Heap Abstractions for Static Analysis

Abstract

Heap data is potentially unbounded and seemingly arbitrary. As a consequence, unlike stack and static memory, heap memory cannot be abstracted directly in terms of a fixed set of source variable names appearing in the program being analysed. This makes it an interesting topic of study and there is an abundance of literature employing heap abstractions. Although most studies have addressed similar concerns, their formulations and formalisms often seem dissimilar and some times even unrelated. Thus, the insights gained in one description of heap abstraction may not directly carry over to some other description. This survey is a result of our quest for a unifying theme in the existing descriptions of heap abstractions. In particular, our interest lies in the abstractions and not in the algorithms that construct them.In our search of a unified theme, we view a heap abstraction as consisting of two features: a heap model to represent the heap memory and a summarization technique for bounding the heap representation. We classify the models as storeless, store based, and hybrid. We describe various summarization techniques based on k-limiting, allocation sites, patterns, variables, other generic instrumentation predicates, and higher-order logics. This approach allows us to compare the insights of a large number of seemingly dissimilar heap abstractions and also paves way for creating new abstractions by mix-and-match of models and summarization techniques. Heap Analysis: MotivationHeap data is potentially unbounded and seemingly arbitrary. Although there is a plethora of literature on heap, the formulations and formalisms often seem dissimilar. This survey is a result of our quest for a unifying theme in the existing descriptions of heap. Why Heap?Unlike stack or static memory, heap memory allows on-demand memory allocation based on the statements in a program (and not just variable declarations). Thus it facilitates creation of flexible data structures which can outlive the procedures that create them and whose sizes can change during execution. With processors becoming faster and memories becoming larger as well as faster, the ability of creating large and flexible data structures increases. Thus the role of heap memory in user programs as well as design and implementation of programming languages becomes more significant. Why Heap Analysis? Why Heap Analysis?The increasing importance of the role of heap memory naturally leads to a myriad requirements of its analysis. Although heap data has been subjected to static as well as dynamic analyses, in this paper, we restrict ourselves to static analysis.Heap analysis, at a generic level, provides useful information about heap data, i.e. heap pointers or references. Additionally, it helps in discovering control flow through dynamic dispatch resolution. Specific applications that can benefit from heap analysis include program understanding, program refactoring, verification, debugging, enhancing security, improving performance, compile time garbage collection, inst...

Context-, flow-, and field-sensitive data-flow analysis using synchronized Pushdown systems

“…To guarantee decidability, all the CFL-formulations over-approximate either the CFL for field stores/loads or the CFL for call/returns. We refer to surveys on alias analysis and respective heap abstractions [Kanvar and Khedker 2016;Sridharan et al 2013] for more detailed comparisons. Analyses that are flow-insensitive are expected to be more memory-efficient, because persisting a single data-flow fact per method suffices.…”

Precision-guided context sensitivity for pointer analysis

“…First, a fast but imprecise context-insensitive pointer analysis is performed as a pre-analysis for Zipper. To simplify the discussion, we assume that the pre-analysis abstracts objects by their allocation-sites [Chase et al 1990], but our technique also works for other object abstractions [Kanvar and Khedker 2016]. This pre-analysis provides the information for the OFG construction, in the form of a relation pt(v) that captures the points-to set for each variable v. Based on the OFG, a PFG is constructed for each class.…”

Template-Based Verification of Heap-Manipulating Programs

“…We can only give an overview of the main lines of research in this section. For a more complete survey, we refer to [25].…”