The subject of this paper is flow- and context-insensitive pointer analysis. We present a novel approach for precisely modelling struct variables and indirect function calls. Our method emphasises e#ciency and simplicity and extends the language of set-constraints. We experimentally evaluate the precision cost trade-o# using a benchmark suite of 7 common C programs between 5,000 to 150,000 lines of code. Our results indicate the field-sensitive analysis is more expensive to compute, but yields significantly better precision.
|
689
|
Depth-first search and linear graph algorithms
– Tarjan
- 1972
|
|
429
|
Points-to analysis in almost linear time
– Steensgaard
- 1996
|
|
410
|
Program Analysis and Specialization for the C Programming Language
– Andersen
- 1994
|
|
348
|
Efficient context-sensitive pointer analysis for C programs
– Wilson, Lam
- 1995
|
|
153
|
Unification-based pointer analysis with directional assignments
– Das
- 2000
|
|
135
|
Fast and accurate flowinsensitive points-to analysis
– Shapiro, Horwitz
- 1997
|
|
116
|
Context-Insensitive Alias Analysis Reconsidered
– Ruf
- 1995
|
|
105
|
of static analysis
– Landi
- 1992
|
|
91
|
Ultra-fast aliasing analysis using CLA: A million lines of c code in a second
– Heintze, Tardieu
- 2001
|
|
90
|
Partial Online Cycle Elimination in Inclusion Constraint Graphs
– Fähndrich, Foster, et al.
- 1998
|
|
90
|
analysis: haven’t we solved this problem yet
– Pointer
- 2001
|
|
78
|
Efficient points-to analysis for whole-program analysis
– Liang, Harrold
- 1999
|
|
71
|
Introduction to Set Constraint-Based Program Analysis
– Aiken
- 1999
|
|
69
|
Points-to Analysis for Java Using Annotated Constraints
– Rountev, Milanova, et al.
- 2001
|
|
68
|
Scaling Java points-to analysis using SPARK
– Lhoták, Hendren
- 2003
|
|
56
|
Which pointer analysis should I use
– Hind, Pioli
- 2000
|
|
56
|
Points-to analysis by type inference of programs with structures and unions
– Steensgaard
- 1996
|
|
53
|
Pointer analysis for programs with structures and casting
– Yong, Horwitz, et al.
- 1999
|
|
52
|
Polymorphic versus Monomorphic Flow-insensitive Points-to Analysis for C
– Foster, Fähndrich, et al.
- 2000
|
|
46
|
Estimating the impact of scalable pointer analysis on optimization
– Das, Liblit, et al.
- 2001
|
|
40
|
Projection merging: Reducing redundancies in inclusion constraint graphs
– Su, Fahndrich, et al.
- 2000
|
|
38
|
Off-line variable substitution for scaling points-to analysis
– Rountev, Chandra
- 2000
|
|
37
|
An efficient inclusion-based pointsto analysis for strictly-typed languages
– Whaley, Lam
|
|
36
|
Physical type checking for C
– Chandra, Reps
- 1999
|
|
36
|
Extending and evaluating flow-insensitive and context-insensitive points-to analyses for Java
– Liang, Pennings, et al.
- 2001
|
|
26
|
Precise flow-insensitive may-alias analysis is NP-hard
– Horwitz
- 1997
|
|
20
|
Flow-insensitive points-to analysis with term and set constraints
– Foster, Fähndrich, et al.
|
|
16
|
O#-line variable substitution for scaling points-to analysis
– Rountev, Chandra
- 2000
|
|
13
|
Online cycle detection and difference propagation for pointer analysis
– Pearce, Kelly, et al.
- 2003
|
|
5
|
Some directed graph algorithms and their application to pointer analysis (work in progress
– Pearce
- 2004
|
|
3
|
Online cycle detection and di#erence propagation for pointer analysis
– Pearce, Kelly, et al.
- 2003
|
|
1
|
An e#cient inclusion-based points-to analysis for strictly-typed languages
– Whaley, Lam
- 2002
|