A novel analysis space for pointer analysis and its application for bug finding

  • Authors:

  • Marcio Buss;Daniel Brand;Vugranam Sreedhar;Stephen A. Edwards

  • Affiliations:

  • Department of Computer Science, Columbia University, New York, NY, United States and IBM T. J. Watson Research Center, Yorktown Heights, NY, United States;IBM T. J. Watson Research Center, Yorktown Heights, NY, United States;IBM T. J. Watson Research Center, Hawthorne, NY, United States;Department of Computer Science, Columbia University, New York, NY, United States

  • Venue:
  • Science of Computer Programming
  • Year:
  • 2010

Quantified Score

Hi-index 0.00

Visualization

Abstract

The size of today's programs continues to grow, as does the number of bugs they contain. Testing alone is rarely able to flush out all bugs, and many lurk in difficult-to-test corner cases. An important alternative is static analysis, in which correctness properties of a program are checked without running it. While it cannot catch all errors, static analysis can catch many subtle problems that testing would miss. We propose a new space of abstractions for pointer analysis-an important component of static analysis for C and similar languages. We identify two main components of any abstraction-how to model statement order and how to model conditionals, then present a new model of programs that enables us to explore different abstractions in this space. Our assign-fetch graph represents reads and writes to memory instead of traditional points-to relations and leads to concise function summaries that can be used in any context. Its flexibility supports many new analysis techniques with different trade-offs between precision and speed. We present the details of our abstraction space, explain where existing algorithms fit, describe a variety of new analysis algorithms based on our assign-fetch graphs, and finally present experimental results that show our flow-aware abstraction for statement ordering both runs faster and produces more precise results than traditional flow-insensitive analysis.