Practical Integrated Analysis of Pointers, Dataflow and Control Flow

• Authors: Stefan Staiger-Stöhr
• Venue: ACM Transactions on Programming Languages and Systems (TOPLAS)
• Year: 2013

This article presents a family of static analyses to determine pointer targets, control flow, and dataflow in combination. The integrated solution to these mutually dependent problems approaches the result from the optimistic side. It is a general strategy for static program analysis and does not need any upfront approximation for one of the problems to overcome the mutual dependencies. A degenerated case yields Andersen’s famous pointer analysis; otherwise, the analyses are flow-sensitive and can support direct and indirect strong updates, within the same cubic asymptotic complexity as known for Andersen, albeit with larger constants. Surprisingly, the ideas behind the integrated analysis are intuitive. The strategy we describe naturally evolves from considering the mutual dependencies between the three problems, or from generalizing Andersen’s analysis to flow sensitivity. Such a flow-sensitive Andersen analysis not only computes pointer targets with higher precision than the original analysis, but it also creates an interprocedural SSA form at the same time. Our extensive experimental evaluation shows that the integrated solution is practical as it can be applied to reasonably large real-world programs within a few seconds or minutes. This uses some optimizations which together achieve a speedup of more than 100 for several programs. We compare several members of the family of analyses, from flow- and field-insensitive to flow- and field-sensitive with strong updates, both with and without optimizations. This gives some insights into the effects of these dimensions of precision on the results. It also sheds new light on the benefits of flow sensitivity versus the costs associated with it.