Structure-Sensitive Points-To Analysis for C and C++

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9837)

Abstract

We present a points-to analysis for C/C++ that recovers much of the available high-level structure information of types and objects, by applying two key techniques: (1) It records the type of each abstract object and, in cases when the type is not readily available, the analysis uses an allocation-site plus type abstraction to create multiple abstract objects per allocation site, so that each one is associated with a single type. (2) It creates separate abstract objects that represent (a) the fields of objects of either struct or class type, and (b) the (statically present) constant indices of arrays, resulting in a limited form of array-sensitivity.

We apply our approach to the full LLVM bitcode intermediate language and show that it yields much higher precision than past analyses, allowing accurate distinctions between subobjects, v-table entries, array components, and more. Especially for C++ programs, this precision is invaluable for a realistic analysis. Compared to the state-of-the-art past approach, our techniques exhibit substantially better precision along multiple metrics and realistic benchmarks (e.g., 40+% more variables with a single points-to target).

Keywords

Abstract Object Array Element Load Instruction Store Instruction Allocation Site 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Notes

Acknowledgments

We gratefully acknowledge funding by the European Research Council under grant 307334 (Spade). We thank Kostas Ferles and Eirini Psallida for their early contributions to cclyzer; and also the anonymous reviewers of this paper, for their insightful comments and suggestions.

References

  1. 1.
    Andersen, L.O.: Program analysis and specialization for the C programming language. Ph.d. thesis, DIKU, University of Copenhagen, May 1994Google Scholar
  2. 2.
    Avots, D., Dalton, M., Livshits, B., Lam, M.S.: Improving software security with a C pointer analysis. In: Proceedings of the 27th International Conference on Software Engineering, ICSE 2005, pp. 332–341. ACM, New York (2005)Google Scholar
  3. 3.
    Berndl, M., Lhoták, O., Qian, F., Hendren, L.J., Umanee, N.: Points-to analysis using BDDs. In: Proceedings of the 2003 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2003, pp. 103–114. ACM, New York (2003)Google Scholar
  4. 4.
    Bravenboer, M., Smaragdakis, Y.: Strictly declarative specification of sophisticated points-to analyses. In: Proceedings of the 24th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, OOPSLA 2009. ACM, New York (2009)Google Scholar
  5. 5.
    Das, M.: Unification-based pointer analysis with directional assignments. In: Proceedings of the 2000 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2000, pp. 35–46. ACM, New York (2000)Google Scholar
  6. 6.
    Emami, M., Ghiya, R., Hendren, L.J.: Context-sensitive interprocedural points-to analysis in the presence of function pointers. In: Proceedings of the 1994 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 1994, pp. 242–256. ACM, New York (1994)Google Scholar
  7. 7.
    Hardekopf, B., Lin, C.: The ant and the grasshopper: fast and accurate pointer analysis for millions of lines of code. In: Proceedings of the 2007 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2007, pp. 290–299. ACM, New York (2007)Google Scholar
  8. 8.
    Hardekopf, B., Lin, C.: Exploiting pointer and location equivalence to optimize pointer analysis. In: Riis Nielson, H., Filé, G. (eds.) SAS 2007. LNCS, vol. 4634, pp. 265–280. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  9. 9.
    Hardekopf, B., Lin, C.: Semi-sparse flow-sensitive pointer analysis. In: Proceedings of the 36th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2009, pp. 226–238. ACM, New York (2009)Google Scholar
  10. 10.
    Hardekopf, B., Lin, C.: Flow-sensitive pointer analysis for millions of lines of code. In: Proceedings of the 9th International Symposium on Code Generation and Optimization, CGO 2011, pp. 289–298. IEEE Computer Society (2011)Google Scholar
  11. 11.
    Heintze, N., Tardieu, O.: Ultra-fast aliasing analysis using CLA: a million lines of C code in a second. In: Proceedings of the 2001 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2001, pp. 254–263. ACM, New York (2001)Google Scholar
  12. 12.
    Hind, M., Burke, M.G., Carini, P.R., Choi, J.: Interprocedural pointer alias analysis. ACM Trans. Program. Lang. Syst. 21(4), 848–894 (1999)CrossRefGoogle Scholar
  13. 13.
    Lattner, C., Lenharth, A., Adve, V.S.: Making context-sensitive points-to analysis with heap cloning practical for the real world. In: Proceedings of the 2007 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2007, pp. 278–289. ACM, New York (2007)Google Scholar
  14. 14.
    Lhoták, O., Chung, K.C.A.: Points-to analysis with efficient strong updates. In: Proceedings of the 38th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2011, pp. 3–16. ACM, New York (2011)Google Scholar
  15. 15.
    Li, Y., Tan, T., Sui, Y., Xue, J.: Self-inferencing reflection resolution for Java. In: Jones, R. (ed.) ECOOP 2014. LNCS, vol. 8586, pp. 27–53. Springer, Heidelberg (2014)Google Scholar
  16. 16.
    Livshits, B., Whaley, J., Lam, M.S.: Reflection analysis for Java. In: Yi, K. (ed.) APLAS 2005. LNCS, vol. 3780, pp. 139–160. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  17. 17.
    Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to and side-effect analyses for Java. In: Proceedings of the 2002 International Symposium on Software Testing and Analysis, ISSTA 2002, pp. 1–11. ACM, New York (2002)Google Scholar
  18. 18.
    Miné, A.: Field-sensitive value analysis of embedded C programs with union types and pointer arithmetics. In: Proceedings of the 2006 ACM SIGPLAN/SIGBED Conference on Languages, Compilers, and Tools for Embedded Systems, LCTES 2006, pp. 54–63. ACM (2006)Google Scholar
  19. 19.
    Nystrom, E.M., Kim, H., Hwu, W.W.: Importance of heap specialization in pointer analysis. In: Proceedings of the 5th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, PASTE 2004, pp. 43–48. ACM, New York (2004)Google Scholar
  20. 20.
    Pearce, D.J., Kelly, P.H.J., Hankin, C.: Efficient field-sensitive pointer analysis for C. In: Proceedings of the 5th ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, PASTE 2004, pp. 37–42. ACM, New York (2004)Google Scholar
  21. 21.
    Pearce, D.J., Kelly, P.H.J., Hankin, C.: Efficient field-sensitive pointer analysis of C. ACM Trans. Program. Lang. Syst. 30(1) (2007)Google Scholar
  22. 22.
    Rountev, A., Milanova, A., Ryder, B.G.: Points-to analysis for Java using annotated constraints. In: Proceedings of the 16th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, OOPSLA 2001, pp. 43–55. ACM, New York (2001)Google Scholar
  23. 23.
    Smaragdakis, Y., Balatsouras, G., Kastrinis, G., Bravenboer, M.: More sound static handling of Java reflection. In: Feng, X., et al. (eds.) APLAS 2015. LNCS, vol. 9458, pp. 485–503. Springer, Heidelberg (2015). doi: 10.1007/978-3-319-26529-2_26 CrossRefGoogle Scholar
  24. 24.
    Whaley, J., Rinard, M.C.: Compositional pointer and escape analysis for Java programs. In: Proceedings of the 14th Annual ACM SIGPLAN Conference on Object Oriented Programming, Systems, Languages, and Applications, OOPSLA 1999, pp. 187–206. ACM, New York (1999)Google Scholar
  25. 25.
    Zheng, X., Rugina, R.: Demand-driven alias analysis for C. In: Proceedings of the 35th ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL 2008, pp. 197–208. ACM, New York (2008)Google Scholar

Copyright information

© Springer-Verlag GmbH Germany 2016

Authors and Affiliations

  1. 1.Department of InformaticsUniversity of AthensAthensGreece

Personalised recommendations