Value Flow Graph for Flow-Sensitive Points-to Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing points-to analyses, such as Andersen's formulation, lack flow-sensitivity and context-sensitivity, leading to imprecise computation of pointer information which affects the precision and performance of program analyses in C-like languages.
Innovation Solution
A method and system for performing points-to analysis by generating a value flow graph that initializes edges based on Base and Assignment instructions, updates the graph with indirect references, and determines pointed-to-by and points-to sets, ensuring flow-sensitivity and context-sensitivity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Andersen's formulation is used to compute points-to sets by solving inclusion constraints, then the analysis can be implemented, but the precision of pointer information deteriorates due to lack of flow-sensitivity and context-sensitivity
Solution Approach 1:
The patent segments the constraint solving process into iterative worklist-based processing, where memory objects are processed individually and their constraints are added to the worklist for subsequent processing. This segmentation enables flow-sensitivity by processing constraints in the order they appear in the program, and context-sensitivity by tracking specific memory object instances throughout the analysis.
Solution Approach 2:
The patent introduces dynamic elements by using a worklist that evolves during analysis, adding constraints as they are discovered rather than processing all constraints simultaneously. The analysis dynamically updates points-to sets and reprocesses relevant constraints when new information becomes available, enabling flow-sensitive and context-sensitive analysis.
2Measurement precision
If transitive closure is computed to handle indirect references, then pointer information can be gathered, but the computation time increases due to iterative updates
Solution Approach 1:
The patent uses periodic action through iterative worklist processing, where the analysis periodically revisits constraints that become relevant due to new information. Instead of continuous re-computation, constraints are processed in discrete iterations, with the worklist guiding which constraints need re-evaluation in each iteration cycle.
Solution Approach 2:
The patent implements feedback mechanisms where the computation of points-to sets for one memory object provides feedback that triggers re-processing of related constraints. When a new point-to relationship is discovered, the system feeds this information back into the worklist, causing relevant constraints to be re-evaluated with the new information.
3Measurement precision
If flow-sensitivity and context-sensitivity are incorporated, then the precision of program analysis improves, but the device complexity increases
Solution Approach 1:
The patent segments the value flow graph into memory object-specific subgraphs, where each memory object has its own pointed-to-by set and associated constraints. This segmentation reduces the apparent complexity by organizing the analysis around individual memory objects rather than processing the entire graph monolithically.
Solution Approach 2:
The patent introduces the worklist as an intermediary data structure that mediates between constraint generation and constraint solving. The worklist absorbs the complexity of coordinating flow-sensitive and context-sensitive analysis by serving as a buffer that manages the order and timing of constraint processing.
Data Source
AI summary
In general, in one aspect, the invention relates to a method for performing points-to analysis by generating a value flow graph for source code. The method steps include: initializing the value flow graph including a set of memory objects and a set of edges based on Base and Assignment instructions, where the set of edges represents inclusion constraints between the set of memory objects and a set of pointer variables; determining a pointed-to-by set including at least one pointer variable of the set of pointer variables; updating the value flow graph by introducing a flow edge based on an indirect reference, where the flow edge is related to a memory object of the set of memory objects that is added to a working list; updating the pointed-to-by set based on the memory object in the working list; and analyzing the source code using the pointed-to-by set.