Results 1  10
of
11
Parametric Shape Analysis via 3Valued Logic
, 1999
"... Shape Analysis concerns the problem of determining "shape invariants"... ..."
Abstract

Cited by 539 (71 self)
 Add to MetaCart
Shape Analysis concerns the problem of determining "shape invariants"...
Alias Types for Recursive Data Structures
, 2000
"... Linear type systems permit programmers to deallocate or explicitly recycle memory, but they are severly restricted by the fact that they admit no aliasing. This paper describes a pseudolinear type system that allows a degree of aliasing and memory reuse as well as the ability to define complex recu ..."
Abstract

Cited by 137 (14 self)
 Add to MetaCart
Linear type systems permit programmers to deallocate or explicitly recycle memory, but they are severly restricted by the fact that they admit no aliasing. This paper describes a pseudolinear type system that allows a degree of aliasing and memory reuse as well as the ability to define complex recursive data structures. Our type system can encode conventional linear data structures such as linear lists and trees as well as more sophisticated data structures including cyclic and doublylinked lists and trees. In the latter cases, our type system is expressive enough to represent pointer aliasing and yet safely permit destructive operations such as object deallocation. We demonstrate the flexibility of our type system by encoding two common compiler optimizations: destinationpassing style and DeutschSchorrWaite or "linkreversal" traversal algorithms.
Pointer analysis: Havenâ€™t we solved this problem yet?
 PASTE'01
, 2001
"... During the past twentyone years, over seventyfive papers and nine Ph.D. theses have been published on pointer analysis. Given the tomes of work on this topic one may wonder, "Haven't we solved this problem yet?" With input from many researchers in the field, this paper describes issues related to ..."
Abstract

Cited by 82 (1 self)
 Add to MetaCart
During the past twentyone years, over seventyfive papers and nine Ph.D. theses have been published on pointer analysis. Given the tomes of work on this topic one may wonder, "Haven't we solved this problem yet?" With input from many researchers in the field, this paper describes issues related to pointer analysis and remaining open problems.
Connection Analysis: A Practical Interprocedural Heap Analysis for C
 International Journal of Parallel Programming
, 1995
"... This paper presents a practical heap analysis technique, connection analysis, that can be used to disambiguate heap accesses in C programs. The technique is designed for analyzing programs that allocate many disjoint objects in the heap such as dynamicallyallocated arrays in scientific programs. Th ..."
Abstract

Cited by 72 (5 self)
 Add to MetaCart
This paper presents a practical heap analysis technique, connection analysis, that can be used to disambiguate heap accesses in C programs. The technique is designed for analyzing programs that allocate many disjoint objects in the heap such as dynamicallyallocated arrays in scientific programs. The method statically estimates connection matrices which encode the connection relationships between all heapdirected pointers at each program point. The results of the analysis can be used by parallelizing compilers to determine when two heapallocated objects are guaranteed to be disjoint, and thus can be used to improve array dependence and interference analysis. The method has been implemented as a contextsensitive interprocedural analysis in the McCAT optimizing/parallelizing C compiler. Experimental results are given to compare the accuracy of connection analysis versus a conservative estimate based on pointsto analysis. This work supported by NSERC, FCAR, and the EPPP project (fin...
Shape Analysis
, 2000
"... A shapeanalysis algorithm statically analyzes a program to determine information about the heapallocated data structures that the program manipulates. The results can be used to understand or verify programs. They also contain information valuable for debugging, compiletime garbage collection ..."
Abstract

Cited by 51 (0 self)
 Add to MetaCart
A shapeanalysis algorithm statically analyzes a program to determine information about the heapallocated data structures that the program manipulates. The results can be used to understand or verify programs. They also contain information valuable for debugging, compiletime garbage collection, instruction scheduling, and parallelization.
Interprocedural Shape Analysis for Recursive Programs
 In: Comp. Construct. Volume 2027 of Lec. Notes in Comp. Sci
, 2001
"... A shapeanalysis algorithm statically analyzes a program to determine information about the heapallocated data structures that the program manipulates. The results can be used to optimize, understand, debug, or verify programs. Existing algorithms are quite imprecise in the presence of recursiv ..."
Abstract

Cited by 26 (8 self)
 Add to MetaCart
A shapeanalysis algorithm statically analyzes a program to determine information about the heapallocated data structures that the program manipulates. The results can be used to optimize, understand, debug, or verify programs. Existing algorithms are quite imprecise in the presence of recursive procedure calls. This is unfortunate, since recursion provides a natural way to manipulate linked data structures. We present a novel technique for shape analysis of recursive programs. An algorithm based on our technique has been implemented. It handles programs manipulating linked lists written in a subset of C. The algorithm is signicantly more precise than existing algorithms. For example, it can verify the absence of memory leaks in many recursive programs; this is beyond the capabilities of existing algorithms. 1
Existential heap abstraction entailment is undecidable
 In 10th Annual International Static Analysis Symposium (SAS 2003
, 2003
"... Abstract. In this paper we study constraints for specifying properties of data structures consisting of linked objects allocated in the heap. Motivated by heap summary graphs in role analysis and shape analysis we introduce the notion of regular graph constraints. A regular graph constraint is a gra ..."
Abstract

Cited by 14 (7 self)
 Add to MetaCart
Abstract. In this paper we study constraints for specifying properties of data structures consisting of linked objects allocated in the heap. Motivated by heap summary graphs in role analysis and shape analysis we introduce the notion of regular graph constraints. A regular graph constraint is a graph representing the heap summary; a heap satisfies a constraint if and only if the heap can be homomorphically mapped to the summary. Regular graph constraints form a very simple and natural fragment of the existential monadic secondorder logic over graphs. One of the key problems in a compositional static analysis is proving that procedure preconditions are satisfied at every call site. For role analysis, precondition checking requires determining the validity of implication, i.e., entailment of regular graph constraints. The central result of this paper is the undecidability of regular graph constraint entailment. The undecidability of the entailment problem is surprising because of the simplicity of regular graph constraints: in particular, the satisfiability of regular graph constraints is decidable. Our undecidability result implies that there is no complete algorithm for statically checking procedure preconditions or postconditions, simplifying static analysis results, or checking that given analysis results are correct. While incomplete conservative algorithms for regular graph constraint entailment checking are possible, we argue that heap specification languages should avoid secondorder existential quantification in favor of explicitly specifying a criterion for summarizing objects.
Typestate checking and regular graph constraints
, 2002
"... Abstract We introduce regular graph constraints and explore their decidability properties. The motivation for regular graph constraints is 1) type checking of changing types of objects in the presence of linked data structures, 2) shape analysis techniques, and 3) generalization of similar constrain ..."
Abstract

Cited by 8 (7 self)
 Add to MetaCart
Abstract We introduce regular graph constraints and explore their decidability properties. The motivation for regular graph constraints is 1) type checking of changing types of objects in the presence of linked data structures, 2) shape analysis techniques, and 3) generalization of similar constraints over trees and grids. Typestate checking for recursive and potentially cyclic data structures requires verifying the validity of implication for regular graph constraints. The implication of regular graph constraints also arises in shape analysis algorithms such as roleanalysis and some analyses based on threevalued logic. Over the class of lists regular graph constraints reduce to a nondeterministic finite state automaton as a special case. Over the class of trees the constraints reduce to a nondeterministic topdown tree automaton, and over the class of grids our constraints reduce to domino system and tiling problems. We define a subclass of graphs called heaps as an abstraction of the data structures that a program constructs during its execution. We show that satisfiability of regular graph constraints over the class of heaps is decidable. However, determining the validity of implication for regular graph constraints over the class of heaps is undecidable. The undecidability of implication is the central result of the paper. The result is somewhat surprising because our simple constraints are strictly less expressive than existential monadic secondorder logic over graphs. In the key step of our proof we introduce the class of corresponder graphs which mimic solutions of Post correspondence problem instances. We show undecidability by exhibiting a characterization of corresponder graphs in terms of presence and absence of homomorphisms to a finite number of fixed graphs.
An Improved Intraprocedural Mayalias Analysis Algorithm
, 1999
"... Hind et al. ([5]) use a standard dataflow framework [15, 16] to formulate an intraprocedural mayalias computation. The intraprocedural aliasing information is computed by applying wellknown iterative techniques to the Sparse Evaluation Graph (SEG) ([3]). The computation requires a transfer funct ..."
Abstract

Cited by 8 (2 self)
 Add to MetaCart
Hind et al. ([5]) use a standard dataflow framework [15, 16] to formulate an intraprocedural mayalias computation. The intraprocedural aliasing information is computed by applying wellknown iterative techniques to the Sparse Evaluation Graph (SEG) ([3]). The computation requires a transfer function for each node that causes a potential pointer assignment (relating the dataflow information owing into and out of the node), and a set of aliases holding at the entry node of the SEG. The intraprocedural analysis assumes that precomputed information in the form of summary functions is available for all functioncall sites in the procedure being analyzed. The time complexity of the intraprocedural mayalias computation for the algorithm presented by Hind et al. ([5]) is O(N 6 ) in the worst case (where N is the size of the SEG). In this paper we present a worst case O(N 3 ) time algorithm to compute the same mayalias information.