## Banshee: A scalable constraint-based analysis toolkit (2005)

Venue: | In SAS ’05: Proceedings of the 12th International Static Analysis Symposium. London, United Kingdom |

Citations: | 31 - 1 self |

### BibTeX

@INPROCEEDINGS{Kodumal05banshee:a,

author = {John Kodumal and Alex Aiken},

title = {Banshee: A scalable constraint-based analysis toolkit},

booktitle = {In SAS ’05: Proceedings of the 12th International Static Analysis Symposium. London, United Kingdom},

year = {2005},

pages = {218--234}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. We introduce Banshee, a toolkit for constructing constraintbased analyses. Banshee’s novel features include a code generator for creating customized constraint resolution engines, incremental analysis based on backtracking, and fast persistence. These features make Banshee useful as a foundation for production program analyses. 1

### Citations

889 | A Theory of Objects
- Abadi, Cardelli
- 1996
(Show Context)
Citation Context ...ping to the top level: at lower levels, the engine performs unification. An alternative explanation is that this signature implements the following sound rule for subtyping with updateable references =-=[1]-=-: ℓx ⊆ ℓy Xℓx = Xℓy ref(ℓx, Xℓx ) ≤ ref(ℓy, Xℓy ) (sub-ref)s6.3 Receiver Class Analysis Now that we have explored subtyping in points-to analysis, we focus on adding new capabilities to the analysis. ... |

518 | Points-to analysis in almost linear time
- Steensgaard
- 1996
(Show Context)
Citation Context ...eft-to-right rewrite rules. Example 2 The Term sort is the tuple: (VTerm, CTerm, {0, 1}, {≤, =}). Here VTerm is a set of term-valued variables, and = and ≤ are unification and conditional unification =-=[25]-=-, respectively. The meaning of a pure Term expression is, as expected, a constant or a constructor cTerm(t1, . . . , tn) where ti are terms. A subset of the resolution rules for the Term sort is shown... |

369 | Precise interprocedural dataflow analysis via graph reachability
- Reps, Horwitz, et al.
- 1995
(Show Context)
Citation Context ...ts that use BDD back-ends include CrocoPat [3] and Jedd [16]. An efficient algorithm for Dyck context-free language reachability has been shown to be useful for solving various flow analysis problems =-=[21]-=-. A demand-driven version of the algorithm also exists [13], though we have not so far seen a fully incremental algorithm described. Our description of a precise incremental algorithm, as well as our ... |

246 | Making data structures persistent
- Driscoll, Sarnak, et al.
- 1989
(Show Context)
Citation Context ...jor concern is the engineering effort required to support fine-grained incrementality. To our knowledge, there is no general, practical incremental algorithm for maintaining arbitrary data structures =-=[7]-=-. Adding ad-hoc support for incremental updates to each Banshee sort is daunting, as the algorithms are highly optimized. For example, our set constraint solver uses a union-find algorithm to implemen... |

228 | M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams
- Whaley, Lam
(Show Context)
Citation Context ...c [17]. Implementations of these frameworks have been applied to solve static analysis problems. The bddbddb system is a deductive database that uses a binary-decision diagram library as its back-end =-=[30]-=-. Other toolkits that use BDD back-ends include CrocoPat [3] and Jedd [16]. An efficient algorithm for Dyck context-free language reachability has been shown to be useful for solving various flow anal... |

191 | Unification-based pointer analysis with directional assignments
- Das
- 2000
(Show Context)
Citation Context ...pe variations of a given program analysis. In the first three examples, we refine the degree of subtyping used in the points-to analysis; much research on points-to analysis has focused on this issue =-=[5, 24, 25]-=-. In the fourth example, we extend points-to analysis to receiver class analysis in an objectoriented language with explicit pointer operations (e.g. C++). This analysis computes the function call gra... |

149 | Fast and accurate flow-insensitive points-to analysis
- Shapiro, Horwitz
(Show Context)
Citation Context ...pe variations of a given program analysis. In the first three examples, we refine the degree of subtyping used in the points-to analysis; much research on points-to analysis has focused on this issue =-=[5, 24, 25]-=-. In the fourth example, we extend points-to analysis to receiver class analysis in an objectoriented language with explicit pointer operations (e.g. C++). This analysis computes the function call gra... |

136 | What you always wanted to know about datalog (and never dared to ask
- Ceri, Gottlob, et al.
- 1989
(Show Context)
Citation Context ...d Work Many related frameworks have been used to specify static analyses. In [26], modal logic is used as a specification language to compile specialized implementationssof dataflow analyses. Datalog =-=[4]-=- is a database query language based on logic programming that has recently received attention as a specification language for static analyses. The subset of pure set constraints implemented in Banshee... |

113 | Ultra-fast aliasing analysis using CLA: A million lines of C code in a second
- Heintze, Tardieu
- 2001
(Show Context)
Citation Context ...A generic constraint resolution implementation with no knowledge of the client may pay a large performance penalty for generality. For example, the fastest hand-written version of Andersen’s analysis =-=[12]-=- is much faster than the fastest version built using a generic toolkit [2]. Furthermore, real build systems require separate analysis to fit with separate compilation. Small edits to projects are the ... |

112 | Partial online cycle elimination in inclusion constraint graphs
- Fahndrich, Foster, et al.
- 1998
(Show Context)
Citation Context ...ntal updates to each Banshee sort is daunting, as the algorithms are highly optimized. For example, our set constraint solver uses a union-find algorithm to implement partial online cycle elimination =-=[9]-=-. Adding incremental support to union-find alone is not easy—in fact, some published solutions are incorrect [10]. Instead of computing precise dependencies, we use backtracking, which is based on an ... |

91 | Language support for regions
- Gay, Aiken
- 2001
(Show Context)
Citation Context ...ata structures to support online constraint solving and backtracking. Persistence is achieved by adding serialization and deserialization to the region-based memory management library used by Banshee =-=[11]-=-. Constraint systems are saved by serializing a collection of regions, and loaded by deserializing regions and updating pointer values stored in those regions. Initially, we implemented serialization ... |

77 | M.: Demand Interprocedural Dataflow Analysis
- Horwitz, Reps, et al.
- 1995
(Show Context)
Citation Context ...]. An efficient algorithm for Dyck context-free language reachability has been shown to be useful for solving various flow analysis problems [21]. A demand-driven version of the algorithm also exists =-=[13]-=-, though we have not so far seen a fully incremental algorithm described. Our description of a precise incremental algorithm, as well as our backtracking algorithm, can be applied to Dyck-CFLR problem... |

65 | On the complexity analysis of static analyses
- McAllester
- 2002
(Show Context)
Citation Context .... The subset of pure set constraints implemented in Banshee is equivalent to chain datalog [31] and also context-free language reachability [18]. There are also obvious connections to bottom-up logic =-=[17]-=-. Implementations of these frameworks have been applied to solve static analysis problems. The bddbddb system is a deductive database that uses a binary-decision diagram library as its back-end [30]. ... |

55 |
Graph Theoretic Methods in Database Theory
- Yannakakis
- 1990
(Show Context)
Citation Context ...sed on logic programming that has recently received attention as a specification language for static analyses. The subset of pure set constraints implemented in Banshee is equivalent to chain datalog =-=[31]-=- and also context-free language reachability [18]. There are also obvious connections to bottom-up logic [17]. Implementations of these frameworks have been applied to solve static analysis problems. ... |

49 | A BDD-based relational extension of Java
- Lhoták, Hendren
- 1995
(Show Context)
Citation Context ...tic analysis problems. The bddbddb system is a deductive database that uses a binary-decision diagram library as its back-end [30]. Other toolkits that use BDD back-ends include CrocoPat [3] and Jedd =-=[16]-=-. An efficient algorithm for Dyck context-free language reachability has been shown to be useful for solving various flow analysis problems [21]. A demand-driven version of the algorithm also exists [... |

44 | A.: Projection Merging: Reducing Redundancies in Inclusion Constraint Graphs
- Su, Fähndrich, et al.
- 2000
(Show Context)
Citation Context ... adding constraint (5) adds edge (4) again, so the entry (1,5) must be included in (4)’s dependency list. This approach is costly in space, because an induced constraint often is added multiple times =-=[28]-=-. Figures 3(b) and (c) show the closed constraint graph and edge dependencies after constraint (6) and its induced constraints are added to the graph. Besides the space cost, another major concern is ... |

41 | G.: Fully dynamic transitive closure: breaking through
- Demetrescu, Italiano
(Show Context)
Citation Context ...LR problems via a reduction in [15]. We are not aware of previous work on incrementalizing set constraints, though work on incrementalizing transitive closure is abundant and addresses related issues =-=[6, 22]-=-. The CLA (compile, link, analyze) [12] approach to analyzing large code bases supports a form of file-granularity incrementality similar to traditional compilers: modified files can be recompiled and... |

36 | Mutatis mutandis: Safe and predictable dynamic software updating. TOPLAS’07
- STOYLE, HICKS, et al.
(Show Context)
Citation Context ...nding-time analysis for partial evaluation of graphics programs has been used in production at a major effects studio [19, 20]. Banshee has been used as part of a software updateability analysis tool =-=[27]-=-. A Banshee-based type inference system for Prolog has been developed [23]. Also, for two years a Banshee pointer analysis was used as a prototype global alias analysis in a development branch of the ... |

29 | M.: Program analysis using mixed term and set constraints
- Aiken, Fahndrich
- 1997
(Show Context)
Citation Context ... C is a finite conjunction of constraints. To fix ideas, we introduce two Banshee sorts and informally explain their semantics. A formal presentation of the semantics of mixed constraints is given in =-=[8]-=-. We leave the set of constructors Cs unspecified in each example, as this set parameterizes the constraint language and is application-specific. Example 1 The Set sort is the tuple: (VSet, CSet, {∪, ... |

29 | A.: The Set Constraint/CFL Reachability Connection in Practice
- Kodumal, Aiken
- 2004
(Show Context)
Citation Context ...sitive analyses can be implemented using Banshee’s Row sort to model structures. Polymorphic recursive analyses can be implemented using a Banshee-based library for context-free language reachability =-=[15]-=-. Banshee also has a modular design that allows new sorts to be added to the system in case an analysis demands a customized set of resolution rules. 7 Experiments To demonstrate the scalability and p... |

29 | T.: Interconvertbility of Set Constraints and Context-Free Language Reachability
- Melski, Reps
- 1997
(Show Context)
Citation Context ...ed attention as a specification language for static analyses. The subset of pure set constraints implemented in Banshee is equivalent to chain datalog [31] and also context-free language reachability =-=[18]-=-. There are also obvious connections to bottom-up logic [17]. Implementations of these frameworks have been applied to solve static analysis problems. The bddbddb system is a deductive database that u... |

26 | Generating data flow analysis algorithms from modal specifications
- Steffen
- 1993
(Show Context)
Citation Context ...n .1 percent of the files are modified. We have confirmed similar distributions hold for other code bases as well. 8 Related Work Many related frameworks have been used to specify static analyses. In =-=[26]-=-, modal logic is used as a specification language to compile specialized implementationssof dataflow analyses. Datalog [4] is a database query language based on logic programming that has recently rec... |

21 | C.: Simple and Efficient Relational Querying of Software Structures
- Beyer, Noack, et al.
- 2003
(Show Context)
Citation Context ... to solve static analysis problems. The bddbddb system is a deductive database that uses a binary-decision diagram library as its back-end [30]. Other toolkits that use BDD back-ends include CrocoPat =-=[3]-=- and Jedd [16]. An efficient algorithm for Dyck context-free language reachability has been shown to be useful for solving various flow analysis problems [21]. A demand-driven version of the algorithm... |

15 |
R.E.: Amortized analysis of algorithms for set union with backtracking
- Westbrook, Tarjan
- 1989
(Show Context)
Citation Context ... pay any cost for this factoring. For example, applying tracked references to a standardsunion-find algorithm yields an algorithm equivalent to a well-known algorithm for union-find with backtracking =-=[29]-=-. The basic approach to adding backtracking to a static analysis is as follows. Given a fully analyzed program and a program edit, we backtrack to the first constraint that changed as a result of the ... |

9 |
A Faster and Simpler Fully Dynamic Transitive Closure
- Roditty
- 2003
(Show Context)
Citation Context ...LR problems via a reduction in [15]. We are not aware of previous work on incrementalizing set constraints, though work on incrementalizing transitive closure is abundant and addresses related issues =-=[6, 22]-=-. The CLA (compile, link, analyze) [12] approach to analyzing large code bases supports a form of file-granularity incrementality similar to traditional compilers: modified files can be recompiled and... |

4 |
A note on set union with arbitrary deunions
- Galil, Italiano
- 1991
(Show Context)
Citation Context ...traint solver uses a union-find algorithm to implement partial online cycle elimination [9]. Adding incremental support to union-find alone is not easy—in fact, some published solutions are incorrect =-=[10]-=-. Instead of computing precise dependencies, we use backtracking, which is based on an approximation: each induced constraint depends on all constraints introduced earlier. Thus, to delete constraint ... |

4 | Practical Interactive Lighting Design for RenderMan Scenes. Undergraduate Thesis
- Ragan-Kelley
- 2004
(Show Context)
Citation Context ... As evidence, we cite several Banshee applications. A Banshee-based polyvariant binding-time analysis for partial evaluation of graphics programs has been used in production at a major effects studio =-=[19, 20]-=-. Banshee has been used as part of a software updateability analysis tool [27]. A Banshee-based type inference system for Prolog has been developed [23]. Also, for two years a Banshee pointer analysis... |

3 |
A toolkit for constructing typeand constraint-based program analyses
- Aiken, Fahndrich, et al.
- 1998
(Show Context)
Citation Context ...ent may pay a large performance penalty for generality. For example, the fastest hand-written version of Andersen’s analysis [12] is much faster than the fastest version built using a generic toolkit =-=[2]-=-. Furthermore, real build systems require separate analysis to fit with separate compilation. Small edits to projects are the norm; reanalyzing an entire project for each small change is unrealistic. ... |

2 |
Banshee: A toolkit for constructing constraint-based analyses. http://banshee.sourceforge.net
- Kodumal
- 2005
(Show Context)
Citation Context ...ion. Small edits to projects are the norm; reanalyzing an entire project for each small change is unrealistic. We have built Banshee, a constraint-based analysis toolkit that addresses these problems =-=[14]-=-. Banshee succeeds Bane, our first generation toolkit for constraint-based program analysis [2]. Banshee inherits several features from Bane, particularly support for mixed constraints, which allow se... |