## Points-to analysis using BDDs (2003)

### Cached

### Download Links

- [plg.uwaterloo.ca]
- [plg.uwaterloo.ca]
- [www.sable.mcgill.ca]
- [www.eecs.umich.edu]
- [pag.lcs.mit.edu]
- [pag.csail.mit.edu]
- [www.sable.mcgill.ca]
- [pages.cs.wisc.edu]
- DBLP

### Other Repositories/Bibliography

Venue: | In Programming Language Design and Implementation (PLDI |

Citations: | 88 - 2 self |

### BibTeX

@INPROCEEDINGS{Berndl03points-toanalysis,

author = {Marc Berndl and Feng Qian and Laurie Hendren and Navindra Umanee},

title = {Points-to analysis using BDDs},

booktitle = {In Programming Language Design and Implementation (PLDI},

year = {2003},

pages = {103--114}

}

### Years of Citing Articles

### OpenURL

### Abstract

### Citations

946 | Symbolic Boolean manipulation with ordered binary-decision diagrams
- Bryant
- 1992
(Show Context)
Citation Context ... aware of. We used the SPARK framework both to generate the input to our BDD-based solver, and as a baseline solver against which to compare our new BBD-based solver. Ordered Binary Decision Diagrams =-=[7]-=- represent boolean functions as DAGs. The canonical representation allows efficient boolean operations and testing of equivalence and satisfiability. Symbolic Model Checking [16] is used to verify cir... |

564 | Program Analysis and Specialization for the C Programming Language
- Andersen
- 1994
(Show Context)
Citation Context ...nsitive points-to analysis have been pursued in the past, equality-based approaches like those pioneered by Steensgaard [29], and subset-based approaches like the analysis first suggested by Andersen =-=[4]-=-. The subset-based approaches give more accurate results, but they also lead to greater challenges for efficient implementations [8, 11, 13, 18, 24,27, 31]. 2 For this paper, we have chosen to impleme... |

553 | Points-to analysis in almost linear time
- Steensgaard
- 1996
(Show Context)
Citation Context ...aches that can scale well to large programs. Two popular approaches to flow-insensitive points-to analysis have been pursued in the past, equality-based approaches like those pioneered by Steensgaard =-=[29]-=-, and subset-based approaches like the analysis first suggested by Andersen [4]. The subset-based approaches give more accurate results, but they also lead to greater challenges for efficient implemen... |

401 | Context-sensitive interprocedural points-to analysis in the presence of function pointers
- Emami, Ghiya, et al.
- 1994
(Show Context)
Citation Context ...fication to describe complex queries and set transformations. Not only does this enable rapid development, but with a good ordering, one can expect good performance. 7 Related Work Points-to analysis =-=[4, 10, 29]-=- has been an active research field in the past several years. Hind [15] gives a very good overview of the current state of algorithms and metrics for points-to analysis. An important issue is how well... |

347 | Optimization of object-oriented programs using static class hierarchy analysis - Dean, Grove, et al. - 1995 |

244 | Symbolic Model Checking for sequential circuit verification
- Burch, Clarke, et al.
- 1994
(Show Context)
Citation Context ...nary Decision Diagrams [7] represent boolean functions as DAGs. The canonical representation allows efficient boolean operations and testing of equivalence and satisfiability. Symbolic Model Checking =-=[16]-=- is used to verify circuits with an extremely large number of states by using BDDs. The use of BDDs in this context has allowed researchers to solve larger problems than can be solved using table-base... |

205 | Unification-based pointer analysis with directional assignments
- Das
- 2000
(Show Context)
Citation Context ...bset-based approaches like the analysis first suggested by Andersen [4]. The subset-based approaches give more accurate results, but they also lead to greater challenges for efficient implementations =-=[8, 11, 13, 18, 24,27, 31]-=-. 2 For this paper, we have chosen to implement a subset-based points-to analysis for Java. At a very high level, one can see this problem as finding the allocation sites that reach a variable in the ... |

158 | Fast and accurate flow-insensitive pointsto analysis
- Shapiro, Horwitz
- 1997
(Show Context)
Citation Context ...bset-based approaches like the analysis first suggested by Andersen [4]. The subset-based approaches give more accurate results, but they also lead to greater challenges for efficient implementations =-=[8, 11, 13, 18, 24,27, 31]-=-. 2 For this paper, we have chosen to implement a subset-based points-to analysis for Java. At a very high level, one can see this problem as finding the allocation sites that reach a variable in the ... |

139 |
analysis: Haven’t we solved this problem yet
- Pointer
- 2001
(Show Context)
Citation Context ...is enable rapid development, but with a good ordering, one can expect good performance. 7 Related Work Points-to analysis [4, 10, 29] has been an active research field in the past several years. Hind =-=[15]-=- gives a very good overview of the current state of algorithms and metrics for points-to analysis. An important issue is how well the algorithms scale to large programs. Various points-to analyses mak... |

136 | Scaling Java points-to analysis using Spark
- Lhoták, Hendren
- 2003
(Show Context)
Citation Context ...e are many points-to sets, and each points-to set can become very large. This problem has been attacked previously by collapsing equivalent variables [11,23] or designing new representations for sets =-=[12, 17]-=-. Since BDDs have been shown to be effective for compactly representing large sets and for solving large state space problems like those generated in model checking, it seemed like an interesting ques... |

123 | Practical virtual method call resolution for java. Trusted objects
- Sundaresan, Razafimahefa, et al.
- 1999
(Show Context)
Citation Context ... has two reasonable options for dealing with the declared types of variables: it can solve the points-to constraints first, and restrict the points-to sets to subtypes of the declared type afterwards =-=[24, 30]-=-; alternatively, it can remove objects of incompatible type as the points-to analysis proceeds [17,31]. Both our BDD solver and the SPARK solver support both variations. We denote a solver that respec... |

122 | Ultra-fast aliasing analysis using CLA: A million lines of C code in a second
- Heintze, Tardieu
- 2001
(Show Context)
Citation Context ...bset-based approaches like the analysis first suggested by Andersen [4]. The subset-based approaches give more accurate results, but they also lead to greater challenges for efficient implementations =-=[8, 11, 13, 18, 24,27, 31]-=-. 2 For this paper, we have chosen to implement a subset-based points-to analysis for Java. At a very high level, one can see this problem as finding the allocation sites that reach a variable in the ... |

121 | Partial online cycle elimination in inclusion constraint graphs
- Fahndrich, Foster, et al.
- 1998
(Show Context)
Citation Context |

104 | Points-to Analysis for Java Using Annotated Constraints
- ROUNTEV, MILANOVA, et al.
(Show Context)
Citation Context |

103 |
Data flow analysis is model checking of abstract interpretations
- SCHMIDT
- 1998
(Show Context)
Citation Context ...to large programs using this new representation. Although model checking and program analyses are not tightly connected yet, several publications have pointed out theoretical connections between them =-=[25, 26]-=-. The theoretical foundation of flow analyses is the fixed-point theory on monotonic functions, whose counterpart in model checking is the modal μ-calculus. Schmidt and Steffen [26] presented a method... |

69 | Tool-supported program abstraction for finite-state verification
- DWYER, HATCLIFF, et al.
- 2001
(Show Context)
Citation Context ...hose counterpart in model checking is the modal μ-calculus. Schmidt and Steffen [26] presented a methodology of treating iterative flow analysis as model checking of abstract interpretations. Bandera =-=[9]-=- is a tool-set applying such ideas to analyzing realistic programs. Like some other work [6], it abstracts program properties to linear temporal logic (LTL) or computational tree logic (CTL) formulas,... |

65 | Program analysis as model checking of abstract interpretations
- Schmidt, Steffen
- 1998
(Show Context)
Citation Context ...to large programs using this new representation. Although model checking and program analyses are not tightly connected yet, several publications have pointed out theoretical connections between them =-=[25, 26]-=-. The theoretical foundation of flow analyses is the fixed-point theory on monotonic functions, whose counterpart in model checking is the modal μ-calculus. Schmidt and Steffen [26] presented a method... |

58 | Off-line variable substitution for scaling points-to analysis
- ROUNTEV, S
(Show Context)
Citation Context ...points-to analysis is that for large programs there are many points-to sets, and each points-to set can become very large. This problem has been attacked previously by collapsing equivalent variables =-=[11,23]-=- or designing new representations for sets [12, 17]. Since BDDs have been shown to be effective for compactly representing large sets and for solving large state space problems like those generated in... |

44 | An efficient inclusion-based points-to analysis for strictly-typed languages
- Whaley, Lam
- 2002
(Show Context)
Citation Context |

43 | Extending and evaluating flow-insensitive and context-insensitive points-to analyses for Java
- Liang, Pennings, et al.
- 2001
(Show Context)
Citation Context ...[13] reported very fast analysis times using a demand-driven algorithm and a carefully designed implementation of points-to sets [12]. Several groups adapted the points-to analyses used for C to Java =-=[18,24]-=-. These approaches, however, were applied only to benchmarks using the JDK 1.1.8 class library. One of the difficult points for whole program analysis for Java is that even very simple programs touch,... |

42 |
Bebop: a path-sensitive interprocedural dataflow engine
- Ball, Rajamani
- 2001
(Show Context)
Citation Context ... and condition relations in a 15scontrol flow graph to a compact BDD representation and performs analysis on these BDDs. Another usage of BDDs is to represent large sets and maps; TVLA [20] and Bebop =-=[5]-=- are examples. In our work, as in model checking, we use BDDs to represent all data structures, and we show non-trivial techniques to make the original algorithm scalable to large programs using this ... |

42 | Spark: A flexible points-to analysis framework for Java - Lhoták - 2002 |

26 | P.: Implicit enumeration of strongly connected components and an application to formal verification
- Xie, Beerel
- 2000
(Show Context)
Citation Context ...roved by introducing some aspects of graph-based solvers into the BDD solver. For example, it would be very interesting to see if efficient BDD algorithms for collapsing strongly connected components =-=[32]-=- would further improve the efficiency of our BDD-based points-to algorithm. In addition to achieving our goals in terms of time and space, we were pleasantly surprised with how easy it was for us to s... |

25 | Accurate and efficient predicate analysis with binary decision diagrams
- Sias, August, et al.
- 2000
(Show Context)
Citation Context ...is context has allowed researchers to solve larger problems than can be solved using table-based representations of graphs. BDDs have also been used in software verification and program analyses. PAS =-=[28]-=- converts predicate and condition relations in a 15scontrol flow graph to a compact BDD representation and performs analysis on these BDDs. Another usage of BDDs is to represent large sets and maps; T... |

24 |
a binary decision diagram package
- BuDDy
- 2001
(Show Context)
Citation Context ...In the worst case, the number of nodes in the BDD representing the result can be the product of the number of nodes in the two operands, but in most cases, the reduced BDD is much smaller [22]. BuDDy =-=[19]-=- is one of several publicly-available BDD packages. Instead of requiring the programmer to manipulate individual bit positions in BDDs,BuDDy provides an interface for grouping bit positions together. ... |

17 | Compactly representing first-order structures for static analysis
- Manevich, Ramalingam, et al.
- 2002
(Show Context)
Citation Context ...verts predicate and condition relations in a 15scontrol flow graph to a compact BDD representation and performs analysis on these BDDs. Another usage of BDDs is to represent large sets and maps; TVLA =-=[20]-=- and Bebop [5] are examples. In our work, as in model checking, we use BDDs to represent all data structures, and we show non-trivial techniques to make the original algorithm scalable to large progra... |

12 | Analysis of large code bases: the compile-link-analyze model. http://cm.bell-labs.com/ cm/cs/who/nch/cla.ps
- Heintze
- 1999
(Show Context)
Citation Context ...e are many points-to sets, and each points-to set can become very large. This problem has been attacked previously by collapsing equivalent variables [11,23] or designing new representations for sets =-=[12, 17]-=-. Since BDDs have been shown to be effective for compactly representing large sets and for solving large state space problems like those generated in model checking, it seemed like an interesting ques... |

10 | Alias analysis by means of a model checker
- Martena, Pietro
- 2001
(Show Context)
Citation Context ... [6], it abstracts program properties to linear temporal logic (LTL) or computational tree logic (CTL) formulas, which can be verified efficiently by existing model checking tools. Martena and Pietro =-=[21]-=- studied the application of a model checker, Spin, to solve intraprocedural alias analysis for C. In a different program analysis setting, BDD-based groundness analysis for constraint (logic) programs... |

9 | Bytecode model checking: An experimental analysis
- Basin, Friedrich, et al.
(Show Context)
Citation Context ...ed a methodology of treating iterative flow analysis as model checking of abstract interpretations. Bandera [9] is a tool-set applying such ideas to analyzing realistic programs. Like some other work =-=[6]-=-, it abstracts program properties to linear temporal logic (LTL) or computational tree logic (CTL) formulas, which can be verified efficiently by existing model checking tools. Martena and Pietro [21]... |

5 |
Le Charlier, B.: Evaluation of the domain prop
- Hentenryck, Cortesi
- 1995
(Show Context)
Citation Context ..., Spin, to solve intraprocedural alias analysis for C. In a different program analysis setting, BDD-based groundness analysis for constraint (logic) programs has become one of the standard approaches =-=[14]-=-. 8 Conclusions and Future Work In this paper, we have presented a BDD-based points-to analysis that scales very well in terms of time and space, and is very easy to implement using standard BDD packa... |