Lazy Pointer Analysis

Flow- and context-sensitive pointer analysis is generally considered too expensive for large programs; most tools relax one or both of the require- ments for scalability. We formulate a flow- and context-sens itive points-to anal- ysis that is lazy in the following sense: points-to informat ion is computed only for live pointers and its propagation is sparse (restricted to live ranges of respec- tive pointers). Our analysis also: ( i) uses strong liveness, effectively including dead code elimination; (ii) afterwards calculates must-points-to information from may-points-to information instead of using a mutual fixed-p oint; (iii) uses value- based termination of call strings during interprocedural a nalysis (which reduces the number of call strings significantly). A naive implementation of our analysis within GCC-4.6.0 gave analysis time and size of points-to measurements for SPEC2006. Using liveness reduced the amount of points-to information by an order of magnitude with no loss of pre- cision. For all programs under 30kLoC we found that the results were much more precise than gcc's analysis. What comes as a pleasant su rprise however, is the fact that below this cross-over point, our naive linke d-list implementation is faster than a flow- and context-insensitive analysis whic h is primarily used for efficiency. We speculate that lazy flow- and context-sensiti ve analyses may be not only more precise, but also more efficient, than current appr oaches.