Flow and Context Sensitive Points-to Analysis using Higher Order Reachability

The bottom up interprocedural methods construct summary flow functions for procedures to represent their calls. These methods have been effectively used for many analyses except for flow and context sensitive points-to analysis which require representing indirect accesses of pointees defined in the callers. This is conventionally handled by using placeholders which explicate the unknown locations resulting in either a large number of placeholders or multiple call-specific summary flow functions for a procedure. We propose a bounded representation of summary flow functions for may points-to analysis called the higher order reachability graph (HRG). The conventional graph reachability based program analyses relate variables but not their pointees whereas HRGs relate the (transitively indirect) pointees of a variable with those of another variable in terms of indirection levels. A simple arithmetic on indirection levels allows unknown locations to be left implicit and is sufficient to relate the indirect pointees defined in the callers obviating the need of placeholders. Thus we construct a single summary flow function (HRG) per procedure which is bounded by the number of variables, is flow sensitive, and performs strong updates in the calling contexts. Our empirical measurements on SPEC benchmarks show that most summary flow functions are compact and are used multiple times. We have been able to scale flow and context sensitive points-to analysis to 158 kLoC using HRGs. Thus, this is a promising direction for further investigations in efficiency and scalability of points-to analysis without compromising on precision.