Making context-sensitive inclusion-based pointer analysis practical for compilers using parameterised summarisation

Abstract

Because of its high precision as a flow-insensitive pointer analysis, Andersen's analysis has been deployed in some modern optimising compilers. To obtain improved precision, we describe how to add context sensitivity on top of Andersen's analysis. The resulting analysis, called ICON, is efficient to analyse large programs while being sufficiently precise to drive compiler optimisations. Its novelty lies in summarising the side effects of a procedure by using one transfer function on virtual variables that represent fully parameterised locations accessed via its formal parameters. As a result, a good balance between efficiency and precision is made, resulting in ICON that is more powerful than a 1-callsite-sensitive analysis and less so than a call-path-sensitive analysis when the recursion cycles in a program are collapsed in all cases. We have compared ICON with FULCRA, a state of the art Andersen's analysis that is context sensitive by acyclic call paths, in Open64 with recursion cycles collapsed in both cases using the 16 C/C++ benchmarks in SPEC2000 totalling 600KLOC and 5 C applications totalling 2.1MLOC. Our results demonstrate scalability of ICON and lack of scalability of FULCRA. FULCRA spends over 2h in analysing SPEC2000 and fails to run to completion within 5h for two of the five applications tested. In contrast, ICON spends just under 7min on the 16 benchmarks in SPEC2000 and just under 26min on the same two applications. For the 19 benchmarks analysable by FULCRA, ICON is nearly as accurate as FULCRA in terms of the quality of the built Static Single Assignment SSA form and the precision of the discovered alias information. Copyright © 2013 John Wiley & Sons, Ltd.