William Landi

A safe approximate algorithm for interprocedural aliasing

During execution, when two or more names exist for the same location at some program point, we call them aliases. In a language which allows arbitrary pointers, the problem of determining aliases at a program point is &rgr;-space-hard [Lan92]. We present an algorithm for the Conditional May Alias problem, which can be used to safely approximate Interprocedural May Alias in the presence of pointers. This algorithm is as precise as possible in the worst case and has been implemented in a prototype analysis tool for C programs. Preliminary speed and precision results are presented.

Relevant context inference

Relevant context inference (RCI) is a modular technique for flow- and context-sensitive data-flow analysis of statically typed object-oriented programming languages such as C++ and Java. RCI can be used to analyze complete programs as well as incomplete programs such as libraries; this approach does not require that the entire program be memory-resident during the analysis. RCI is presented in the context of points-to analysis for a realistic subset of C++. The empirical evidence obtained from a prototype implementation argues the effectiveness of RCI.

Pointer-induced aliasing: a problem classification

A?iasing occurs at some program point during execution when two or more names exist for the same location. We have isolated various programming language mechanisms which create aliases. We have classified the complexity of the fllas problem induced by each mechanism alone and in combination, as AfP-hard, complement tip-hard, or polynomial (’P). We present our problem classification, give an overview of our proof that finding interprocedural aliases in the presence of single level pointers is in 7, and present a represent tive proof for the NP-hard problems.

Interprocedural modification side effect analysis with pointer aliasing

We present a new interprocedural modification side effects algorithm for C programs, that can discern side effects through general-purpose pointer usage. Ours is the first complete design and implementation of such an algorithm. Preliminary performance findings support the practicality of the technique, which is based on our previous approximation algorithm for pointer aliases [LR92]. Each indirect store through a pointer variable is found, on average, to correspond to a store into 1.2 locations. This indicates that our program-point-specific pointer aliasing information is quite precise when used to determine the effects of these stores.

Interprocedural def-use associations for C systems with single level pointers

Def-use analysis links possible value-setting statements for a variable (i.e. definitions) to potential value-fetches (i.e. uses) of that value. This paper describes the first algorithm that calculates accurate interprocedural def-use associations in C software systems. Our algorithm accounts for program-point-specific pointer-induced aliases, though it is currently limited to programs using a single level of indirection. We prove the NP-hardness of the interprocedural reaching definitions problem and describe the approximations made by our polynomial-time algorithm. Initial empirical results are also presented. >

A schema for interprocedural modification side-effect analysis with pointer aliasing

The first interprocedural modification side-effects analysis for C (MOD<subscrpt><italic>C</italic></subscrpt>) that obtains better than worst-case precision on programs with general-purpose pointer usage is presented with empirical results. The analysis consists of an algorithm schema corresponding to a family of MOD<subscrpt><italic>C</italic></subscrpt> algorithms with two independent phases: one for determining pointer-induced aliases and a subsequent one for propagating interprocedural side effects. These MOD<subscrpt><italic>C</italic></subscrpt> algorithms are parameterized by the aliasing method used. The empirical results compare the performance of two dissimilar MOD<subscrpt><italic>C</italic></subscrpt> algorithms: MOD<subscrpt><italic>C</italic></subscrpt>(<italic>FSAlias</italic>) uses a flow-sensitive, calling-context-sensitive interprocedural alias analysis; MOD<subscrpt><italic>C</italic></subscrpt>(<italic>FIAlias</italic> uses a flow-insensitive, calling-context-insensitive alias analysis which is much faster, but less accurate. These two algorithms were profiled on 45 programs ranging in size from 250 to 30,000 lines of C code, and the results demonstrate dramatically the possible cost-precision trade-offs. This <italic>first comparative</italic> implementation of MOD<subscrpt><italic>C</italic></subscrpt> analyses offers insight into the differences between <italic>flow-/context-sensitive</italic> and <italic>flow-/context-insensitive</italic> analyses. The analysis cost versus precision trade-offs in side-effect information obtained are reported. The results show surprisingly that the precision of flow-sensitive side-effect analysis is not always prohibitive in cost, and that the precision of flow-insensitive analysis is substantially better than worst-case estimates and seems sufficient for certain applications. On average MOD<subscrpt><italic>C</italic></subscrpt>(<italic>FSAlias</italic>) for procedures and calls is in the range of 20% more precise than MOD<subscrpt><italic>C</italic></subscrpt>(<italic>FIAlias</italic>); however, the performance was found to be at least an order of magnitude slower than MOD<subscrpt><italic>C</italic></subscrpt>(<italic>FIAlias</italic>).

Data-flow analysis of program fragments

Traditional interprocedural data-flow analysis is performed on whole programs; however, such whole-program analysis is not feasible for large or incomplete programs. We propose fragment data-flow analysis as an alternative approach which computes data-flow information for a specific program fragment. The analysis is parameterized by the additional information available about the rest of the program. We describe two frameworks for interprocedural flow-sensitive fragment analysis, the relationship between fragment analysis and whole-program analysis, and the requirements ensuring fragment analysis safety and feasibility. We propose an application of fragment analysis as a second analysis phase after an inexpensive flow-insensitive whole-program analysis, in order to obtain better information for important program fragments. We also describe the design of two fragment analyses derived from an already existing whole-program flow- and context-sensitive pointer alias analysis for C programs and present empirical evaluation of their cost and precision. Our experiments show evidence of dramatically better precision obtainable at a practical cost.

Program decomposition for pointer aliasing: a step toward practical analyses

Pointer aliasing analysis is crucial to compile-time analyses for languages with general-purpose pointer usage (such as C), but many aliasing methods have proven quite costly. We present a technique that partitions the statements of a program to allow separate, and therefore possibly different, pointer aliasing analysis methods to be used on independent parts of the program. This decomposition enables exploration of tradeoff between algorithm efficiency and precision. We also present a new, efficient flow-insensitive pointer aliasing algorithm, which is used together with an existing flow-sensitive aliasing algorithm in our experiments. We demonstrate our technique in the context of determining side effects and variable fetches through names containing pointer dereferences (Thru-deref MOD/REF). Initial empirical results using a combination of a flow-sensitive and a flow-insensitive aliasing analysis on the same program, demonstrate that the resulting analysis is much faster than solely using the flow-sensitive method, and obtains similar precision for the Thru-deref MOD/REF problems.

An incremental flow- and context-sensitive pointer aliasing analysis

Pointer aliasing analysis is used to determine if two object names containing dereferences and/or field selectors (e.g., *P,9->t) may refer to the same location during execution. Such information is necessary for applications such as data-flow-based testers, program understanding tools, and debuggers, but is expensive to calculate with acceptable precision. Incremental algorithms update data flow information after a program change rather than recomputing it from scratch, under the assumption that the change impact will be limited. Two versions of a practical incremental pointer aliasing algorithm have been developed, based on Landi-Ryder flow- and context-sensitive alias analysis. Empirical results attest to the time savings over exhaustive analysis (a six-fold speedup on average), and the precision of the approximate solution obtained (on average same solution as exhaustive algorithm for 75% of the tests.).

Experiments with combined analysis for pointer aliasing

We present initial empirical experiments with combined analysis, a scalabk analysis technique that uses a program decomposition to apply different aliasing algorithms to independent program segments. The effectiveness of the solution strategy is validated through application to side-effect and reference analysis of C programs.