Points-to analysis by type inference of programs with structures and unions

Abstract

We present an interprocedural flow-insensitive points-to analysis algorithm based on monomorphic type inference. The source language model the important features of C including pointers, pointer arithmetic, pointers to functions, structured objects, and unions. The algorithm is based on a non-standard type system where types represent nodes and edges in a storage shape graph.This work is an extension of previous work on performing points-to analysis of C programs in almost linear time. This work makes three new contributions. The first is an extension of a type system for describing storage shape graphs to include objects with internal structure. The second is a constraint system that can deal with arbitrary use of pointers and which incorporates a two-tier domain of pointer offsets to improve the results of the analysis. The third is an efficient inference algorithm for the constraint system, leading to an algorithm that has close to linear time and space performance in practice.Keywords: interprocedural program analysis, points-to analysis, C programs, standard types, constraint solving. noni IntroductionModern optimizing compilers and program understanding and browsing tools for pointer languages like C lAme89, KR88] are dependent on semantic information obtained by either an alias analysis or a points-to analysis. Alias analyses compute pairs of expressions (or access paths) that may be aliased (e.g., [LR92,LRZ93]). Pointsto analyses compute a store model using abstract locations (e.g., [CWZ90,EGH94,WL95,Ruf95]). Points-to analysis results serve no purpose in themselves, but they are a prerequisite for most other analyses and transformations for imperative programs (e.g., computing use-def relations, permitted code motion, and detection of use of uninitialized variables).Most current compilers and programming tools use only intraprocedural points-to analyses, as the polynomial time and space complexity of the common data-flow based points-to analyses prevents the use of interprocedural analyses for large programs. Interprocedural analysis is becoming increasingly important, as it is a prerequisite for whole-program optimization and various program understanding tools.

Automated bug detection for pointers and memory accesses in High-Level Synthesis compilers

“…The first point is usually inferred using alias-analysis (or pointsto analysis [15]) and/or decided with explicit directives. The process is described in [8], which also outlines some optimizations to save resources and superfluous accesses.…”

“…This means that s does not point to any valid SW memory location. Hence the discrepancy analysis cannot give conclusive results because there is no SW memory location to compare with HW (lines [14][15][16]. If the lookup in the SAT succeeds, then the variable i is used as key for a second lookup, this time in the HAT (line 3-4).…”

“…When the analysis is not fully resolved, the address discrepancy analysis may have to give up in some cases. If the analyzed pointer is not in range for any memoryallocated variable (a so called wild pointer), Algorithm 1 never returns a mismatch (lines [14][15][16]. The reason is that only inrange memory locations are mapped in HW, thus out-of-bound addresses cannot be checked.…”

Towards the Integration of Symbolic and Numerical Static Analysis

“…This graph is iteratively refined by narrowing intervals and pruning edges. The process is bootstrapped by using the memory graph produced by Steensgaard's analysis [16], and subsequent phases essentially consist of arithmetic manipulations on the labels of the graph. We have applied this static checker to codes ranging from 140 KLOC to 550 KLOC (the flight software of the current mission Mars Exploration Rovers).…”

“…We will call the former "symbolic static analysis" and the latter "numerical static analysis". Both areas were successful in effectively analyzing large applications [16,6,11,2,4]. However, symbolic and numerical static analysis are commonly regarded as entirely orthogonal problems.…”