D. Liang and M.J. Harrold, "Efficient Points-To Analysis for Whole-Program Analysis," O. Nierstrasz and M. Lemoine, eds., Proc. Foundations on Software Eng., 1999.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....Java and C . Both flow sensitive and context sensitive techniques were used in pointer analysis [21] In general, the analysis community decided that flow sensitivity was not scalable to large programs. Context sensitivity for C pointer analysis also was explored independent of flow sensitivity [17, 22, 35], but the verdict on its effectiveness is less clear. Keeping calling contexts distinguished is of varying importance in a C program, depending on programming style, whereas in object oriented codes it seems crucial for obtaining high precision for problems needing dependence information, for ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proceedings of the 7th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, LNCS 1687, pages 199--215, September 1999.

....to e.g. the analysis can determine which are the locations that p may point to at line 1. In addition, pointer analysis determines which function addresses may be stored in a given function pointer. Because of the importance of such information, a variety of pointer analyses have been developed [11, 12, 9, 5, 1, 22, 20, 25, 18, 13, 7, 4, 6, 3]. These analyses provide different tradeoffs between cost and precision. For example, flow and context insensitive pointer analyses [1, 20, 25, 18, 4] ignore the flow of control between program points and do not distinguish between different calling contexts of procedures. As a result, such ....

....a conceptual fully precise pointer analysis . This analysis is a fully flow sensitive, contextsensitive, field sensitive pointer analysis that represents a point at the very high end of the design space for pointer analysis. A large number of pointer analyses (or their minor variations) [11, 9, 5, 1, 22, 20, 25, 18, 13, 7, 4, 6, 3] can be considered approximate versions of P that is, the solution computed by is a subset of the solutions computed by these analyses. was specifically designed to achieve this high precision. For example, the analysis maintains full information about calling context; for existing ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Symposium on the Foundations of Software Engineering, LNCS 1687, pages 199--215, 1999.

....of large programs. In addition, Das00] showed that the One Level Flow algorithm generally produces results as precise as Andersen s well known flow and context insensitive algorithm [And94] which, however, is considerably slower in practice. Andersen s algorithm, in turn, has been shown [LH99a] to be of comparable precision as some other well known flow [PLR94] or context sensitive [LH99a] pointer analysis algorithms, which suggests that in practice, the results obtainable with more expensive flow or context sensitive algorithms (when they are practical) may not be significantly ....

....produces results as precise as Andersen s well known flow and context insensitive algorithm [And94] which, however, is considerably slower in practice. Andersen s algorithm, in turn, has been shown [LH99a] to be of comparable precision as some other well known flow [PLR94] or context sensitive [LH99a] pointer analysis algorithms, which suggests that in practice, the results obtainable with more expensive flow or context sensitive algorithms (when they are practical) may not be significantly better than what is achievable with the OLF algorithm. In addition to the flow and ....

[Article contains additional citation context not shown here]

Donglin Liang and Mary Jean Harrold. Efficient points-to analysis for whole-program analysis. In Proceedings of the 7th European Software Engineering Conference and ACM Symposium on the Foundations of Software Engineering, pages 199--215, Toulouse, France, September 1999.

.... that the typically observed dynamic points to sets are 10 100 times smaller than the points to sets computed by Das s highly scalable One Level Flow algorithm [9] which generally produces results as precise as Andersen s well known algorithm [2] Andersen s algorithm, in turn, has been shown [17] to be of comparable precision as some other well known pointer analysis algorithms [17, 24] Mock et al. 23] additionally showed that the majority of program variables point to only a single logical location during execution with the SPEC provided test inputs. Although more expensive ....

.... points to sets computed by Das s highly scalable One Level Flow algorithm [9] which generally produces results as precise as Andersen s well known algorithm [2] Andersen s algorithm, in turn, has been shown [17] to be of comparable precision as some other well known pointer analysis algorithms [17, 24]. Mock et al. 23] additionally showed that the majority of program variables point to only a single logical location during execution with the SPEC provided test inputs. Although more expensive flowsensitive algorithms [26] can obtain much better average points to sets than the scalable ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proceeedings of the 7th European Software Engineering Conference and ACM pages 199--215, Toulouse, France, Sept. 1999.

....from above, pointer analysis can determine what are the locations that p may point to. In addition, pointer analysis determines which function addresses may be stored in a given function pointer. Because of the importance of such points to information, a variety of analyses have been developed [10, 9, 5, 1, 18, 17, 20, 15, 11, 7, 4, 6, 3, 14, 8]. These analyses provide different tradeoffs between cost and precision. For example, flow and context insensitive pointer analyses [1, 17, 20, 15, 4] ignore the flow of control between program points and do not distinguish between different calling contexts of procedures. As a result, such ....

....FA analysis may provide sufficient precision for the purposes of call graph construction. In this context, the use of more expensive pointer analyses may not be necessary. 6 Related Work There is a large body of work on various pointer analyses for C with different degrees of cost and precision [10, 9, 5, 1, 18, 17, 20, 15, 11, 7, 4, 6, 3, 14, 8]. Traditionally, the precision of these analyses has been evaluated with respect to the disambiguation of indirect memory reads and writes (e.g. in p=1) Our work evaluates the precision of pointer analysis with respect to indirect procedure calls and call graph construction. Existing work ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Symposium on the Foundations of Software Engineering, LNCS 1687, pages 199--215, 1999.

....0LCS 0FCS and 0LCC 0FCC. Based on our results, it would be interesting to fully evaluate other problems of program analysis: First, what influence have prerequisites like pointer analysis onto precision and speed of the different slicing chopping algorithms (Some results for SIS are presented in [11, 12]. Second, how are applications that use slicing or chopping influenced by the different algorithms Based on our technique to generate and solve path conditions [16] which makes intensive use of chopping, we will work on both questions in the future. ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In ESEC / SIGSOFT FSE, 1999.

....to evaluate this threat. Since one experiment found lots of violating paths and the second found none, it is hard to see what conclusions can be drawn. 7. Related work Much work has been done in comparing different data flow algorithms, especially algorithms for performing points to analysis [11, 14]. The problem of comparing verification based algorithms or of finding counter examples through a data flow analysis problem does not seem to have been studied. Some work has been done on counter example generation for testing [1, 3] In [9] model checking is used to create counter examples for ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proc. of the Seventh European Soft. Eng. Conf. held jointly with the Seventh ACM SIGSOFT Symp. on the Found. of Soft. Eng., pages 199--215, Sept. 1999.

....by assessing whether the treatment of one or more precise features is really useful and worth incorporating in a compiler. A long term goal of our research is also the integration of our toolkit with other less precise analysis tools, such as the one being developed in our group [GC00] and others [Ste96,LH99a]. The model checking tool could then be used to check only those parts of a program that are found in need of greater optimization and thus require more precision in the analysis. Alternatively, if experiments with the model checker may show that a certain kind of precise analysis is feasible and ....

D. Liang and M.J. Harrold, Efficient Points-to Analysis for Whole-Program Analysis, Lectures Notes in Computer Science, 1687, 1999.

....optimizations can be made. Interprocedural data flow analysis techniques typically require that the entire program representation be available in memory before the analysis is performed. Only recently have techniques been developed to modularize the interprocedural data flow analysis problem [52, 64]. Results of research in a demand driven approach to interprocedural data flow analysis [26, 27, 45] have shown that overhead can be reduced compared to more exhaustive methods. 2.3.2 Inlining Procedure inlining [2, 4, 5, 12, 16, 21, 22, 23, 46, 49, 56] is a widely researched and accepted means ....

D. Lian and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In ACM SIGSOFT International Symposium on the Foundations of Software Engineering (FSE), Sept. 1999.

....[17] which allows efficient node merges. One of the variables in each class is used as an equivalence class representative (ECR) 15] During the analysis, every reference to a variable v is translated into a reference to the ECR for the equivalence class to which v 2 Some analyses (e.g. [7, 9]) only ignore intraprocedural flow of control. 2 currently belongs. Shapiro and Horwitz [14] propose a family of points to analyses whose cost and precision range from those of Steensgaard s analysis to those of Andersen s analysis. Similarly to Steensgaard s analysis, the nodes in the ....

....off line variable substitution in the context of Andersen s analysis, the technique is applicable to other kinds of points to analysis. For example, it could be useful in investigating tradeoffs between cost and precision for pointer analyses with some degree of flow or context sensitivity (e.g. [8, 7, 4, 18, 9]) 3 a = b b = c b = d q = b p = a oe(a) x oe(p) x oe(b) y oe(q) y x = y y = c y = d R G 0 S x y c d R Gamma Gamma Gamma Gamma R GS a b c p q d GA = GS Gamma f(a; q) p; q)g Figure 3: Off line variable ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proc. Symposium on the Foundations of Software Engineering, LNCS 1687, pages 199--215, 1999.

....in each case, so that the results only vary the usage of flow sensitivity. In particular, all analyses are context insensitive, name heap objects based on their allocation site, collapse aggregate components, and use the compact points to representation. This work differs from previous studies [33, 35, 7, 21] in the following ways: 1 The minor difference between the compact and points to representations [12] is not relevant to this work. ffl The breadth of pointer algorithms studied; in the only two studies [35, 21] that also include a flow sensitive analysis, the analysis they study [18] also ....

....compact points to representation. This work differs from previous studies [33, 35, 7, 21] in the following ways: 1 The minor difference between the compact and points to representations [12] is not relevant to this work. ffl The breadth of pointer algorithms studied; in the only two studies [35, 21] that also include a flow sensitive analysis, the analysis they study [18] also benefits from being context sensitive and uses a different alias representation (an explicit one) than the (points to) flowinsensitive analyses it is compared with. ffl The number of client analyses reported; this ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In O. Nierstrasz and M. Lemoine, editors, Lecture Notes in Computer Science, 1687, pages 199--215. Springer-Verlag, Sept. 1999. Proceedings of the 7th European Software Engineering Confrence and ACM SIGSOFT Foundations of Software Engineering.

....23 (dst ) src ) 24 dst=0; 25 return dst; 26 Figure 1: Example program. ments, these algorithms must iteratively propagate information throughout the program using the control flow graph. Studies indicate that these algorithms may be too expensive to be applied to large programs [9, 12]. Flow insensitive alias analysis algorithms (e.g. 1, 11] compute less precise alias information for a program. These algorithms avoid iteratively propagating information throughout the program by ignoring the execution order of the statements. Studies indicate that these algorithms are more ....

....information for a program. These algorithms avoid iteratively propagating information throughout the program by ignoring the execution order of the statements. Studies indicate that these algorithms are more efficient and thus, scale better to large programs, than the flow sensitive algorithms [9, 12]. A program analysis might compute imprecise program information when the analysis uses alias information provided by a flow insensitive alias analysis algorithm. One way that this imprecision occurs is that, to resolve pointer dereferences in a program, the program analysis may use the large ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for wholeprogram analysis. In 7th ACM Symposium on Foundations of Software Engineering, pages 199--215, September 1999.

....6 or statement 7 is executed) Therefore, the alias set for p at statement 8 contains two elements: sum1 and sum2. A variety of alias analysis algorithms have been presented in the literature, which vary in the efficiency and the precision with which they compute the alias relations (e.g. [3, 15, 25, 16]) For the empirical studies reported in this paper, we used the may alias information computed by the flow sensitive, context sensitive alias algorithm described by Landi and Ryder [15] Program slicing is a technique for identifying transitive control and data dependences in a program. A ....

.... results to perform slicing more effectively in the presence of pointers (e.g. 1, 4, 6, 7, 17] Some researchers have also evaluated the effects of the precision of the pointer analysis on subsequent analyses, such as the computation of def use associations (e.g. 26] and program slicing (e.g. [5, 16, 23]) However, none of that work considers definitions, uses, and def use associations in terms of the certainty with which those entities occur. Tonella and colleagues [27] analyze the effects of the precision of the reaching definition computation on def use associations. Other researchers (e.g. ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proceedings of ESEC/FSE '99 7th European Software Engineering Conference and 7th ACMSIGSOFT Symposium on the Foundations of Software Engineering, volume 1687 of Lecture Notes in Computer Science, pages 199--215. Springer-Verlag, Sept. 1999.

....in the presence of pointers Program slicing, like other data flow analyses, requires alias information to ensure safety. An alias occurs between two names that can access one memory location at a program point. Aliases can be resolved using flow sensitive (e.g. 8] or flow insensitive (e.g. [1, 9, 13]) algorithms. Flow sensitive algorithms compute more precise alias information at a higher cost than flow insensitive algorithms. After the alias information is computed, many slicing techniques (and other data flow analyses) can be modified Program 1 1. int j,sum; 2. main( f 3. int sum1, ....

....data flow analyses. Because most memory locations accessed through dereferences of parameter pointers or global pointers are non local to the procedure in which the access occurs, pointer variables can greatly increase the data flow information computed for the procedure. For example, we found [9] that a procedure in a C program with 25,002 lines of code can modify, on average, 199 non local memory locations when the aliases are computed with Steensgaard s algorithm. This means that interprocedural data flow analyses, such as the reuse driven slicer, must compute large amounts of summary ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Joint 7th European Software Engineering Conferenceand 7th ACM Symposium on Foundations of Software Engineering, Sept. 1999.

....fixed locations (i.e. the non pointer variables) that p may refer to when the execution reaches n. For example, in program Sum, the points to set for p at statement 6 contains sum1 and sum2. Different alias analysis algorithms have been presented in the literature, with different characteristics [15, 3, 24, 16]. For this work we used the alias information provided by the flow sensitive context sensitive alias algorithm from Landi and Ryder [15] Program slicing is a technique for identifying transitive control and data dependences in a program. A 4 int i; main( int p; int j, sum1, sum2; 1. ....

....the second set of slices were based on dua types 1 and 3, neither of which are caused by the effects of pointers. 14 evaluated the effects of the precision of the pointer analysis on subsequent analyses, such as the computation of def use associations (e.g. 25] and program slicing (e.g. [5, 16, 22]) None of that research, however, distinguishes def use associations based on the types of definitions, uses, and def use associations they view uniformly each def use association that arises in the presence of pointers. Tonella and colleagues [26] analyze the effects of the precision of the ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proceedings of ESEC/FSE '99 7th European Software Engineering Conference and 7th ACM SIGSOFT Symposium on the Foundations of Software Engineering, volume 1687 of Lecture Notes in Computer Science, pages 199--215. Springer-Verlag, Sept. 1999.

....analyses use alias analysis algorithms to compute alias information. Existing alias analysis algorithms can be classified into two categories: flow sensitive algorithms (e.g. 6, 11] provide precise alias information at each program point but are expensive; flow insensitive algorithms (e.g. [1, 13, 15, 16]) sacrifice precision for efficiency, and quickly compute less precise alias information that holds throughout a procedure or the entire program. Many researchers report ways to use alias information in dataflow analyses to ensure safety (e.g. 2, 12, 14] The method used 1 Aliasing occurs ....

.... several studies to evaluate the effectiveness of equivalence analysis in reducing the amount of data flow information that is computed using alias information provided by each of the following alias analysis algorithms: Steensgaard s algorithm (ST) 16] Liang and Harrold s algorithm (LH) [13], Andersen s algorithm (AND) 1] and Landi and Ryder s algorithm (LR) 11] We implemented the equivalence analysis algorithm, Steensgaard s algorithm, Liang and Harrold s algorithm, and Andersen s algorithm using PROLANGS Analysis Framework (PAF) 7] which parses a C program and provides an ....

[Article contains additional citation context not shown here]

D. Liang and M. J. Harrold. Efficient points-to analysis for wholeprogram analysis. In Joint 7th European Software Engineering Conference and 7th ACM Symposium on Foundations of Software Engineering, September 1999.

....ex exit E21 exit ex exit E1 E2 E3 E21 E3 T T F F T F T T F F T T F T F F E1 E21 Figure 4. Control flow representation of class C2 that is used for unit testing of the class. alias 4 information about the program using a technique at the desired level of precision (e.g. [12, 20]) then it uses the alias information to compute, reaching definitions, and finally it uses the reaching definitions to compute the du associations. We then select those du associations that are associated with exception objects. For the e ad associations, we first determine activation and ....

D. Liang and M. J. Harrold. Efficient points-to analysis for whole-program analysis. In Proc. of 7th Intl. Symp. on the Foundations of Softw. Eng., Sep. 1999. to appear.

No context found.

D. Liang and M.J. Harrold, "Efficient Points-To Analysis for Whole-Program Analysis," O. Nierstrasz and M. Lemoine, eds., Proc. Foundations on Software Eng., 1999.

No context found.

Liang, D., and Harrold, M. J.: 1999, `Efficient Points-to Analysis for Whole-program Analysis'. In: Symposium on the Foundations of Software Engineering. pp. 199--215.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC