Fast and precise points-to analysis

  • Authors:

  • Jonas Lundberg;Tobias Gutzmann;Marcus Edvinsson;Welf Löwe

  • Affiliations:

  • Software Technology Group, School of Mathematics and System Engineering, Växjö University, 351 95 Växjö, Sweden;Software Technology Group, School of Mathematics and System Engineering, Växjö University, 351 95 Växjö, Sweden;Software Technology Group, School of Mathematics and System Engineering, Växjö University, 351 95 Växjö, Sweden;Software Technology Group, School of Mathematics and System Engineering, Växjö University, 351 95 Växjö, Sweden

  • Venue:
  • Information and Software Technology
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Many software engineering applications require points-to analysis. These client applications range from optimizing compilers to integrated program development environments (IDEs) and from testing environments to reverse-engineering tools. Moreover, software engineering applications used in an edit-compile cycle need points-to analysis to be fast and precise. In this article, we present a new context- and flow-sensitive approach to points-to analysis where calling contexts are distinguished by the points-to sets analyzed for their call target expressions. Compared to other well-known context-sensitive techniques it is faster in practice, on average, twice as fast as the call string approach and by an order of magnitude faster than the object-sensitive technique. In fact, it shows to be only marginally slower than a context-insensitive baseline analysis. At the same time, it provides higher precision than the call string technique and is similar in precision to the object-sensitive technique. We confirm these statements with experiments using a number of abstract precision metrics and a concrete client application: escape analysis.