Points-to analysis in almost linear time

Abstract

We present an interprocedural flow-insensitive points-to analysis based on type inference methods with an almost linear time cost complexity. To our knowledge, this is the asymptotically fastest non-trivial interprocedural points-to analysis algorithm yet described. The algorithm is based on a non-standard type system. The type inferred for any variable represents a set of locations and includes a type which in turn represents a set of locations possibly pointed to by the variable. The type inferred for a function variable represents a set of functions it may point to and includes a type signature for these functions. The results are equivalent to those of a flowinsensitive alias analysis (and control flow analysis) that assumes alias relations are reflexive and transitive.This work makes three contributions. The first is a type system for describing a universally valid storage shape graph for a program in linear space. The second is a constraint system which often leads to better results than the "obvious" constraint system for the given type system. The third is an almost linear time algorithm for points-to analysis by solving a constraint system.Modern optimizing compilers and program understanding and browsing tools for pointer languages such as C [KR88] are dependent on semantic information obtained by either an alias analysis or a points-to analysis. Alias analyses compute pairs of expressions (or access paths) that may be aliased (e.g., [LR92,LRZ93]). Pointsto analyses compute a store model using abstract locations (e.g., [CWZ90, EGH94, WL95, Ruf95]). Most current compilers and programming tools use only intraprocedural analyses, as the polynomial time and space complexity of the common data-flow based analyses prevents the use of interprocedural analyses for large programs. Interprocedural analysis is becoming increasingly important, as it is necessary to support whole-program optimization and various program understanding tools. Previously published interprocedural analysis algorithms have not been reported to have been successfully applied to programs around 100,000 lines of C code (the published results are practically all for less than 10,000 lines of C code). Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that new copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, to republish, to post on servers or to redistribute requires prior specific permission and/or a fee. Request permissions from Publications Dept, ACM Inc, Fax +1 (212) 869-0481, or <permissions@acm.org>.We present a flow-insensitive interprocedural points-to analysis algorithm that has a desirable linear space and almost linear time complexity and is also very fast in practice. The algorithm is easily applicable to programs with m...

A GPU implementation of inclusion-based points-to analysis

“…The literature contains many variations of points-to analysis: context-sensitive versus context-insensitive, flow-sensitive versus flow-insensitive, etc. [3,6,12,13,15,33,35]. These variations make different trade-offs between precision and running time, but production compilers like gcc and LLVM seem to have settled on context-insensitive, flow-insensitive points-to analysis because the more precise alternatives are currently intractable for very large programs.…”

The Flow-Insensitive Precision of Andersen’s Analysis in Practice

“…Unions, structures, and dynamic memory allocation are handled with summary locations. To resolve function pointers, our constraint generator uses CIL's built-in Steensgaard analysis [18]. The constraints are then analyzed using our own implementation of Andersen's analysis.…”

Soundness of Data Flow Analyses for Weak Memory Models

“…With the re-Analysis Soundness w.r.t. weak memory models Knoop et al [33] yes (separable) Chugh et al [34] yes (if no datarace) Steensgaard [35] yes (flow-insensitive) Miné [16] yes Rugina and Rinard [24] yes Jeannet [14] no Ferrara [15] yes on Java Memory Model Farzan and Kincaid [25] yes (separable) Khedker and Dhamdhere [36] separable: yes; non-separable: not in general Constant propagation [32] yes (non-relational) Fig. 6.…”

“…Rinard observes in [11] that flow insensitive analyses such as Steensgaard's pointer analysis [35] are SC-sound. Hence by Thm.…”