A lightweight context-sensitive pointer analysis method based on higher-order functions

Abstract

The present invention discloses a lightweight context-sensitive pointer analysis method based on a high-order function, comprising: determining a function analysis order; collecting context-insensitive pointing constraints according to the function analysis order; collecting context-sensitive pointing constraints; solving the context-insensitive pointing constraints and the context-sensitive pointing constraints to obtain the pointing information analysis results of the called function, and saving them in the form of a high-order function; judging whether all functions have been analyzed, and if not, continuing to collect pointing constraints of other functions; otherwise, outputting the pointer analysis results; the present invention can avoid the additional introduction of auxiliary variables and mapping tables in the existing method to solve the indirect reference problem, thereby efficiently performing context-sensitive pointer analysis.

Description

Technical Field

[0001] The present invention relates to the technical field of functional programming and program analysis, and in particular to a lightweight context-sensitive pointer analysis method based on high-order functions. Background Art

[0002] In recent years, pointer analysis is an important technology in the field of program analysis. Pointer analysis can be used to determine the address pointed to by a pointer variable in a program. The results of pointer analysis can be applied to other program analysis techniques and can directly affect the accuracy of the analysis results of these techniques. Pointer analysis can be classified according to different dimensions, selecting the call point in the program as context information. In addition, in object-oriented programs, the receiving object of the function can be selected as context information, or the type of the receiving object of the function can be used as context information.

[0003] The traditional context-sensitive pointer analysis method needs to establish a mapping table for variables inside and outside the function body. It not only needs to record the correspondence between the actual parameter x and the formal parameter a, but also needs to introduce auxiliary variables to represent *x and **x. According to the variable address stored in x, other variables are indirectly referenced, and the correspondence between *x, **x and the variables indirectly referenced is recorded. After the analysis of the called function is completed, the reverse mapping is performed according to the correspondence in the mapping table. However, when using high-order functions for analysis, only the actual parameters themselves need to be substituted, and the values ​​indirectly referenced through the actual parameters, that is, the pointer set of the actual parameters, can be brought back to the calling point from the called function body in the form of a function, and the specific pointer is calculated at the calling point.

[0004] Higher-order functions are a feature of functional programming. Functions can be used as parameters and return values. Therefore, during pointer analysis, the uncertain pointing set can be brought back to the call point in the form of a function, and the pointing information can be concretized at the call point based on the actual pointing. Summary of the invention

[0005] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0006] In view of the above existing problems, the present invention is proposed.

[0007] To solve the above technical problems, the present invention provides the following technical solutions, including: determining the function analysis order; collecting context-insensitive pointing constraints according to the function analysis order; collecting context-sensitive pointing constraints; solving the context-insensitive pointing constraints and the context-sensitive pointing constraints to obtain the pointing information analysis results of the called function, and saving them in the form of high-order functions; judging whether the function has been fully analyzed, if not, continuing to collect context-insensitive pointing constraints; otherwise, outputting the pointer analysis results.

[0008] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed in the present invention, it is proposed that: determining the function analysis order includes: generating a function call graph of the program to be analyzed, and performing reverse topological sorting on the functions in the program to be analyzed according to the function call graph.

[0009] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed in the present invention, collecting context-insensitive pointing constraints includes: taking out a function to be analyzed in the order of function analysis, generating a control flow graph of the function, and initializing pointer information according to the type of variables in the source code; traversing each node in the control flow graph, that is, statement, analyzing the statements related to pointer information, and adding the pointer information in the statement to the constraint table in the form of constraints.

[0010] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed in the present invention, it includes: statements related to pointer information refer to four types of statements that do not involve function calls and will change the pointer pointing, namely pointer statements, copy statements, load statements, and store statements; the four types of statements are analyzed using a pointer analysis algorithm based on set inclusion, and the pointer information in the statement is added to the constraint table in the form of constraints.

[0011] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed by the present invention, collecting context-sensitive pointing constraints includes: for function call statements, according to different call types, substituting the pointing information of the actual parameter pointer and the global pointer at the call point into the pointing information summary of the called function; passing the instantiated pointing information back to the call point according to the correspondence between the formal parameter and the actual parameter, and collecting the instantiated pointing information; wherein the different call types include: external function call, direct call and indirect call.

[0012] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed by the present invention, the working process of collecting context-sensitive pointing constraints includes: when the call type is a direct call, obtaining the pointing information of the global pointer and the pointing information of the actual parameter pointer at the call point, and substituting them into the corresponding parameters of the called function summary to instantiate the pointing information summary; passing the instantiated pointing information summary back to the call point, and generating constraints based on the pointing information in the summary; when the call type is an indirect call, obtaining the pointing information of the function pointer, the global pointer, and the actual parameter pointer at the call point, and substituting the pointing information of the function pointer, the global pointer, and the actual parameter pointer respectively according to the pointing result of the function pointer; when a conditional statement appears in the program, when x>0, the function pointer f points to the address of function a, and when x<0, the function pointer f points to the address of function b; in subsequent analysis, both the cases of f pointing to a and f pointing to b will be taken into consideration, and the corresponding parameters in the summary of the called function will be instantiated; the pointing information in multiple function summaries will be summarized, passed back to the call point, and constraints will be generated based on the pointing information in the summary.

[0013] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed by the present invention, the instantiation of corresponding parameters includes: when indirectly calling, it is necessary to judge the specific calling function according to the pointing of the function pointer f; if the program executes to this point, the pointing set of the function pointer contains the addresses of two functions a and b; it is necessary to instantiate the summary of a and the summary of b respectively, when instantiating the summary of a, only f→a can be substituted, and when instantiating the summary of b, only f→b can be substituted; the current value of the function pointer f is substituted into the function pointer parameter in the called function: the function pointer f is substituted into the function pointer parameter in the called function; ... Substitute the current value of the pointer f into the function pointer parameter in the called function: if the function pointer f may point to the address of function a and function b at the calling point, that is, pts(f) = {a, b}, where pts(f) represents the pointing set of f, then instantiate the summaries of function a and function b respectively. When instantiating the function summary of a, substitute pts(f) = {a} into the corresponding summary; when instantiating the function summary of b, substitute pts(f) = {b} into the corresponding summary; substitute the global pointer and actual parameter pointer at the current program point into the corresponding parameters of the called function summary.

[0014] As a preferred solution of the lightweight context-sensitive pointer analysis method based on high-order functions proposed by the present invention, solving context-insensitive pointing constraints and context-sensitive pointing constraints includes: solving the context-insensitive pointing constraints and context-sensitive pointing constraints according to the constraint solving rules contained in the set, and calculating the content of the pointing set of each pointer; using the equal status characteristic of functions and variables, the pointing set containing parameters is saved in the form of a function; and the analysis result of the pointing information of the called function is saved in the form of a λ function.

[0015] The beneficial effects of the present invention are as follows: using the properties of higher-order functions for analysis can avoid the introduction of auxiliary variables, as well as mapping and unmapping operations, to solve pointer indirect calls during context-sensitive analysis; using higher-order functions for analysis, only the actual parameters themselves need to be substituted, and the values ​​indirectly referenced through the actual parameters, that is, the pointer set of the actual parameters, can be brought back from the called function body to the calling point in the form of a function, and the specific pointer is calculated at the calling point. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0017] Figure 1 This is a context-sensitive pointing information collection flow chart of the lightweight context-sensitive pointer analysis method based on high-order functions described in the first embodiment of the present invention. DETAILED DESCRIPTION

[0018] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0019] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0020] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0021] The present invention is described in detail with reference to the schematic diagram. When describing the embodiments of the present invention, for the sake of convenience, the cross-sectional diagrams showing the device structure will not be partially enlarged according to the general scale, and the schematic diagrams are only examples, which should not limit the scope of protection of the present invention. In addition, in actual production, the three-dimensional dimensions of length, width and depth should be included.

[0022] At the same time, in the description of the present invention, it should be noted that the directions or positional relationships indicated by the terms "upper, lower, inner and outer" are based on the directions or positional relationships shown in the drawings, and are only for the convenience of describing the present invention and simplifying the description, rather than indicating or implying that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore cannot be understood as limiting the present invention. In addition, the terms "first, second or third" are only used for descriptive purposes and cannot be understood as indicating or implying relative importance.

[0023] In the present invention, unless otherwise clearly specified and limited, the terms "install, connect, connect" should be understood in a broad sense, for example: it can be a fixed connection, a detachable connection or an integral connection; it can also be a mechanical connection, an electrical connection or a direct connection, or it can be indirectly connected through an intermediate medium, or it can be the internal communication of two components. For ordinary technicians in this field, the specific meanings of the above terms in the present invention can be understood according to specific circumstances.

[0024] Example 1

[0025] Reference Figure 1 , which is the first embodiment of the present invention, provides a lightweight context-sensitive pointer analysis method based on a high-order function, comprising:

[0026] S1: Determine the function analysis order.

[0027] Generate a function call graph of the program to be analyzed, and perform reverse topological sorting on the functions in the program to be analyzed according to the function call graph.

[0028] It should be noted that a function refers to any piece of program code that can be obtained from any public resource such as the Internet.

[0029] S2: Collect context-insensitive pointing constraints according to the function analysis order.

[0030] (1) Take out a function to be analyzed in the function analysis order, generate the control flow graph of the function, and initialize the pointer information according to the type of the variable in the source code;

[0031] (2) Traverse each node, i.e., statement, in the control flow graph, analyze the statements related to the pointer information, and add the pointer information in the statement to the constraint table in the form of constraints.

[0032] Pointer information related statements refer to four types of statements that do not involve function calls and will change the pointer pointing;

[0033] For the pointer statement a=&b, add the constraint loc(b)∈pts(a) (where loc(b) represents the memory address of b);

[0034] Add constraints for the copy statement a=b

[0035] For the load statement a=*b, Adding constraints

[0036] For the store statement *a=b, Adding constraints

[0037] When analyzing load statements and store statements, if you encounter a pointer set containing parameters, you do not need to add constraints to each variable in the pointer set separately. Instead, you can save the pointer set as a function and add constraints directly by taking advantage of the high-order function feature that functions and variables have equal status.

[0038] If a=*b, where b is a formal parameter and the corresponding parameter is β, the constraint rule should be followed: Adding constraints However, β is an uncertain variable here, and its pointing set can only be determined based on the actual parameters at the call point, so we can directly add the constraint After instantiating the summary, analyze its pointing information according to the specific arguments;

[0039] S3: Collect context-sensitive pointing constraints.

[0040] (1) For a function call statement, according to different call types (external function call, direct call, and indirect call), the pointing information of the actual parameter pointer and the global pointer at the call point is substituted into the pointing information summary of the called function;

[0041] The call point is finer-grained than the call statement. On the system dependency graph, a call statement can be represented as several points.

[0042] Specifically, external function call: calling functions defined in other source files. Since it is impossible to obtain the function bodies in other source files, the present invention has corresponding pointing information summaries for commonly used external functions, and will add pointing information according to the summaries; other infrequently used external functions will not affect the analysis by default;

[0043] Direct call: directly call the function in the current source file;

[0044] Indirect call: indirectly call the function in the current source file through the function pointer;

[0045] (2) According to the correspondence between formal parameters and actual parameters, the instantiated pointing information is passed back to the calling point, and the instantiated pointing information is collected.

[0046] Specifically, when the call type is a direct call, the pointing information of the global pointer and the pointing information of the actual parameter pointer at the call point are obtained, and substituted into the corresponding parameters of the called function summary to instantiate the pointing information summary; the instantiated pointing information summary is passed back to the call point, and constraints are generated according to the pointing information in the summary;

[0047] For example, if the function call statement is call Fun(a,t), first obtain the pointing information of the global pointer t and the actual parameter pointer a, that is, pts(t) and pts(a). Then, according to the correspondence between the variables a, t and the parameters α, β, substitute these two pointing sets into the summary λα.λβ.Fun(α,β) of the fun function to obtain the instantiated pointing information, that is, Fun(a,t), and then pass it back to the calling point to generate constraints.

[0048] When the call type is indirect call, obtain the pointing information of the function pointer, global pointer, and actual parameter pointer at the call point, and substitute the pointing information of the function pointer, global pointer, and actual parameter pointer into

[0049] When a conditional statement appears in the program, when x>0, the function pointer f points to the address of function a, and when x<0, the function pointer f points to the address of function b;

[0050] In subsequent analysis, both the cases where f points to a and f points to b are taken into account, and instantiated at the corresponding parameters in the summary of the called function; the pointing information in multiple function summaries is summarized and passed back to the call point, and constraints are generated based on the pointing information in the summary.

[0051] For example, if the function call statement is call*fp(a), first obtain the pointing information pts(fp), pts(t), and pts(a) of the function pointer fp, the global pointer t, and the actual parameter pointer a, and then use the pointing information of the function pointer (such as Figure 1, pts(fp)={p,q}), respectively instantiate the function summary of p and the function summary of q: when instantiating the summary of function p, according to the correspondence between a, t, fp and parameters α, β, γ, pts(t), pts(a) and pts(fp)=p are substituted into the function summary of p λα.λβ.λγ.P(α,β,γ) to obtain the instantiated pointing information P(a,t,p); similarly, instantiate the summary of function q to obtain the pointing information Q(a,t,q); then summarize the two pieces of pointing information P(a,t,p)∪Q(a,t,q) and pass them back to the call point to generate constraints.

[0052] S4: Solve the context-insensitive pointing constraints and the context-sensitive pointing constraints, obtain the pointing information analysis results of the called function, and save them in the form of high-order functions.

[0053] (1) Solve the collected pointing constraints according to the constraint solving rules contained in the set, and calculate the content of each pointer's pointing set (variable or pointing set containing parameters). With the help of the high-order function feature that functions and variables have equal status, the pointing set containing parameters is saved in the form of a function without directly calculating its specific pointing result.

[0054] (2) Save the result of constraint solving in the form of a λ function, such as λα.λβ.P(α,β), where P(α,β) is the result of the directional analysis containing the function parameters.

[0055] S5: Determine whether all functions have been analyzed. If not, go to S2 to continue collecting pointer constraints of other functions; otherwise, output the pointer analysis results.

[0056] Example 2

[0057] The program codes selected in this embodiment are shown in Table 1.

[0058] The first step is to determine the function analysis order, which corresponds to step S1 of embodiment 1.

[0059] In this embodiment, the analysis order of functions is foo→main.

[0060] Table 1 Example code

[0061]

[0062]

[0063] The second step is to collect context-insensitive constraints of the foo function, corresponding to step S2.

[0064] (1) Initialize the formal parameters in the function, using the Greek letters α and β to represent the parameter pointers p and q respectively. Although the variable obj is a global variable, it is not a pointer variable, so there is no need to use symbols to replace it.

[0065] (2) Based on the four statements in function foo, we can get the following constraints:

[0066]

[0067] Since there is no function call statement in the foo function, step S3 can be skipped.

[0068] The third step is to solve the pointing constraint of the foo function and generate the function summary of the foo function, which corresponds to step S4.

[0069] In this embodiment, the summary of the foo function is λα,β.{pts(pts(α))={pts(pts(β))},pts(pts(β))={obj}}.

[0070] The fourth step is to determine whether the function analysis is complete. The first three steps only analyze the foo function, and the main function has not been analyzed, so it is necessary to continue to collect the pointer information of the main function, corresponding to step S5.

[0071] The fifth step is to collect context-insensitive constraints of the main function, corresponding to step S2.

[0072] According to the pointer-related statements in the main function, we can get the constraints loc(a)∈pts(x),loc(b)∈pts(y) on line 11, the constraints loc(c)∈pts(x),loc(e)∈pts(y) on line 15, the constraints loc(d)∈pts(x),loc(d)∈pts(y) on line 17, and the constraint loc(t)∈pts(c) on line 19.

[0073] Step 6: Collect context-sensitive constraints of the main function, corresponding to step S3.

[0074] In this embodiment, when the call statement in line 12 is analyzed, it is determined according to the type of the called function that this is a direct call:

[0075] (1) Get the pointer information of the actual parameter pointer pts(x) = {a}, pts(y) = {b}; substitute the pointer information into the summary of the foo function: according to the corresponding relationship (x corresponds to parameter α, y corresponds to parameter β), we get pts(a) = {pts(b)}, pts(b) = {obj}};

[0076] (2) Bring the instantiated summary back to the call point and generate constraints based on the pointing information in the summary. get pts(b)=loc(obj), and then rewrite it as a constraint obj∈pts(b) is put into the constraint table.

[0077] Similarly, in this embodiment, when analyzing the call statement on line 20, the pointing information of the current call point pts(x)={c,d},pts(y)={d,e} is obtained, and it is substituted into the foo function summary to obtain pts(c,d)={pts(d,e)},pts(d,e)=loc(obj), which are then rewritten as constraints and put into the constraint table.

[0078] The seventh step is to solve the pointing constraint of the main function and generate the function summary of the main function, corresponding to step S4.

[0079] In this embodiment, the summary of the main function is: pts(b)=loc(obj), pts(c)=loc(t), pts(d)=loc(obj), pts(e)=loc(obj), pts(x)=loc(a), pts(y)=loc(b).

[0080] At this point there are no unknown parameters in the main function, so the function summary is not in the form of a lambda function.

[0081] Step 8: Determine whether the function analysis is complete. In this embodiment, the two functions have been analyzed, and the complete pointing analysis results are output at this time, corresponding to step S5.

[0082] It should be appreciated that embodiments of the present invention may be implemented or enforced by computer hardware, a combination of hardware and software, or by computer instructions stored in a non-transitory computer-readable memory. The method may be implemented in a computer program using standard programming techniques - including a non-transitory computer-readable storage medium configured with a computer program, wherein the storage medium so configured causes the computer to operate in a specific and predefined manner - according to the methods and drawings described in the specific embodiments. Each program may be implemented in a high-level procedural or object-oriented programming language to communicate with a computer system. However, if desired, the program may be implemented in an assembly or machine language. In any case, the language may be a compiled or interpreted language. In addition, the program may be run on a programmed ASIC for this purpose.

[0083] Furthermore, the operations of the processes described herein may be performed in any suitable order unless otherwise indicated herein or otherwise clearly contradicted by context. The processes described herein (or variations and / or combinations thereof) may be performed under the control of one or more computer systems configured with executable instructions, and may be implemented as code (e.g., executable instructions, one or more computer programs, or one or more applications) that is executed collectively on one or more processors, by hardware, or a combination thereof. The computer program includes a plurality of instructions that may be executed by one or more processors.

[0084] Further, the method can be implemented in any type of computing platform that is operably connected to a suitable computer, including but not limited to a personal computer, a minicomputer, a mainframe, a workstation, a network or distributed computing environment, a separate or integrated computer platform, or in communication with a charged particle tool or other imaging device, etc. Aspects of the present invention can be implemented in machine-readable code stored on a non-transitory storage medium or device, whether removable or integrated into a computing platform, such as a hard disk, an optical read and / or write storage medium, a RAM, a ROM, etc., so that it can be read by a programmable computer, and when the storage medium or device is read by the computer, it can be used to configure and operate the computer to perform the process described herein. In addition, the machine-readable code, or part thereof, can be transmitted via a wired or wireless network. When such media includes instructions or programs that implement the steps described above in conjunction with a microprocessor or other data processor, the invention described herein includes these and other different types of non-transitory computer-readable storage media. When programmed according to the methods and techniques described in the present invention, the present invention also includes the computer itself. The computer program can be applied to input data to perform the functions described herein, thereby converting the input data to generate output data stored in a non-volatile memory. The output information can also be applied to one or more output devices such as a display. In a preferred embodiment of the present invention, the converted data represents a physical and tangible object, including a specific visual depiction of the physical and tangible object produced on a display.

[0085] As used in this application, the terms "component", "module", "system", etc. are intended to refer to a computer-related entity, which can be hardware, firmware, a combination of hardware and software, software, or software in operation. For example, a component can be, but is not limited to: a process running on a processor, a processor, an object, an executable file, a thread in execution, a program, and / or a computer. As an example, an application running on a computing device and the computing device can both be components. One or more components can exist in a process and / or thread in execution, and a component can be located in a computer and / or distributed between two or more computers. In addition, these components can be executed from various computer-readable media having various data structures thereon. These components can communicate in a local and / or remote process manner, such as according to a signal having one or more data packets (e.g., data from a component that interacts with another component in a local system, a distributed system, and / or interacts with other systems in a signal manner through a network such as the Internet).

[0086] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A lightweight context-sensitive pointer analysis method based on high-order functions, characterized in that: include: Determine the function analysis order; Collect context-insensitive pointing constraints according to the function analysis order; The collection of context-insensitive pointing constraints includes: A function to be analyzed is taken out according to the function analysis sequence, a control flow graph of the function is generated, and pointer information is initialized according to the types of variables in the source code: for three types of pointer variables that cannot be determined due to procedure calls, namely, global pointers, formal parameter pointers, and function pointers; Traverse each node, i.e., statement, in the control flow graph, analyze the statements related to the pointer information, and add the pointer information in the statement to the constraint table in the form of constraints; Collect context-sensitive pointing constraints; The collection of context-sensitive pointing constraints includes: For function call statements, according to different call types, the pointing information of the actual parameter pointer and the global pointer at the call point is substituted into the pointing information summary of the called function; According to the correspondence between formal parameters and actual parameters, the instantiated pointing information is passed back to the call point, and the instantiated pointing information is collected; The different call types include: external function call, direct call and indirect call; The process of collecting context-sensitive pointing constraints includes: When the call type is a direct call, obtain the pointing information of the global pointer and the pointing information of the actual parameter pointer at the call point, and substitute them into the corresponding parameters of the called function summary to instantiate the pointing information summary; pass the instantiated pointing information summary back to the call point, and generate constraints based on the pointing information in the summary; When the call type is indirect call, obtain the pointing information of the function pointer, global pointer, and actual parameter pointer at the call point, and substitute the pointing information of the function pointer, global pointer, and actual parameter pointer respectively according to the pointing result of the function pointer: When a conditional statement appears in the program, when x>0, the function pointer f points to the address of function a, and when x<0, the function pointer f points to the address of function b; In the subsequent analysis, both the cases where f points to a and f points to b are taken into account, and the corresponding parameters in the summary of the called function are instantiated; the pointing information in multiple function summaries is summarized and passed back to the call point, and constraints are generated based on the pointing information in the summary; Solving the context-insensitive pointing constraint and the context-sensitive pointing constraint to obtain a pointing information analysis result of the called function, and saving the result in a high-order function form; It is determined whether the function has been completely analyzed. If not, the context-insensitive pointing constraints are continuously collected; otherwise, the pointer analysis result is output.

2. The context-sensitive pointer analysis method based on high-order functions according to claim 1, characterized in that: Determining the function analysis order includes: A function call graph of the program to be analyzed is generated, and functions in the program to be analyzed are reverse topologically sorted according to the function call graph.

3. The context-sensitive pointer analysis method based on high-order functions according to claim 1 or 2, characterized in that: Also includes: Pointer information related statements refer to four types of statements that do not involve function calls and will change the pointer, namely pointer statements, copy statements, load statements, and store statements; The four types of statements are analyzed using a pointer analysis algorithm based on set inclusion, and the pointer information in the statements is added to a constraint table in the form of constraints.

4. The context-sensitive pointer analysis method based on high-order functions according to claim 3, characterized in that: The function summary corresponding to the instantiation includes: When calling indirectly, the specific function to be called needs to be determined based on the pointer to the function pointer f; If the program executes to this point, the set pointed to by the function pointer contains the addresses of two functions a and b; You need to instantiate the summary of a and the summary of b separately. When instantiating the summary of a, you can only substitute f→a, and when instantiating the summary of b, you can only substitute f→b; Substitute the current value of the function pointer f into the function pointer parameter in the called function: if the function pointer f may point to the address of function a and function b at the call point, that is, pts(f) = {a, b}, where pts(f) represents the pointing set of f, then instantiate the digests of function a and function b respectively. When instantiating the function digest of a, substitute pts(f) = {a} into the corresponding digest; when instantiating the function digest of b, substitute pts(f) = {b} into the corresponding digest; Substitute the global pointer and actual parameter pointer at the current program point into the corresponding parameters of the called function summary.

5. The context-sensitive pointer analysis method based on high-order functions according to claim 4, characterized in that: Solving the context-insensitive pointing constraint and the context-sensitive pointing constraint includes: Solve the context-insensitive pointing constraints and the context-sensitive pointing constraints according to the constraint solving rules contained in the set, and calculate the content of the pointing set of each pointer; By using the equal status of functions and variables, the pointer set containing parameters is saved in the form of function; the result of the pointer information analysis of the called function is saved in the form of lambda function.

Images