Towards Path-Sensitive Points-to Analysis

Johannes, Jendrik

doi:10.1109/scam.2007.26

Cited by 7 publications

(7 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Symbolic pointer analysis has been discussed in the literature [17][18][19]32]. Zhu [18] used a boolean function represented by BDD to capture the program state of a procedure, while BDDs are known to suffer from exponential blow-up on multiplication, division, which are all frequent operation in programs.…”

Section: Related Workmentioning

confidence: 99%

“…Zhu [18] used a boolean function represented by BDD to capture the program state of a procedure, while BDDs are known to suffer from exponential blow-up on multiplication, division, which are all frequent operation in programs. Gutzmann [32] suggested a new way to achieve path-sensitive pointer analysis, but it might lead to an unacceptably low absolute performance. One of the most related work with ours is [17], in which the symbolic evaluation technique was used to handling heap algebra for detecting memory leaks, but the symbolic heap algebra and the pointer graph reachability algorithm were somehow too complicate and with a poor efficiency; our STVL not only supports the heap memory abstraction, but also naturally supports the pointer arithmetic and alias analysis.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

STVL: Improve the Precision of Static Defect Detection with Symbolic Three-Valued Logic

Zhao

Wang

Gong

et al. 2011

2011 18th Asia-Pacific Software Engineering Conference

View full text Add to dashboard Cite

Among various abstract domains, the interval domain is simple but also less precise. To improve the precision of static defect detection based on the interval domain, we propose a symbolic three-valued logic (STVL) based interval analysis. Our STVL differs from other symbolic techniques in that it is capable of handling the logical relationship between variables, which could help eliminating false positives. In addition, for the pointer related defect detection, we introduce a STVL-based pointer model, which naturally supports the pointer arithmetic operation, alias analysis and point-to memory abstraction. Moreover, we present a unified symbolic procedure summary model, also STVL-based, to extract the call effect of each invocation and achieve context-sensitivity. Experimental results indicate that the technique is able to achieve sizable precision improvements at reasonable costs, compared with the none-symbolic method.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

STVL: Improve the Precision of Static Defect Detection with Symbolic Three-Valued Logic

Zhao

Wang

Gong

et al. 2011

2011 18th Asia-Pacific Software Engineering Conference

View full text Add to dashboard Cite

show abstract

“…al [23] present an approach that retains control-flow information by inserting path-specific filter operations in the program dataflow. The filter operations correspond to different types of branching conditions in the control flow.…”

Section: Points-to Analysismentioning

confidence: 99%

Decisions: Algebra and Implementation

Danylenko

Lundberg

Löwe

2011

Machine Learning and Data Mining in Pattern Recognition

Self Cite

View full text Add to dashboard Cite

Processing decision information is a constitutive part in a number of applications in Computer Science fields. In general, decision information can be used to deduce the relationship between a certain context and a certain decision. Decision information is represented by a decision model that captures this information. Frequently used examples of decision models are decision tables and decision trees. The choice of an appropriate decision model has an impact on application performance in terms of memory consumption and execution time. High memory expenses can possibly occur due to redundancy in a decision model; and high execution time is often a consequence of an unsuitable decision model. Applications in different domains try to overcome these problems by introducing new data structures or algorithms for implementing decision models. These solutions are usually domain-specific and hard to transfer from one domain to another.Different application domains of Computer Science often process decision information in a similar way and, hence, have similar problems. We should thus be able to present a unifying approach that can be applicable in all application domains for capturing and manipulating decision information. Therefore, the goal of this thesis is (i) to suggest a general structure (Decision Algebra) which provides a common theoretical framework that captures decision information and defines operations (signatures) for storing, accessing, merging, approximating, and manipulating such information along with some general algebraic laws regardless of the used implementation. Our Decision Algebra allows defining different construction strategies for decision models and data structures that capture decision information as implementation variants, and it simplifies experimental comparisons between them.Additionally, this thesis presents (ii) an implementation of Decision Algebra capturing the information in a non-redundant way and performing the operations efficiently. In fact, we show that existing decision models that originated in the field of Data Mining and Machine Learning and variants thereof as exploited in special algorithms can be understood as alternative implementation variants of the Decision Algebra by varying the implementations of the Decision Algebra operations. Hence, this work (iii) will contribute to a classification of existing technology for processing decision information in different application domains of Computer Science.

show abstract

“…In addition to the upper bounds from automated feedback, we allow even coarse grained hints which are more accessible to human insight, i.e., (1) which code can be considered dead, (2) what arguments to or return values of methods are infeasible, (3) what call relations can not be taken. Figure 3.1 shows a short example code of where such manual feedback is trivial but which many points-to analysis algorithms cannot deduct: (1) The user is able to prove that method f () never returns −1, so that the code at line 6 can be considered dead.…”

Section: Manual Feedbackmentioning

confidence: 99%

“…For future work, it should be possible to perform this optimization automatically by inserting special filter-operations (cf. [2]) into the analysis' program representation.…”

Section: Polymorphic Calls In Branching Conditionsmentioning

confidence: 99%

Feedback-driven points-to analysis

Gutzmann

Lundberg

Löwe

2011

Proceedings of the 2011 ACM Symposium on Applied Computing

Self Cite

View full text Add to dashboard Cite

Points-to analysis is a static program analysis that extracts reference information from a given input program. Its accuracy is limited due to abstractions that any such analysis needs to make. Further, the exact analysis results are unknown, i.e., no so-called Gold Standard exists for points-to analysis. This hinders the assessment of new ideas to pointsto analysis, as results can be compared only relative to results obtained by other inaccurate analyses.In this paper, we present feedback-driven points-to analysis. We suggest performing (any classical) points-to analysis with the points-to results at certain program points guarded by a-priori upper bounds. Such upper bounds can come from other points-to analyses -this is of interest when different approaches are not strictly ordered in terms of accuracy -and from human insight, i.e., manual proofs that certain points-to relations are infeasible for every program run. This gives us a tool at hand to compute very accurate points-to analysis and, ultimately, to manually create a Gold Standard.

show abstract

Towards Path-Sensitive Points-to Analysis

Cited by 7 publications

References 25 publications

STVL: Improve the Precision of Static Defect Detection with Symbolic Three-Valued Logic

STVL: Improve the Precision of Static Defect Detection with Symbolic Three-Valued Logic

Decisions: Algebra and Implementation

Feedback-driven points-to analysis

Contact Info

Product

Resources

About