A new abstraction for summary-based pointer analysis

Abstract

We propose a new abstraction for pointer analysis based on the principle of matching pointer dereferences or “memory fetches” with pointer assignments. Our abstraction, the Assign-Fetch Graph (AFG), has several advantages over traditional points-to graphs. It leads to concise procedure summaries for pointer analysis and similar computations; each procedure’s summary information can be used effectively in arbitrary calling contexts. Different analysis variations can be formulated on the AFG— we present two possible variations. One is based on a standard flow-insensitive view of the program; the other takes some statement ordering into account and produces results that are both more precise and more quickly computed. Our abstraction also facilitates incremental summary-based pointer analysis, which is not generally possible with conventional points-to graphs. We show how the AFG simplifies certain steps in updating pointer graphs and computing procedure summaries. For efficiency and compactness, we build a single summary for each procedure under the optimistic assumption that distinct pointers from the environment are not aliased. We restore soundness when the summary is used in a context with aliases. We present some results of the practical impact of our technique.