1. Pointer Analysis – A Survey Vishwanath Raman (call me vishwa please) vishwa@soe.ucsc.edu Dec. 1, 2004

2. I did say Pointer Analysis He certainly is a pointer.. By first impressions he seems earnest. But also wickedly gleeful. The puffing out of his chest is suggestive.. Seriously…

3. What is it? – For variables of pointer type, what are the objects they may point to at runtime. Where is it used? –Compiler optimizations – register allocation, constant propagation. –Bug detection – NULL pointer dereference. –Security violations – buffer overruns. –Tracking resource usage in static schedulers. ?/! (clearly borrowed)

4. Consider the following C snippet - int x, y, *p, **q; p = &x; q = &p; *q = &y; Points-to set: [q -> {p}, p -> {x, y}] Example

5. –Analysis based on a type system by Bjarne Steensgaard (Microsoft Research). –Analysis based on BDDs from the SABLE group at McGill. –An application of pointer analysis for bug detection from the SUIF group at Stanford. The survey covers?

6. In the interest of time… BDD based approach A BDD is a directed acyclic graph used to represent boolean functions and state spaces. Interpreted as sets – 1.S = {11} 2.S = {01, 10, 11} 1. 2.

7. a = allocate; // encode a = 00, location = 00 b = allocate; // b = 01, location = 01 c = allocate; // c = 10, location = 10 a = b; c = b; Points-to for allocate, Y = {(a, A), (b, B), (c, C)} Points-to for assignments X = {(b, a), (b, c)} In terms of bit strings (each bit is a BDD var) - {(0000), (0101), (1010)} and {(0100), (0110)} Analyze this...

8. RelProd(X, Y, V1) = {(v 2, h) | 1 v 1. ((v 1, v 2 ) ε X and (v 1, h) ε Y)} Points-to for allocate, Y = {(a, A), (b, B), (c, C)} Points-to for assignments, X = {(b, a), (b, c)} RelProd(X, Y, V1) = {(a, B), (c, B)} To get well formed BDDs, there are two variable domains (V1 and V2) with the same encoding BDD operations to die for 1 Can someone please tell me how to get the $#!@% symbol for “there exists” in Windows

9. Replace will replace variables in one domain with variables from another domain Replace ( RelProd ( X, Y, V1 ) ) = {(a, B), (c, B)} Now, a and c are from the V1 domain as opposed to the V2 domain. More operations to die for

10. Union has the usual meaning Union ( Replace ( RelProd ( X, Y, V1 ) ), Y ) = {(a, A), (b, B), (c, C), (a, B), (c, B)} as desired. Remember the program : a = allocate; b = allocate; c = allocate; a = b; c = b;

11. The types based approach defines a type system over a storage model and assigns types to locations. Two locations (variables) have unique type assignments, unless they HAVE to be of the same type for ALL statements to be well-formed. Types joined through unification. Algorithm produces a storage shape graph which can be used to get points-to sets and alias sets. An epitome of elegance

12. The bug detector from SUIF is more orthodox. Uses a variant of Static Single Assignment forms to compute def-use chains. def-use chains are analyzed for potential violations such as buffer overruns. Technique is inter-procedural, flow-sensitive and context-sensitive. Claim to fame

13. Thanks. If you are still interested and just can’t wait to get your hands on the survey - www.soe.ucsc.edu/~vishwa/publications/Pointers.pdf