Alias analysis is one of the most fundamental techniques that compilers use to optimize languages with pointers. However, in spite of all the attention that this topic has received, the current state-of-the-art approaches inside compilers still face challenges regarding precision and speed. In particular, pointer arithmetic, a key feature in C and C++, is yet to be handled satisfactorily. This work presents a new alias analysis algorithm to solve this problem. The key insight of our approach is to combine alias analysis with symbolic range analysis. This combination lets us disambiguate elds within arrays and structs, eectively achieving more precision than traditional algorithms. To validate our technique, we have implemented it on top of the LLVM compiler. Tests on a vast suite of benchmarks show that we can disambiguate several kinds of C idioms that current state-of-the-art analyses cannot deal with. In particular, we can disambiguate 1.35x more queries than the alias analysis currently available in LLVM. Furthermore, our analysis is very fast: we can go over one million assembly instructions in 10 seconds.

The design and implementation of static analyses that disambiguate pointers has been a focus of research since the early days of compiler construction. One of the challenges that arise in this context is the analysis of languages that support pointer arithmetics, such as C, C++ and assembly dialects. This paper contributes to solve this challenge. We start from an obvious, yet unexplored, observation: if a pointer is strictly less than another, they cannot alias. Motivated by this remark, we use abstract interpretation to build strict less-than relations between pointers. We construct a program representation that bestows the Static Single Information (SSI) property onto our dataflow analysis. SSI gives us a sparse algorithm, whose correctness is easy to ensure. We have implemented our static analysis in LLVM. It runs in time linear on the number of program variables, and, depending on the benchmark, it can be as much as six times more precise than the pointer disambiguation techniques already in place in that compiler.

HAL is a multidisciplinary open access archive for the deposit and dissemination of scientific research documents, whether they are published or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers. L'archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

A análise de largura de variáveis determina o maior e menor valores que cada variável inteira de um programa pode assumir durante a sua execução. Tal técnica é de suma importância para detectar vulnerabilidades em programas mas, até o momento, não existe abordagem que aplique essa análise em sistemas distribuídos. Tal omissão é séria, uma vez que esse tipo de sistema é alvo comum de ataques de software. O objetivo deste artigo é preencher tal lacuna. Valendo-nos de um algoritmo recente para inferir protocolos de comunicação, nós projetamos, implementamos e testamos uma análise de largura de variáveis para sistemas distribuídos. Nosso algoritmo, ao prover uma visão holística do sistema distribuído, é mais preciso que analisar cada parte daquele sistema separadamente. Demonstramos tal fato via uma série de exemplos e experimentos realizados sobre os programas presentes em SPEC CPU 2006. Um protótipo de nossa ferramenta, implementado sobre o compilador LLVM, está disponível para escrutínio.

This paper presents a strategy to improve the integer range analysis on networked programs by taking advantage of a key characteristic. The integer range analysis is one strategy to detect integer overflow occurrences in programs. Even though this analysis can be applied to networked programs as-is, the proposed approach aims at taking advantage of the messages that programs send to each other to improve the integer range analysis.