Analysis of pointers and structures

Chase, David; Wegman, Mark N.; Zadeck, F. Kenneth

doi:10.1145/93548.93585

Cited by 129 publications

(122 citation statements)

References 20 publications

Supporting

Mentioning

122

Contrasting

Order By: Relevance

“…This approach was refined Zadeck et al [2] to aggregate only nodes generated from the same allocation site. Plevyak et al [11] addresses the issue of cycles by representing simple invariants between fields of nodes.…”

Section: Shape Analysismentioning

confidence: 99%

Increasing the Accuracy of Shape and Safety Analysis of Pointer-Based Codes

Diniz

2004

Languages and Compilers for Parallel Computing

View full text Add to dashboard Cite

Abstract. Analyses and transformations of programs that manipulate pointer-based data structures rely on understanding the topological relationships between the nodes ı.e., the overall shape of the data structures. Current static shape analyses either assume correctness of the code or trade-off accuracy for analysis performance, leading in most cases to shape information that is of little use for practical purposes. This paper introduces four novel analysis techniques, namely structural fields, scan loops, assumed/verified shape properties and context tracing. Analysis of structural fields allows compilers to uncover node configurations that play key roles in the data structure. Analysis of scan loops allows compilers to establish accurate relationship between variables that traverse the data structure. Assumed/verified property analysis derives sufficient shape properties that guarantee termination of loops. These properties must be verified during shape analysis for consistency. Context tracing allows the compiler to isolate data structure nodes by evaluation of conditional statements and hence preserve shape accuracy. We believe that future static shape and safety analysis algorithms will have to include some if not all of these techniques to attain a high level accuracy. In this paper we illustrate the application of the proposed techniques to codes that build (correctly as well as incorrectly) sophisticated data structures that are beyond the reach of current approaches.

show abstract

Section: Shape Analysismentioning

confidence: 99%

Increasing the Accuracy of Shape and Safety Analysis of Pointer-Based Codes

Diniz

2004

Languages and Compilers for Parallel Computing

View full text Add to dashboard Cite

show abstract

“…In existing work on pointer and shape analysis, there is a fundamental distinction between two kinds of updates to memory locations: weak updates and strong updates [1][2][3][4]. A strong update overwrites the old content of an abstract memory location l with a new value, whereas a weak update adds new values to the existing set of values associated with l. Whenever safe, it is preferable to apply strong updates to achieve better precision.…”

Section: Introductionmentioning

confidence: 99%

Fluid Updates: Beyond Strong vs. Weak Updates

Dillig

Aiken

2010

Programming Languages and Systems

120

View full text Add to dashboard Cite

Abstract. We describe a symbolic heap abstraction that unifies reasoning about arrays, pointers, and scalars, and we define a fluid update operation on this symbolic heap that relaxes the dichotomy between strong and weak updates. Our technique is fully automatic, does not suffer from the kind of state-space explosion problem partition-based approaches are prone to, and can naturally express properties that hold for non-contiguous array elements. We demonstrate the effectiveness of this technique by evaluating it on challenging array benchmarks and by automatically verifying buffer accesses and dereferences in five Unix Coreutils applications with no annotations or false alarms.

show abstract

“…In this paper we partially address this challenge by presenting and empirically evaluating a new heap abstraction, i.e., an abstraction for the (potentially unbounded) dynamically allocated storage manipulated by programs (e.g., see [7,9,2,8,16,14,15]). Heap abstractions are of fundamental importance to static analysis and verification of programs written in modern languages.…”

Section: Introductionmentioning

confidence: 99%

“…The heap abstractions most commonly used in practice, especially when scalability is important, tend to be single-shape heap abstractions, which use a single shape descriptor to describe all possible program states at a program point [9,2,14]. The current TVLA implementation provides options to utilize such single-shape heap abstractions.…”

Section: Introductionmentioning

confidence: 99%

Partially Disjunctive Heap Abstraction

Manevich

Sagiv

Ramalingam³

et al. 2004

Static Analysis

View full text Add to dashboard Cite

Abstract.One of the continuing challenges in abstract interpretation is the creation of abstractions that yield analyses that are both tractable and precise enough to prove interesting properties about real-world programs. One source of difficulty is the need to handle programs with different behaviors along different execution paths. Disjunctive (powerset) abstractions capture such distinctions in a natural way. However, in general, powerset abstractions increase space and time costs by an exponential factor. Thus, powerset abstractions are generally perceived as very costly. In this paper, we partially address this challenge by presenting and empirically evaluating a new heap abstraction. The new heap abstraction works by merging shape descriptors according to a partial isomorphism similarity criteria, resulting in a partially disjunctive abstraction. We implemented this abstraction in TVLA-a generic system for implementing program analyses.We conducted an empirical evaluation of the new abstraction and compared it with the powerset heap abstraction. The experiments show that analyses based on the partially disjunctive heap abstraction are as precise as the ones based on the powerset heap abstraction. In terms of performance, analyses based on the partially disjunctive heap abstraction are often superior to analyses based on the powerset heap abstraction. The empirical results show considerable speedups, up to 2 orders of magnitude, enabling previously non-terminating analyses, such as verification of the Deutsch-Schorr-Waite scanning algorithm, to terminate with no negative effect on the overall precision. Indeed, experience indicates that the partially disjunctive shape abstraction improves performance across all TVLA analyses uniformly, and in many cases is essential for making precise shape analysis feasible.

show abstract

Analysis of pointers and structures

Cited by 129 publications

References 20 publications

Increasing the Accuracy of Shape and Safety Analysis of Pointer-Based Codes

Increasing the Accuracy of Shape and Safety Analysis of Pointer-Based Codes

Fluid Updates: Beyond Strong vs. Weak Updates

Partially Disjunctive Heap Abstraction

Contact Info

Product

Resources

About