The Flow-Insensitive Precision of Andersen’s Analysis in Practice
We present techniques for determining the precision gap between Andersen’s points-to analysis and precise flow-insensitive points-to analysis in practice. While previous work has shown that such a gap may exist, no efficient algorithm for precise flow-insensitive analysis is known, making measurement of the gap on real-world programs difficult. We give an algorithm for precise flow-insensitive analysis of programs with finite memory, based on a novel technique for refining any points-to analysis with a search for flow-insensitive witnesses. We give a compact symbolic encoding of the technique that enables computing the search using a tuned SAT solver. We also present extensions of the algorithm that enable computing lower and upper bounds on the precision gap in the presence of dynamic memory allocation. In our experimental evaluation over a suite of small- to medium-sized C programs, we never observed a precision gap between Andersen’s analysis and the precise analysis. In other words, Andersen’s analysis computed a precise flow-insensitive result for all of our benchmarks. Hence, we conclude that while better algorithms for the precise flow-insensitive analysis are still of theoretical interest, their practical impact for C programs is likely to be negligible.
Unable to display preview. Download preview PDF.
- 1.Andersen, L.O.: Program Analysis and Specialization for the C Programming Language. PhD thesis, University of Copenhagen, DIKU (1994)Google Scholar
- 2.Berndl, M., Lhoták, O., Qian, F., Hendren, L., Umanee, N.: Points-to analysis using BDDs. In: Programming Language Design and Implementation (PLDI), pp. 103–114 (2003)Google Scholar
- 3.Blackshear, S., Chang, B.-Y.E., Sankaranarayanan, S., Sridharan, M.: The flow-insensitive precision of Andersen’s analysis in practice (extended version). Technical Report CU-CS-1083-11, Department of Computer Science, University of Colorado Boulder (2011)Google Scholar
- 5.Chakaravarthy, V.T.: New results on the computability and complexity of points-to analysis. In: Principles of Programming Languages (POPL), pp. 115–125 (2003)Google Scholar
- 6.Dutertre, B., de Moura, L.: The YICES SMT solver, http://yices.csl.sri.com/tool-paper.pdf
- 7.Hardekopf, B., Lin, C.: The ant and the grasshopper: Fast and accurate pointer analysis for millions of lines of code. In: Programming Language Design and Implementation (PLDI), pp. 290–299 (2007)Google Scholar
- 8.Hind, M.: Pointer analysis: Haven’t we solved this problem yet? In: Program Analysis for Software Tools and Engineering (PASTE), pp. 54–61 (2001)Google Scholar
- 9.Horwitz, S.: Precise flow-insensitive alias analysis is NP-hard. ACM Trans. Program. Lang. Syst. 19(1) (1997)Google Scholar
- 10.Kahlon, V.: Bootstrapping: a technique for scalable flow and context-sensitive pointer alias analysis. In: Programming Language Design and Implementation (PLDI), pp. 249–259 (2008)Google Scholar
- 12.Muth, R., Debray, S.: On the complexity of flow-sensitive dataflow analyses. In: Principles of Programming Languages (POPL), pp. 67–80 (2000)Google Scholar
- 17.Rinetzky, N., Ramalingam, G., Sagiv, M., Yahav, E.: On the complexity of partially-flow-sensitive alias analysis. ACM Trans. Program. Lang. Syst. 30(3) (2008)Google Scholar
- 18.Steensgaard, B.: Points-to analysis in almost linear time. In: Principles of Programming Languages (POPL), pp. 32–41 (1996)Google Scholar
- 19.Whaley, J., Lam, M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: Programming Language Design and Implementation (PLDI), pp. 131–144 (2004)Google Scholar