## The set constraint/cfl reachability connection in practice (2004)

### Cached

### Download Links

- [pag.csail.mit.edu]
- [pag.lcs.mit.edu]
- [theory.stanford.edu]
- [morpheus.cs.ucdavis.edu]
- DBLP

### Other Repositories/Bibliography

Citations: | 29 - 3 self |

### BibTeX

@MISC{Kodumal04theset,

author = {John Kodumal and Alex Aiken},

title = {The set constraint/cfl reachability connection in practice},

year = {2004}

}

### Years of Citing Articles

### OpenURL

### Abstract

Many program analyses can be reduced to graph reachability problems involving a limited form of context-free language reachability called Dyck-CFL reachability. We show a new reduction from Dyck-CFL reachability to set constraints that can be used in practice to solve these problems. Our reduction is much simpler than the general reduction from context-free language reachability to set constraints. We have implemented our reduction on top of a set constraints toolkit and tested its performance on a substantial polymorphic flow analysis application.

### Citations

697 | Interprocedural slicing using dependence graphs
- Horwitz, Reps, et al.
- 1990
(Show Context)
Citation Context ... of Rehof et al.’s work was to polymorphic points-to analysis [3]. Other applications of Dyck-CFL reachability include field-sensitive points-to analysis, shape analysis [16], interprocedural slicing =-=[9]-=-, and debugging systems of unification constraints [2]. 7. CONCLUSION We have shown a reduction from Dyck-CFL reachability to set constraints, and shown that our technique can be applied in practice t... |

369 | Precise interprocedural dataflow analysis via graph reachability
- Reps, Horwitz, et al.
- 1995
(Show Context)
Citation Context ...s context-free language (CFL) reachability problems. These include applications such as type-based polymorphic flow analysis, field-sensitive points-to analysis, and interprocedural dataflow analysis =-=[15, 17, 18]-=-. Getting CFL-based Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for prof... |

357 | A Theory of Type Qualifiers
- Foster, Fähndrich, et al.
- 1999
(Show Context)
Citation Context ...(buf); } The call exec(buf) is probably not safe, since the buffer may come from a malicious or untrusted source. The particular tainting analysis we use employs type qualifiers to solve this problem =-=[5]-=-. Briefly, we can detect errors like the example shown above by introducing two type qualifiers tainted and untainted. Data that may come from an untrusted source is given the type qualifier tainted, ... |

198 | Detecting format string vulnerabilities with type qualifiers
- SHANKAR, TALWAR, et al.
- 2001
(Show Context)
Citation Context ...Dyck-CFL reachability problem. In this section, we apply our technique to the problem of polymorphic flow analysis. For concreteness, we consider the specific problem of polymorphic tainting analysis =-=[20]-=-. In tainting analysis, we are interested in checking whether any values possibly under adversarial control can flow to functions that expect trusted data. As a trivial example, consider the following... |

119 | Program analysis via graph reachability
- Reps
- 1998
(Show Context)
Citation Context ...s context-free language (CFL) reachability problems. These include applications such as type-based polymorphic flow analysis, field-sensitive points-to analysis, and interprocedural dataflow analysis =-=[15, 17, 18]-=-. Getting CFL-based Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for prof... |

113 | Ultra-fast aliasing analysis using CLA: A million lines of C code in a second
- Heintze, Tardieu
- 2001
(Show Context)
Citation Context ...yses have been shown to scale to large programs on applications such as points-to analysis, shape analysis, and receiver class prediction, though scalability requires highly optimized implementations =-=[4, 8, 19, 21]-=-. Recently, a number of program analyses have been formulated as context-free language (CFL) reachability problems. These include applications such as type-based polymorphic flow analysis, field-sensi... |

112 | Partial online cycle elimination in inclusion constraint graphs
- Fahndrich, Foster, et al.
- 1998
(Show Context)
Citation Context ...yses have been shown to scale to large programs on applications such as points-to analysis, shape analysis, and receiver class prediction, though scalability requires highly optimized implementations =-=[4, 8, 19, 21]-=-. Recently, a number of program analyses have been formulated as context-free language (CFL) reachability problems. These include applications such as type-based polymorphic flow analysis, field-sensi... |

95 |
Set Based Program Analysis
- Heintze
- 1993
(Show Context)
Citation Context ...hown. 2.2 Set Constraints In this subsection, we review the set constraints framework introduced in [21]. We define a language of set constraints (essentially a subset of the full language defined in =-=[1, 6]-=-) and discuss inductive form, a graph-based representation of set constraints. 2.2.1 A Language of Set Constraints A constraint system is a finite collection of set constraints. A set constraint is a ... |

78 |
Solving Systems of Set Constraints
- Aiken, Wimmers
- 1992
(Show Context)
Citation Context ...hown. 2.2 Set Constraints In this subsection, we review the set constraints framework introduced in [21]. We define a language of set constraints (essentially a subset of the full language defined in =-=[1, 6]-=-) and discuss inductive form, a graph-based representation of set constraints. 2.2.1 A Language of Set Constraints A constraint system is a finite collection of set constraints. A set constraint is a ... |

77 | M.: Demand Interprocedural Dataflow Analysis
- Horwitz, Reps, et al.
- 1995
(Show Context)
Citation Context ...dd A 〈u, u〉 for each production of the form A → ɛ Figure 1: Closure rules for CFL reachability • We believe that our reduction bridges the gap between the various algorithms for Dyck-CFL reachability =-=[10]-=- and the algorithms for solving set constraints. In light of our reduction, it seems that the distinction between these problems is illusory: the manner in which a problem is specified (as Dyck-CFL re... |

57 | Demand-driven pointer analysis
- Heintze, Tardieu
- 2001
(Show Context)
Citation Context ...chability problem that can be solved on demand by exploring the least solution of the constraints as described above. 3 A completely demand-driven algorithm could be implemented using the approach of =-=[7]-=-. x1 � � � � � � � � � � � � � � � z1 ��� � (1 ��� � � · · · y1 � � � � � � � � � � � � � � � )1 �� � �� � �� �� �� · · · � yk−1 � yk � · · · �� �� �� �� �� � (n )n � �� �� xn � � � � � � � � � � � � ... |

54 | Estimating the impact of scalable pointer analysis on optimization
- Das, Liblit, et al.
- 2001
(Show Context)
Citation Context ...ally, nodes corresponding to global variables should have self-loops labeled )i for every index i that may appear elsewhere in the graph. This solution essentially treats globals monomorphically (see =-=[3]-=- for a more complete discussion). While this solution is simple and easy to implement, in practice it is too expensive to represent these edges explicitly. With an explicit representation, each global... |

52 | Type-base flow analysis: from polymorphic subtyping to CFL-reachability
- Rehof, Fahndrich
- 2001
(Show Context)
Citation Context ...s context-free language (CFL) reachability problems. These include applications such as type-based polymorphic flow analysis, field-sensitive points-to analysis, and interprocedural dataflow analysis =-=[15, 17, 18]-=-. Getting CFL-based Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for prof... |

51 | Off-line variable substitution for scaling points-to analysis
- Rountev, Chandra
- 2000
(Show Context)
Citation Context ...yses have been shown to scale to large programs on applications such as points-to analysis, shape analysis, and receiver class prediction, though scalability requires highly optimized implementations =-=[4, 8, 19, 21]-=-. Recently, a number of program analyses have been formulated as context-free language (CFL) reachability problems. These include applications such as type-based polymorphic flow analysis, field-sensi... |

44 | A.: Projection Merging: Reducing Redundancies in Inclusion Constraint Graphs
- Su, Fähndrich, et al.
- 2000
(Show Context)
Citation Context |

37 |
Flow analysis of Typed Higher-Order Programs
- Mossin
- 1997
(Show Context)
Citation Context ...r case study (see Section 5) but found that none finished within 10 minutes. 5. CASE STUDY: POLYMORPHIC FLOW ANALYSIS Flow analysis statically estimates creation, use, and flow of values in a program =-=[14]-=-. Problems such as computing may-alias relationships, determining receiver class information, and resolving control flow in the presence of indirect function calls can be solved using flow analysis. A... |

29 | T.: Interconvertbility of Set Constraints and Context-Free Language Reachability
- Melski, Reps
- 1997
(Show Context)
Citation Context ...n for X can be viewed as a tree language L(X ) whose grammar is X ⇒ cons(zero, X) X ⇒ nil 3. THE MELSKI-REPS REDUCTION In this section we review the reduction from CFL reachability to set constraints =-=[12, 13]-=-. Readers familiar with this reduction may wish to skip this section. Again, we assume that the CFL grammar is normalized so that the right-hand side of every production contains at most two symbols. ... |

27 | Interconvertibility of a class of set constraints and context-free-language reachability. Theoretical Computer Science
- Melski, Reps
- 2000
(Show Context)
Citation Context ...oved as tricky as implementing set constraints, leading to new algorithms and optimization techniques. Set constraints and CFL reachability were shown to be closely related in work by Melski and Reps =-=[13]-=-. While their result is useful for understanding the conceptual similarity between the two problems, it does not serve as an implementation strategy; as with many reductions, the cost of encoding one ... |

20 |
Shape analysis as a generalized path problem
- Reps
- 1995
(Show Context)
Citation Context ...traints. The first application of Rehof et al.’s work was to polymorphic points-to analysis [3]. Other applications of Dyck-CFL reachability include field-sensitive points-to analysis, shape analysis =-=[16]-=-, interprocedural slicing [9], and debugging systems of unification constraints [2]. 7. CONCLUSION We have shown a reduction from Dyck-CFL reachability to set constraints, and shown that our technique... |

3 | Source-tracking Unification
- Choppella, Haynes
- 2003
(Show Context)
Citation Context ...nalysis [3]. Other applications of Dyck-CFL reachability include field-sensitive points-to analysis, shape analysis [16], interprocedural slicing [9], and debugging systems of unification constraints =-=[2]-=-. 7. CONCLUSION We have shown a reduction from Dyck-CFL reachability to set constraints, and shown that our technique can be applied in practice to the CFL reachability problems that arise in program ... |

1 |
BANSHEE: A Toolkit for Building 11 Analyses. http://bane.cs.berkeley.edu/banshee
- Kodumal
(Show Context)
Citation Context ...ison We have implemented both the Melski-Reps reduction and our reduction in order to compare the two approaches. Both implementations used the banshee toolkit as the underlying set constraint solver =-=[11]-=-. Our implementation of the MelskiReps reduction uses the following normalized form of the Dyck-CFL grammar: S → S S S → Li )i Li → (i S S → s S → ɛ We ran both implementations on randomly generated g... |