Field-sensitive Function Pointer Analysis Using Field Propagation for State Graph Extraction

Abstract

Accurate state graph is important to static program analysis. In order to extract reliable state graphs from programs, which contains function pointers, for model analysis in software engineering, we proposed a field-sensitive may-alias analysis using field propagation, which tries to discover deeply implied aliasing relations by propagating the aliases to variables from their nested structures. For the high complexity of alias analysis, several optimizations are proposed for performance with the price of potentially losing few aliases. Unlike Most previous works which adopted various kinds of approximations that would compromise the reliability of the results, our field-propagation analyzer makes sure that the solutions of queried pointers are sound in a flow-insensitive manner, because none of our adopted optimizations would bring in approximation to the results.