algorithm for Java programs. The algorithm is based on the abstraction of points-to escape graphs, which characterize how local variables and elds in objects refer to other objects. Each points-to escape graph also contains escape information, which characterizes how objects allocated in one region of the program can escape to be accessed by another region. The algorithm is designed to analyze arbitrary regions of complete or incomplete programs, obtaining complete information for objects that do not escape the analyzed regions.

This paper describes a new algorithm for flow and context insensitive pointer analysis of C programs. Our studies show that the most common use of pointers in C programs is in passing the addresses of composite objects or updateable values as arguments to procedures. Therefore, we have designed a low-cost algorithm that handles this common case accurately. In terms of both precision and running time, this algorithm lies between Steensgaard's algorithm, which treats assignments bi-directionally using unification, and Andersen's algorithm, which treats assignments directionally using subtyping. Our "one level flow" algorithm uses a restricted form of subtyping to avoid unification of symbols at the top levels of pointer chains in the points-to graph, while using unification elsewhere in the graph. The method scales easily to large programs. For instance, we are able to analyze a 1.4 MLOC (million lines of code) program in two minutes, using less than 200MB of memory. At the same time, the pr...

A new method is presented for analyzing and reengineering class hierarchies. In our approach, a class hierarchy is processed along with a set of applications that use it, and a fine-grained analysis of the access and subtype relationships between objects, variables and class members is performed. The result of this analysis is again a class hierarchy, which is guaranteed to be behaviorally equivalent to the original hierarchy, but in which each object only contains the members that are required. Our method is semantically well-founded in concept analysis: the new class hierarchy is a minimal and maximally factorized concept lattice that reflects the access and subtype relationships between variables, objects and class members. The method is primarily intended as a tool for finding imperfections in the design of class hierarchies, and can be used as the basis for tools that largely automate the process of reengineering such hierarchies. The method can also be used as a space-optimizing source-to-source transformation that removes redundant fields from objects. A prototype implementation for Java has been constructed, and used to conduct several case studies. Our results demonstrate that the method can provide valuable insights into the usage of the class hierarchy in a specific context, and lead to useful restructuring proposals.

This paper presents a practical heap analysis technique, connection analysis, that can be used to disambiguate heap accesses in C programs. The technique is designed for analyzing programs that allocate many disjoint objects in the heap such as dynamically-allocated arrays in scientific programs. The method statically estimates connection matrices which encode the connection relationships between all heap-directed pointers at each program point. The results of the analysis can be used by parallelizing compilers to determine when two heapallocated objects are guaranteed to be disjoint, and thus can be used to improve array dependence and interference analysis. The method has been implemented as a context-sensitive interprocedural analysis in the McCAT optimizing/parallelizing C compiler. Experimental results are given to compare the accuracy of connection analysis versus a conservative estimate based on points-to analysis. This work supported by NSERC, FCAR, and the EPPP project (fin...

During the past twenty-one years, over seventy-five papers and nine Ph.D. theses have been published on pointer analysis. Given the tomes of work on this topic one may wonder, "Haven't we solved this problem yet?" With input from many researchers in the field, this paper describes issues related to pointer analysis and remaining open problems.

Automatic object inlining [19, 20] transforms heap data structures by fusing parent and child objects together. It can improve runtime by reducing object allocation and pointer dereference costs. We report continuing work studying object inlining optimizations. In particular, we present a new semantic derivation of the correctness conditions for object inlining, and program analysis which extends our previous work. And we present an object inlining transformation, focusing on a new algorithm which optimizes class field layout to minimize code expansion. Finally, we detail a fuller evaluation on eleven programs and libraries (including Xpdf, the 25,000 line Portable Document Format (PDF) le browser) that utilizes hardware measures of impact on the memory system. We show that our analysis scales effectively to large programs, nding many inlinable elds (45 in xpdf) at acceptable cost, and we show that, on some programs, it finds nearly all fields for which object inlining is correct, and a...

This paper presents a novel interprocedural, ow-sensitive, and context-sensitive pointer analysis algorithm for multithreaded programs that may concurrently update shared pointers. The algorithm is designed to handle programs with structured parallel constructs, including fork-join constructs, parallel loops, and conditionally spawned threads. For each pointer and each program point, the algorithm computes a conservative approximation of the memory locations to which that pointer may point. The algorithm correctly handles a wide range of programming language constructs, including recursive functions, recursively generated parallelism, function pointers, structures, arrays, nested structures and arrays, pointer arithmetic, casts between dierent pointer types, heap and stack allocated memory, shared global variables, and thread-private global variables. We have implemented the algorithm in the SUIF compiler system and used the implementation to analyze a set of multithreaded programs written in the Cilk programming language. Our experimental results show that the analysis has good precision and converges quickly for our set of Cilk programs

The research was done under the supervision of Dr. Shmuel Sagiv and Prof. Orna

Storage Graph . . . . . . . . . . . . . . . . . . . . . . . . . 124 6.4.2 Dataow Lattice . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 6.5 Transfer Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 ix 6.5.1 Labeling execution instances . . . . . . . . . . . . . . . . . . . . . . 125 6.5.2 LTFs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 6.6 Intraprocedural Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 6.6.1 Malloc . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 6.6.2 Assignment Statements . . . . . . . . . . . . . . . . . . . . . . . . . 127 6.7 Interprocedural Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 6.7.1 Processing SCCs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 7 An elimination algorithm for interprocedural alias analysis 136 7.1.1 Alias Abstractions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 7.1.2 Elimination algorithms for interprocedural pointer analysis . . . . . 138 7.1.3 An Example Program . . . . . . . . . . . . . . . . . . . . . . . . . . 138 7.2 Induction variable introduction . . . . . . . . . . . . . . . . . . . . . . . . . 139 7.2.1 Iterative control structures . . . . . . . . . . . . . . . . . . . . . . . 140 7.2.2 Interprocedural context . . . . . . . . . . . . . . . . . . . . . . . . . 142 7.3 Sequence Tokens . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143 7.3.1 Dynamic Sequence Tokens . . . . . . . . . . . . . . . . . . . . . . . . 144 7.3.2 Interprocedural sequence tokens . . . . . . . . . . . . . . . . . . . . 145 7.4 Data types . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 7.4.1 A Layout dependent represe...

... algorithm for Java programs. The algorithm is based on the abstraction of points-to escape graphs, which characterize how local variables and elds in objects refer to other objects. Each points-to escape graph also contains escape information, which characterizes how objects allocated in one region of the program can escape to be accessed by another region. The algorithm is designed to analyze arbitrary regions of complete or incomplete programs, obtaining complete information for objects that do not escape the analyzed regions. We have