries because they are context-insensitive. To this end, we have developed a new context-sensitive pointer analysis that also serves as a general engine for tracing the flow of values in C programs. To our knowledge, it is the first technique for performing context-sensitive analysis with subtyping that scales to millions of lines of code. We find that the new algorithm does not identify fewer aliases than the contextinsensitive analysis.

show abstract

Bibliography

2012

Program Specialization

View full text Add to dashboard Cite

Scalable context-sensitive flow analysis using instantiation constraints

Cited by 99 publications

References 18 publications

Polymorphic versus Monomorphic Flow-Insensitive Points-To Analysis for C

Polymorphic versus Monomorphic Flow-Insensitive Points-To Analysis for C

Estimating the Impact of Scalable Pointer Analysis on Optimization

Bibliography

Contact Info

Product

Resources

About