SPAS: Scalable Path-Sensitive Pointer Analysis on Full-Sparse SSA

We present a new SPAS (Scalable PAth-Sensitive) framework for resolving points-to sets in C programs that exploits recent advances in pointer analysis. SPAS enables intraprocedural path-sensitivity to be obtained in flow-sensitive and context-sensitive (FSCS) techniques scalably, by using BDDs to manipulate program paths and by performing pointer analysis level-by-level on a full-sparse SSA representation similarly as the state-of-the-art LevPA (the FSCS version of SPAS). Compared with LevPA using all 27 C benchmarks in SPEC CPU2000 and CPU2006, SPAS incurs 18.42% increase in analysis time and 10.97% increase in memory usage on average, while guaranteeing that all points-to sets are obtained with non-decreasing precision.

[1]  Laurie J. Hendren,et al.  Context-sensitive interprocedural points-to analysis in the presence of function pointers , 1994, PLDI '94.

[2]  Mark N. Wegman,et al.  Efficiently computing static single assignment form and the control dependence graph , 1991, TOPL.

[3]  Hongtao Yu,et al.  Level by level: making flow- and context-sensitive pointer analysis scalable for millions of lines of code , 2010, CGO '10.

[4]  Ben Hardekopf,et al.  Semi-sparse flow-sensitive pointer analysis , 2009, POPL '09.

[5]  Ondrej Lhoták,et al.  Points-to analysis using BDDs , 2003, PLDI '03.

[6]  Alexander Aiken,et al.  Scalable error detection using boolean satisfiability , 2005, POPL '05.

[7]  Monica S. Lam,et al.  Cloning-based context-sensitive pointer alias analysis using binary decision diagrams , 2004, PLDI '04.

[8]  Vineet Kahlon.  Bootstrapping: a technique for scalable flow and context-sensitive pointer alias analysis , 2008, PLDI '08.

[9]  Benjamin Livshits,et al.  Tracking pointers with path and context sensitivity for bug detection in C programs , 2003, ESEC/FSE-11.

[10]  J. Johannes.  Source Code Composition with the Reuseware Composition Framework , 2007 .

[11]  William R. Bush,et al.  A static analyzer for finding dynamic programming errors , 2000 .

[12]  Barbara G. Ryder,et al.  Relevant context inference , 1999, POPL '99.

[13]  Mary Lou Soffa,et al.  Refining buffer overflow detection via demand-driven path-sensitive analysis , 2007, PASTE '07.

[14]  Welf Löwe,et al.  Towards Path-Sensitive Points-to Analysis , 2007, Seventh IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM 2007).

[15]  Hong-Seok Kim,et al.  Bottom-Up and Top-Down Context-Sensitive Summary-Based Pointer Analysis , 2004, SAS.

[16]  Ben Hardekopf,et al.  Flow-sensitive pointer analysis for millions of lines of code , 2011, International Symposium on Code Generation and Optimization (CGO 2011).

[17]  Isil Dillig,et al.  Sound, complete and scalable path-sensitive analysis , 2008, PLDI '08.

[18]  Ondrej Lhoták,et al.  Pick your contexts well: understanding object-sensitivity , 2011, POPL '11.

[19]  Bjarne Steensgaard,et al.  Points-to analysis in almost linear time , 1996, POPL '96.

[20]  Barbara G. Ryder,et al.  A safe approximate algorithm for interprocedural aliasing , 1992, PLDI '92.

[21]  Raymond Lo,et al.  Effective Representation of Aliases and Indirect Memory Operations in SSA Form , 1996, CC.

[22]  Lin Gao,et al.  Partial dead code elimination on predicated code regions , 2006 .

[23]  Alexander Aiken,et al.  Context- and path-sensitive memory leak detection , 2005, ESEC/FSE-13.

[24]  Ondrej Lhoták,et al.  Points-to analysis with efficient strong updates , 2011, POPL '11.

[25]  Jianwen Zhu,et al.  Symbolic pointer analysis revisited , 2004, PLDI '04.