1. Online Cycle Detection and Difference Propagation for Pointer Analysis David J. Pearce, Paul H.J. Kelly and Chris Hankin Imperial College, London d.pearce@doc.ic.ac.uk www.doc.ic.ac.uk/~djp1/

2. What is Pointer Analysis?  Determine targets of pointer variables without running program Analysis would conclude: p  {a}  In general this problem is undecidable >Any solution may be conservative >Must contain actual targets and may contain extra targets - e.g. p  {a,b}  Applications >Compiler – do statements interfere? If not, e.g. can reorder them. >Verification – e.g. can we show there are no NULL pointer errors? int a,b,*p; p = &a;

3. Constraint Graphs  One node per variable, edges represent assignments  But, what about “ *q = s ” ? >e.g. if q  {a,b} add edges s  b, s  a >Add new edges as solution for q becomes known p = &a; r = &b q = &c; q = p; q = r; pqr {a}{b} {c}

4. Constraint Graphs  One node per variable, edges represent assignments  But, what about “ *q = s ” ? >e.g. if q  {a,b} add edges s  a, s  b >Add new edges as solution for q becomes known p = &a; r = &b q = &c; q = p; q = r; pqr {a}{b} {a,b,c}

5. Speeding up Pointer Analysis  Online cycle detection >Variables in cycle must have same solution >Replacing cycles with single node reduces work >Hence, we have designed algorithm for online cycle detection  Difference Propagation >Original idea due to Fecht and Seidl [FS98] >Attempt to reduce cost of propagation -Set union operation typically linear in size of smallest set -Can reduce set size by preventing unnecessary repropagation pq {a}{b}

6. Empirical Data make 3.79.116164 LOC uucp 1.06.110256 LOC gawk 3.1.019598 LOC bash 2.0555324 LOC Execution time (s), to solve constraint graph Notes OCD = Online Cycle Detection 900 MHz Athlon, with 1GB RAM Doesn’t include time to generate or parse constraints and to build initial constraint graph 7.055.140.160.367 +OCD 7.095.850.1820.437 OCD + Diff Prop 26.437.60.260.41 +Diff Prop 49.458.60.465 Base bash 2.05gawk 3.1.0uucp 1.06.1make 3.79.1

7. Useful Insight  Working with large benchmarks (> 100 KLOC) >Memory requirements prohibitive >Many duplicate solution sets >Hash table scheme from [HT01] addresses this: -Sets stored in hash table with size as hash key -Can actually decrease execution time -Reduces memory requirements by factors of 10 or more  The Heintze-Tardieu Solver >Generally, faster than worklist algorithm – but why? - Doesn’t explore entire graph until complex statements resolved - Because always recomputes solution from scratch? >Doesn’t extend well to some more interesting ideas -For example, worklist algorithm better for modeling integer variables