Pointer Analysis Lecture 2. G. Ramalingam Microsoft Research, India. Andersen’s Analysis. A flow-insensitive analysis computes a single points-to solution valid at all program points ignores control-flow – treats program as a set of statements
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Pointer AnalysisLecture 2
G. Ramalingam
Microsoft Research, India
R IdealMayPT(u) for every vertex u
1
x = &a;
y = x;
x = &b;
z = x;
x = &a
2
y = x
3
x = &b
4
z = x
5
1
x = &a;
y = x;
x = &b;
z = x;
x = &a
2
y = x
3
x = &b
4
z = x
5
1
x = &a;
y = x;
y = &b;
b = &c;
x = &a
2
y = x
3
y = &b
4
b = &c
5
1
x = &a;
y = x;
y = &b;
b = &c;
x = &a
2
y = x
3
y = &b
4
b = &c
5
x = &a;
y = x;
y = &b;
b = &c;
*x = &d;
Ideal-May-Point-To
???
Algorithm A
more efficient / less precise
Andersen’s
more efficient / less precise
Steensgaard’s
x: &y
y: &z
x: &b
y: &x
g
x: &b
x: &y
y: &x
y: &x
a
x: {&y,&b}
y: {&x,&z}
x: &y
y: &z
x: &b
y: &z
Ideal-May-Point-To
more efficient / less precise
Algorithm A
more efficient / less precise
Andersen’s
more efficient / less precise
Steensgaard’s
Ideal (with Int, with Malloc)
Ideal (with Int)
Ideal (with Malloc)
Ideal (no Int, no Malloc)
Algorithm A
Andersen’s
Steensgaard’s
1
x = new;
y = x;
*y = &b;
*y = &a;
x = new
2
y = x
3
*y = &b
4
*y = &a
5
class Foo {
A* f;
B* g;
}
s: x = new Foo()
x->f = &b;
x->g = &a;
class Foo {
A* f;
B* g;
}
s: x = new Foo()
x->f = &b;
x->g = &a;
4
*y = &a
5
AS[stmt] : AbsDataState -> AbsDataState
AS[ *x = y ] s =
s[z s(y)] if s(x) = {z}
s[z1 s(z1) s(y)] if s(x) = {z1, …, zk}
[z2s(z2) s(y)] (where k > 1)
…
[zks(zk) s(y)]
a
g
2Data-State
2Var x Var’
a(Y) = { (p,x) | exists s in Y. s(p) == x }
MayPT(u)
a
Í
a
RS(u)
IdealMayPT(u)
2Data-State
2Var x Var’
IdealMayPT (u) = a ( RS(u) )
c is said to be correctly
approximated by a
iff
a(c) Ía
c1
correctly
approximated by
a1
f
c2
f#
correctly
approximated by
a2
C
A
concretization
g
c1
a1
f
abstraction
a
c2
f#
a2
requirement:
f#(a1) ≥a (f( g(a1))
C
A
where s*({v1,…,vn}) = s(v1) È … È s(vn)
x: &y
y: &x
z: &a
g
x: {&y}
y: {&x,&z}
z: {&a}
x: &y
y: &z
z: &a
f
f#
*y = &b;
*y = &b;
x: &b
y: &x
z: &a
x: {&y,&b}
y: {&x,&z}
z: {&a,&b}
x: &y
y: &z
z: &b
a
x: &y
y: &x
z: &a
g
x: {&y}
y: {&x,&z}
z: {&a}
x: &y
y: &z
z: &a
f
f#
*x = &b;
*x = &b;
x: &y
y: &b
z: &a
x: {&y}
y: {&b}
z: {&a}
x: &y
y: &b
z: &a
a
4
*y = &a
5