We present a general algorithm for solving systems of inclusion constraints over type expressions. The constraint language includes function types, constructor types, and liberal intersection and union types. We illustrate the application of our constraint solving algorithm with a type inference system for the lambda calculus with constants. In this system, every pure lambda term has a (computable) type and every term typable in the Hindley/Milner system has all of its Hindley/Milner types. Thus, the inference system is an extension of the Hindley/Milner system that can type a very large set of lambda terms. 1 Introduction Type inference systems for functional languages are based on solving systems of type constraints. The best known and most widely used type inference algorithm was first discovered by Hindley and later independently by Milner [Hin69, Mil78]. In its simplest form, the algorithm generates type equations from the program text and then solves the equations. If the equati...

Many program analyses are naturally formulated and implemented using inclusion constraints. We present new results on the scalable implementation of such analyses based on two insights: first, that online elimination of cyclic constraints yields orders-of-magnitude improvements in analysis time for large problems; second, that the choice of constraint representation affects the quality and efficiency of online cycle elimination. We present an analytical model that explains our design choices and show that the model's predictions match well with results from a substantial experiment.

We describe the design and implementation of a system for very fast points-to analysis. On code bases of about a million lines of unpreprocessed C code, our system performs eldbased Andersen-style points-to analysis in less than a second and uses less than 10MB of memory. Our tw o main contributions are a database-centric analysis architecture called compile-link-analyze (CLA), and a new algorithm for implementing dynamic transitive closure. Our points-to analysis system is built into a forward data-dependence analysis tool that is deployed within Lucent to help with consistent type modi cations to large legacy C code bases. 1.

. Set constraints are a natural formalism for many problems that arise in program analysis. This paper provides a brief introduction to set constraints: what set constraints are, why they are interesting, the current state of the art, open problems, applications and implementations. 1 Introduction Set constraints are a natural formalism for describing relationships between sets of terms of a free algebra. A set constraint has the form X ` Y , where X and Y are set expressions. Examples of set expressions are 0 (the empty set), ff (a set-valued variable), c(X; Y ) (a constructor application), and the union, intersection, or complement of set expressions. Recently, there has been a great deal of interest in program analysis algorithms based on solving systems of set constraints, including analyses for functional languages [AWL94, Hei94, AW93, AM91, JM79, MR85, Rey69], logic programming languages [AL94, HJ92, HJ90b, Mis84], and imperative languages [HJ91]. In these algorithms, sets of...

. Set constraints are relations between sets of terms. They have been used extensively in various applications in program analysis and type inference. We present several results on the computational complexity of solving systems of set constraints. The systems we study form a natural complexity hierarchy depending on the form of the constraint language. 1 Introduction Systems of set constraints have received considerable attention as a formalism for expressing algorithms in program analysis and type inference. Many algorithms based on set constraints have been proposed and implemented, but very little is known about the computational complexity of solving systems of set constraints. In this paper we present complexity results for a natural hierarchy of decision problems involving set constraints. Set constraints are formal inclusions between expressions representing subsets of T \Sigma , the set of ground terms over a finite ranked alphabet \Sigma . A positive set constraint is an in...

We carry out an experimental analysis for two of the design dimensions of flow-insensitive points-to analysis for C: polymorphic versus monomorphic and equality-based versus inclusion-based. Holding other analysis parameters fixed, we measure the precision of the four design points on a suite of benchmarks of up to 90,000 abstract syntax tree nodes. Our experiments show that the benefit of polymorphism varies significantly with the underlying monomorphic analysis. For our equalitybased analysis, adding polymorphism greatly increases precision, while for our inclusion-based analysis, adding polymorphism hardly makes any difference. We also gain some insight into the nature of polymorphism in points-to analysis of C. In particular, we find considerable polymorphism available in function parameters, but little or no polymorphism in function results, and we show how this observation explains our results.

Set constraints are relations between sets of terms. They have been used extensively in various applications in program analysis and type inference. Recently, several algorithms for solving general systems of positive set constraints have appeared. In this paper we consider systems of mixed positive and negative constraints, which are considerably more expressive than positive constraints alone. We show that it is decidable whether a given such system has a solution. The proof involves a reduction to a number-theoretic decision problem that may be of independent interest.

In this paper, we describe an efficient algorithm for lazily decomposing aggregates such as records and arrays into simpler components based on the access patterns specific to a given program. This process allows us both to identify implicit aggregate structure not evident from declarative information in the program, and to simplify the representation of declared aggregates when references are made only to a subset of their components. We show that the structure identification process can be exploited to yield the following principal results: - A fast type analysis algorithm applicable to program maintenance applications such as date usage inference for the "Year 2000" problem. - An efficient algorithm for atomization of aggregates. Given a program, an aggregate atomization decomposes all of the data that can be manipulated by the program into a set of disjoint atoms such that each data reference can be modeled as one or more references to atoms without loss of semantic information. A...

Combinatorial problems involving sets and relations are currently tackled by integer programming and expressed with vectors or matrices of 0-1 variables. This is efficient but not flexible and unnatural in problem formulation. Toward a natural programming of combinatorial problems based on sets, graphs or relations, we define a new CLP language with set constraints. This language Conjunto 1 aims at combining the declarative aspect of Prolog with the efficiency of constraint solving techniques. We propose to constrain a set variable to range over finite set domains specified by lower and upper bounds for set inclusion. Conjunto is based on the inclusion and disjointness constraints applied to set expressions which comprise the union, intersection and difference symbols. The main contribution herein is the constraint handler which performs constraint propagation by applying consistency techniques over set constraints. 1 Introduction Various systems of set constraints have been define...

We present an algorithm for automatic type checking of logic programs with respect to directional types that describe both the structure of terms and the directionality of predicates. The type checking problem is reduced to a decidable problem on systems of inclusion constraints over set expressions. We discuss some properties of the reduction algorithm, complexity, and present a proof of correctness. 1 1 Introduction Most logic programming languages are untyped. In Prolog, for example, it is considered meaningful to apply any n-ary predicate to any n-tuple of terms. However, it is generally accepted that static type checking has great advantages in detecting programming errors early and for generating efficient executable code. Motivated at least in part by the success of type systems for procedural and functional languages, there is currently considerable interest in finding appropriate definitions of type and welltyping for logic languages. This paper explores the type checki...