Pointer Analysis Lecture 2. G. Ramalingam Microsoft Research, India. Andersen’s Analysis. A flow-insensitive analysis computes a single points-to solution valid at all program points ignores control-flow – treats program as a set of statements
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Pointer AnalysisLecture 2
G. Ramalingam
Microsoft Research, India
R IdealMayPT(u) for every vertex u
1
x = &a;
y = x;
x = &b;
z = x;
x = &a
2
y = x
3
x = &b
4
z = x
5
1
x = &a;
y = x;
x = &b;
z = x;
x = &a
2
y = x
3
x = &b
4
z = x
5
1
x = &a;
y = x;
y = &b;
b = &c;
x = &a
2
y = x
3
y = &b
4
b = &c
5
1
x = &a;
y = x;
y = &b;
b = &c;
x = &a
2
y = x
3
y = &b
4
b = &c
5
Ideal-May-Point-To
???
Algorithm A
more efficient / less precise
Andersen’s
more efficient / less precise
Steensgaard’s
x: &y
y: &z
x: &b
y: &x
g
x: &b
x: &y
y: &x
y: &x
a
x: {&y,&b}
y: {&x,&z}
x: &y
y: &z
x: &b
y: &z
Ideal-May-Point-To
more efficient / less precise
Algorithm A
more efficient / less precise
Andersen’s
more efficient / less precise
Steensgaard’s
Ideal (with Int, with Malloc)
Ideal (with Int)
Ideal (with Malloc)
Ideal (no Int, no Malloc)
Algorithm A
Andersen’s
Steensgaard’s
1
x = new;
y = x;
*y = &b;
*y = &a;
x = new
2
y = x
3
*y = &b
4
*y = &a
5
4
*y = &a
5
class Foo {
A* f;
B* g;
}
s: x = new Foo()
x->f = &b;
x->g = &a;
class Foo {
A* f;
B* g;
}
s: x = new Foo()
x->f = &b;
x->g = &a;
1
if (P) then
S1;
else
S2;
endif
assume !P
assume P
2
4
S1
S2
3
5
1
if (P) then
S1;
else
S2;
endif
assume !P
assume P
2
4
S1
S2
3
5
1
if (x != null) then
y = x;
else
…
endif
assume (x != null)
assume (x == null)
2
4
y = x
S2
3
5
2
assume x == y
3