Demand-driven pointer analysis

Abstract

Known algorithms for pointer analysis are "global" in the sense that they perform an exhaustive analysis of a program or program component. In this paper we introduce a demand-driven approach for pointer analysis. Specifically, we describe a demand-driven flow-insensitive, subset-based, context-insensitive points-to analysis. Given a list of pointer variables (a query), our analysis performs just enough computation to determine the points-to sets for these query variables. Using deductive reachability formulations of both the exhaustive and the demand-driven analyses, we prove that our algorithm is correct. We also show that our analysis is optimal in the sense that it does not do more work than necessary. We illustrate the feasibility and efficiency of our analysis with an implementation of demand-driven points-to analysis for computing the call-graphs of C programs with function pointers. The performance of our system varies substantially across benchmarks -the main factor is how much of the points-to graph must be computed to determine the call-graph. For some benchmarks, only a small part of the points-to graph is needed (e.g povray, emacs and gcc), and here we see more than a 10x speedup. For other benchmarks (e.g. burlap and gimp), we need to compute most (> 95%) of the points-to graph, and here the demanddriven algorithm is considerably slower, because using the demand-driven algorithm is a slow method of computing the full points-to graph. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. PLDI 2001 6/01 Snowbird, Utah, USA

Incremental and demand-driven points-to analysis using logic programming

“…The rules in Figure 3 are similar to the inference rules for demand driven analysis in [19]. The mode based specialization presented here is straightforward.…”

“…To simplify our presentation, we assume that the program is decomposed to a set of primitive assignment statements of the following form: Figure 1 shows the points-to analysis rules for each assignment statements (from [19]). In the figure x −→ y denotes that x may point to y.…”

“…Among the many works on points-to analysis, Heintze and Tardieu [20,19] encode flow-insensitive and context-insensitive subset-based pointer analysis due to Anderson [3] using deductive rules. Our encoding in Section 2 follows [19].…”

“…Our encoding in Section 2 follows [19]. We derive demanddriven as well as incremental analyses directly based on these rules.…”

The Vulnerability Analysis Framework for Java Bytecode

“…Since this relationship can describe the flow of information inside the program, so many analysts use it to analyze the security problem. The points-to relationship is widely used in the dataflow analysis [12,13]. SPARK [14] does a lot of work in points-to analysis, but it aims to optimize the performance of the program, so its definition of the start of points-to relationship dose not meets the security analysis.…”