Efficient subcubic alias analysis for C

ZhangQirun,; Xiaoxiao,; ZhangCharles,; Yuan-Hao,; Su, Zhendong

doi:10.1145/2714064.2660213

Cited by 12 publications

(10 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…CFL-reachability can be used to formulate many static analyses, such as polymorphic ow analysis [24], shape analysis [27], context-insensitive [38,52] and contextsensitive [38,46] points-to analysis, and information ow analysis [20]. The work in [16,22] studies the connection between CFL-reachability and set-constraints, shows the connection between the two problems.…”

Section: Related Workmentioning

confidence: 99%

Calling-to-reference context translation via constraint-guided CFL-reachability

et al. 2018

Self Cite

View full text Add to dashboard Cite

A calling context is an important piece of information used widely to help developers understand program executions (e.g., for debugging). While calling contexts o er useful control information, information regarding data involved in a bug (e.g., what data structure holds a leaking object), in many cases, can bring developers closer to the bug's root cause. Such data information, often exhibited as heap reference paths, has already been needed by many tools. The only way for a dynamic analysis to record complete reference paths is to perform heap dumping, which incurs huge runtime overhead and renders the analysis impractical. This paper presents a novel static analysis that can precisely infer, from a calling context of a method that contains a use (e.g., read or write) of an object, the heap reference paths leading to the object at the time the use occurs. Since calling context recording is much less expensive, our technique provides bene ts for all dynamic techniques that need heap information, signi cantly reducing their overhead. CCS Concepts • Software and its engineering → Automated static analysis; Dynamic analysis;

show abstract

Section: Related Workmentioning

confidence: 99%

Calling-to-reference context translation via constraint-guided CFL-reachability

et al. 2018

Self Cite

View full text Add to dashboard Cite

show abstract

“…We let {l, u} be two symbols dened within the program code. Like the vast majority of pointer analyses available in the compiler literature, from Andersen's work [Andersen, 1994] to the more recent technique of Zhang et al [Zhang et al, 2014], our method is correct if the underlying program is also correct. In other words, our results are sound with respect to the semantics of the program if this program has no undened behavior, such as out-of-bounds accesses.…”

Section: Solutionmentioning

confidence: 99%

“…Given this importance, it comes as no surprise that pointer analysis has been one of the most researched topics within the eld of compiler construction [Hind, 2001]. This research has contributed to make the present algorithms more precise [Hardekopf and Lin, 2007;Zhang et al, 2014], and faster [Hardekopf and Lin, 2011;Shang et al, 2012]. Nevertheless, one particular feature of imperative programming languages remains to be handled satisfactorily by the current state-of-the-art approaches: the disambiguation of pointer intervals.…”

Section: Introductionmentioning

confidence: 99%

Symbolic range analysis of pointers

Paisante

Maalej

Barbosa

et al. 2016

Proceedings of the 2016 International Symposium on Code Generation and Optimization

View full text Add to dashboard Cite

Alias analysis is one of the most fundamental techniques that compilers use to optimize languages with pointers. However, in spite of all the attention that this topic has received, the current state-of-the-art approaches inside compilers still face challenges regarding precision and speed. In particular, pointer arithmetic, a key feature in C and C++, is yet to be handled satisfactorily. This work presents a new alias analysis algorithm to solve this problem. The key insight of our approach is to combine alias analysis with symbolic range analysis. This combination lets us disambiguate elds within arrays and structs, eectively achieving more precision than traditional algorithms. To validate our technique, we have implemented it on top of the LLVM compiler. Tests on a vast suite of benchmarks show that we can disambiguate several kinds of C idioms that current state-of-the-art analyses cannot deal with. In particular, we can disambiguate 1.35x more queries than the alias analysis currently available in LLVM. Furthermore, our analysis is very fast: we can go over one million assembly instructions in 10 seconds.

show abstract

“…Two nodes are L-reachable in G if there exists a path joining them, and the path string belongs to L. In the literature, the most popular L-reachability formulation is Dyck-reachability [11,27]. A Dyck language essentially generates well-balanced parentheses, which can be used to capture well-paired program properties, such as function calls/returns [17,18,24], pointer references/dereferences [29,30], locks/unlocks [10,15], and ield reads/writes [9,26,27].…”

Section: Introductionmentioning

confidence: 99%

Fast Graph Simplification for Interleaved-Dyck Reachability

Zhang

Reps

2022

ACM Trans. Program. Lang. Syst.

Self Cite

View full text Add to dashboard Cite

Many program-analysis problems can be formulated as graph-reachability problems. Interleaved Dyck language reachability ( InterDyck -reachability) is a fundamental framework to express a wide variety of program-analysis problems over edge-labeled graphs. The InterDyck language represents an intersection of multiple matched-parenthesis languages ( i.e. , Dyck languages). In practice, program analyses typically leverage one Dyck language to achieve context-sensitivity, and other Dyck languages to model data dependences, such as field-sensitivity and pointer references/dereferences. In the ideal case, an InterDyck -reachability framework should model multiple Dyck languages simultaneously . Unfortunately, precise InterDyck -reachability is undecidable. Any practical solution must over-approximate the exact answer. In the literature, a lot of work has been proposed to over-approximate the InterDyck -reachability formulation. This paper offers a new perspective on improving both the precision and the scalability of InterDyck -reachability: we aim to simplify the underlying input graph G . Our key insight is based on the observation that if an edge is not contributing to any InterDyck -paths, we can safely eliminate it from G . Our technique is orthogonal to the InterDyck -reachability formulation, and can serve as a pre-processing step with any over-approximating approach for InterDyck -reachability. We have applied our graph simplification algorithm to pre-processing the graphs from a recent InterDyck -reachability-based taint analysis for Android. Our evaluation on three popular InterDyck -reachability algorithms yields promising results. In particular, our graph-simplification method improves both the scalability and precision of all three InterDyck -reachability algorithms, sometimes dramatically.

show abstract

Efficient subcubic alias analysis for C

Cited by 12 publications

References 47 publications

Calling-to-reference context translation via constraint-guided CFL-reachability

Calling-to-reference context translation via constraint-guided CFL-reachability

Symbolic range analysis of pointers

Fast Graph Simplification for Interleaved-Dyck Reachability

Contact Info

Product

Resources

About