Bottom-Up and Top-Down Context-Sensitive Summary-Based Pointer Analysis

  • Erik M. Nystrom
  • Hong-Seok Kim
  • Wen-mei W. Hwu
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3148)


This paper addresses scalability and accuracy of summary-based context-sensitive pointer analysis formulated as a two-phase computation. The first phase, or bottom-up phase, propagates procedure summaries from callees to callers. Then, the second phase, or top-down phase, computes the actual pointer information. These two phases can be independently context-sensitive. Having observed the problems that procedural side effects cause, we developed a bottom-up phase that constructs concise procedure summaries in a manner that permits their subsequent removal. This transformation results in an efficient two-phase pointer analysis in the style of Andersen [1] that is simultaneously bottom-up and top-down context-sensitive. Context sensitivity becomes inherent to even a context-insensitive analysis allowing for an accurate and efficient top-down phase. The implemented context-sensitive analysis exhibits scalability comparable to that of its context-insensitive counterpart. For instance, to analyze 176.gcc, the largest C benchmark in SPEC 2000, our analysis takes 190 seconds as opposed to 44 seconds for the context-insensitive analysis. Given the common practice of treating recursive subgraphs context-insensitively, its accuracy is equivalent to an analysis which completely inlines all procedure calls.


Pointer Analysis Code Fragment Context Sensitivity Call Graph Pointer Information 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Andersen, L.O.: Program analysis and specialization for the C programming language. Ph.D thesis, DIKU, Unversity of Copenhagen (1994)Google Scholar
  2. 2.
    Chatterjee, R., Ryder, B.G., Landi, W.A.: Relevant context inference. In: POPL (1999)Google Scholar
  3. 3.
    Cheng, B.-C., Hwu, W.W.: Modular interprocedural pointer analysis using access paths: design, implementation, and evaluation. In: PLDI (2000)Google Scholar
  4. 4.
    Choi, J.-D., Gupta, M., Serrano, M.J., Sreedhar, V.C., Midkiff, S.P.: Stack allocation and synchronization optimizations for java using escape analysis. TOPLAS (2003)Google Scholar
  5. 5.
    Clarke, E., Grunmberg, O., Jha, S., Lu, Y., Veith, H.: Counterexample-guided abstraction refinement for symbolic model checking. Journal of the ACM (1997)Google Scholar
  6. 6.
    Das, M.: Unification-based pointer analysis with directional assignments. In: PLDI (2000)Google Scholar
  7. 7.
    Das, M., Liblit, B., Fähndrich, M., Rehof, J.: Estimating the impact of scalable pointer analysis on optimization. In: Cousot, P. (ed.) SAS 2001. LNCS, vol. 2126, p. 260. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  8. 8.
    Emami, M., Ghiya, R., Hendren, L.J.: Context-sensitive interprocedural pointsto analysis in the presence of function pointers. In: PLDI (1994)Google Scholar
  9. 9.
    Fähndrich, M., Foster, J.S., Su, Z., Aiken, A.: Partial online cycle elimination in inclusion constraint graphs. In: PLDI (1998)Google Scholar
  10. 10.
    Fähndrich, M., Rehof, J., Das, M.: Scalable context-sensitive flow analysis using instantiation constraints. In: PLDI (2000)Google Scholar
  11. 11.
    Flanagan, C., Felleisen, M.: Componential set-based analysis. In: PLDI (1997)Google Scholar
  12. 12.
    Foster, J.S., Fähndrich, M., Aiken, A.: Polymorphic versus monomorphic flowinsensitive points-to analysis for C. In: Palsberg, J. (ed.) SAS 2000. LNCS, vol. 1824, pp. 175–199. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  13. 13.
    Guyer, S.Z., Lin, C.: Client-driven pointer analysis. In: Cousot, R. (ed.) SAS 2003. LNCS, vol. 2694, Springer, Heidelberg (2003)CrossRefGoogle Scholar
  14. 14.
    Heintze, N., Tardieu, O.: Ultra-fast aliasing analysis using CLA: a million lines of C code in a second. In: PLDI (2001)Google Scholar
  15. 15.
    Hind, M.: Pointer analysis: Haven’t we solved this problem yet?. In: PASTE (2001)Google Scholar
  16. 16.
    Hind, M., Burke, M., Carini, P., Choi, J.-D.: Interprocedural pointer alias analysis. TOPLAS 21(4), 848–894 (1999)CrossRefGoogle Scholar
  17. 17.
    Hopcroft, J.E.: An nlogn algorithm for minimizing the states of a finite automaton. The Theory of Machines and Computations, 189–196 (1971)Google Scholar
  18. 18.
    Kim, H.-S., Nystrom, E.M., Hwu, W.W.: Bottom-up and top-down contextsensitive summary-based pointer analysis. Technical report, IMPACT research group, University of Illinois (2004)Google Scholar
  19. 19.
    Landi, W., Ryder, B.G.: A safe approximation algorithm for interprocedural pointer aliasing. In: PLDI (1992)Google Scholar
  20. 20.
    Lattner, C., Adve, V.: Data structure analysis: a fast and scalable contextsensitive heap analysis. Technical report, CS Dept., University of Illinois (2003)Google Scholar
  21. 21.
    Liang, D., Harrold, M.J.: Efficient points-to analysis for whole-program analysis. In: FSE (1999)Google Scholar
  22. 22.
    McAllester, D.A.: On the complexity analysis of static analysis. In: Cortesi, A., Filé, G. (eds.) SAS 1999. LNCS, vol. 1694, p. 312. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  23. 23.
    Rehof, J.: Minimal typings in atomic subtyping. In: POPL (1997)Google Scholar
  24. 24.
    Reps, T., Horwitz, S., Sagiv, M.: Precise interprocedural dataflow analysis via graph reachability. In: POPL (1995)Google Scholar
  25. 25.
    Ruf, E.: Context-insensitive alias analysis reconsidered. In: PLDI (1995)Google Scholar
  26. 26.
    Steensgaard, B.: Points-to analysis in almost linear time. In: POPL (1996)Google Scholar
  27. 27.
    Wilson, R.P., Lam, M.S.: Efficient context-sensitive pointer analysis for C programs. In: PLDI (1995)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2004

Authors and Affiliations

  • Erik M. Nystrom
    • 1
  • Hong-Seok Kim
    • 1
  • Wen-mei W. Hwu
    • 1
  1. 1.Center for Reliable and High Performance ComputingUniversity of Illinois, Urbana-Champaign 

Personalised recommendations