Symbolic range analysis of pointers

Abstract

Alias analysis is one of the most fundamental techniques that compilers use to optimize languages with pointers. However, in spite of all the attention that this topic has received, the current state-of-the-art approaches inside compilers still face challenges regarding precision and speed. In particular, pointer arithmetic, a key feature in C and C++, is yet to be handled satisfactorily. This work presents a new alias analysis algorithm to solve this problem. The key insight of our approach is to combine alias analysis with symbolic range analysis. This combination lets us disambiguate elds within arrays and structs, eectively achieving more precision than traditional algorithms. To validate our technique, we have implemented it on top of the LLVM compiler. Tests on a vast suite of benchmarks show that we can disambiguate several kinds of C idioms that current state-of-the-art analyses cannot deal with. In particular, we can disambiguate 1.35x more queries than the alias analysis currently available in LLVM. Furthermore, our analysis is very fast: we can go over one million assembly instructions in 10 seconds.

Pointer disambiguation via strict inequalities

“…Aliasing is also impossible in well-defined programs between references derived from non-aliased base pointers. Additionally, derived pointers whose offsets have nonoverlapping ranges cannot alias, as discussed in previous work [4,27,31]. Thus, our analysis says nothing about p1 and p2 in scenarios as simple as: p1 = malloc(); p2 = malloc(), or p1 = p + 1; p2 = p + 2.…”

“…There are points-to analyses designed specifically to deal with pointer arithmetics [2,4,24,27,31,32,37,39,41]. Still, none of them works satisfactorily for the two examples seen in Figure 1.…”

“…Range-Based Alias Analyses There exist several different pointer disambiguation strategies that associate ranges with pointers [2,4,5,24,27,31,32,37,39,41]. They all share a common idea: two memory addresses p 1 + [l 1 , u 1 ] and p 2 + [l 2 , u 2 ] do not alias if the intervals [p 1 + l 1 , p 1 + u 1 ] and [p 2 + l 2 , p 2 + u 2 ] do not overlap.…”

“…State-of-the-art approaches perform such distinction by solving diophantine equations, be it via the greatest common divisor test, be it via integer linear programming, as Rugina and Rinard do [31]. Other techniques try to associate intervals, numeric or symbolic, with pointers [4,26,27,44], presenting different ways to build Balakrishnan In this paper, we present a simple and efficient solution to this shortcoming. We say that v[i] and v[j] are obviously different locations because i < j.…”

The computer for the 21st century: present security & privacy challenges

“…In the second front, researchers have devised analyses that infer the contents [48] and the size of arrays [49] in weakly-typed programming languages. More importantly, recent years have seen a new flurry of algorithms designed to analyze C/C++ style pointer arithmetics [50][51][52][53]. The wide adoption of higher-level programming languages coupled with the construction of new tools to analyze lower-level languages is exciting.…”