1 / 23

Pointer Analysis Survey.

Rupesh Nasre. Aug 24, 2007. Pointer Analysis Survey. Outline. The problem. Background. Representative papers. Discussion: trends, similarities, differences. Directions for research.

caden
Download Presentation

Pointer Analysis Survey.

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. Rupesh Nasre. Aug 24, 2007. Pointer Analysis Survey.

  2. Outline. • The problem. • Background. • Representative papers. • Discussion: trends, similarities, differences. • Directions for research.

  3. Statically find out the groups of program variables, such that, all variables in a group may point to the same memory block during the program execution. The problem.

  4. Background (1 of 7). • Static analysis. • done on static representation of a program. • does not require program execution. • is conservative by definition. • Dynamic analysis. • done on traces of program executions. • does not cover all possible behaviors. • precise for a run of the program.

  5. Background (2 of 7). • Clients. • program transformations that depend on pointer analysis. • for instance, queries related to pointers and compiler optimizations. • typically, query resolution time for clients is inversely proportional to pointer analysis time.

  6. Background (3 of 7). • Precision. • a measure of correctness for getting the required information from pointer analysis. • for pointer analysis, the required information is: whether two pointers are aliases or non-aliases. • dynamic analysis is precise with respect to that execution.

  7. Background (4 of 7). • Efficiency. • amount of time taken by an algorithm. • Scalability. • asymptotic time complexity of an algorithm. • An algorithm can be efficient, but not scalable.

  8. Background (5 of 7). • Flow-sensitivity. • algorithm considers control flow in the program. • Context-sensitivity. • algorithm considers calling context of a function. • Field-sensitivity. • algorithm separates individual fields of an aggregate, from each other and from the aggregate itself.

  9. Background (6 of 7). • Unification-based. • algorithm merges equivalence classes of variables in an assignment. • less storage requirement. • fast. • low precision.

  10. Background (7 of 7). • Inclusion based (or subset based or constraint based). • algorithm processes assignments directionally and each symbol is represented by a single node. • more storage requirement. • slower. • high precision.

  11. Representative papers (1 of 4). • Choi et al, Efficient flow-sensitive interprocedural computation of pointer-induced aliases and side effects, POPL 1993. • Andersen, PhD Thesis, 1994. • Burke et al, Flow-insensitive interprocedural alias analysis in the presence of pointers, LCPC 1995. • Reps et al, Precise interprocedural dataflow analysis via graph reachability, POPL 1995.

  12. Representative papers (2 of 4). • Steensgaard, Points-to analysis in almost linear time, POPL 1996. • Ghiya et al, Is it a tree, DAG, or a cyclic graph? A shape analysis for heap-directed pointers in C, PLDI 1996. • Hind et al, Which pointer analysis should I use?, ISSTA 2000.

  13. Representative papers (3 of 4). • Cheng et al, Modular interprocedural pointer analysis using access paths: design, implementation, and evaluation, PLDI 2000. • Liang et al, Evaluating the precision of static reference analysis using profiling, ISSTA 2002. • Whaley et al, Cloning-based context-sensitive pointer alias analysis using binary decision diagrams, PLDI 2004.

  14. Representative papers (4 of 4). • Raman et al, Recursive data structure profiling, MSP 2005. • Lattner et al, Making context sensitive points-to analysis with heap-cloning practical for the real world, PLDI 2007.

  15. Discussion: similarities, differences. • Flow-sensitive: Choi93, Ghiya96, Reps95, Whaley04. • Context-sensitive: Andersen94, Cheng00, Ghiya96, Lattner07, Whaley04. • Field-sensitive: Cheng00, Lattner07, Whaley04. • Unification-based: Steensgaard96, Lattner07. • Inclusion-based: Andersen94, Cheng00, Whaley04.

  16. Discussion: trends (1 of 2). • Recursion is handled using strongly-connected components. • A recursive data structure is represented using a single representative node. • Stack pointers are often treated in a different manner than heap pointers. • For better precision, inclusion-based analyses are preferred. For better efficiency, unification-based analyses are preferred.

  17. Discussion: trends (2 of 2). • Flow-sensitivity does not improve precision to a significant extent, for, typically pointers are not reassigned and when they are, they point to the other part of the same data structure represented as a whole using a single node. • Graph algorithms typically involve three phases: intraprocedural, bottom-up, and top-down. • Single level of context-sensitivity proves sufficiently precise and efficient.

  18. Discussion. • Most of the papers differ in the techniques used to solve pointer analysis problem. • Representation of alias information differs a lot across techniques. • matrices: Ghiya96. • graphs: Das00, Lattner07, Raman05, Reps95, Steensgaard96. • access-paths: Cheng00. • ordered binary decision diagrams: Whaley04.

  19. Directions for research (1 of 4). • Complex data structures. • most algorithms do not handle them well. • occur when large hash tables, dictionaries, symbol tables form the main data structure of a program. • need to characterize complexity of a data structure. • adaptive algorithm depending on the complexity.

  20. Directions for research (2 of 4). • Out-of-order execution for multithreaded programs. • some research done for multithreaded programs. • none of the papers talk about the result of out-of-order execution of instructions on aliases in multithreaded programs. • instructions may be reordered by compiler or hardware.

  21. Directions for research (3 of 4). • Combination of techniques. • no one of the techniques present is best in all aspects. • hybrid approaches are necessary. • one way is to combine static pointer analysis with dynamic profile information. • another way is to use adaptive algorithm which internally uses different sub-algorithms invented.

  22. Directions for research (4 of 4). • Representation of alias information. • history tells us that difference in the alias information representation often led to new algorithms. • research on finding novel ways to represent aliases can be an interesting area to be explored.

  23. Rupesh Nasre. Aug 24, 2007. Pointer Analysis Survey.

More Related