P. Stocks, B. G. Ryder, W. Landi, and S. Zhang. Comparing flow and context sensitivity on the modification-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, 1998.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....to use finer analysis units such as the computation rooted at a given call site. Researchers have proposed several flowinsensitive pointer analysis algorithms with different degrees of precision. In general, flow sensitive analyses provide a more precise result than flow insensitive analyses [24], although it is unclear how important this difference is in practice. Finally, flow insensitive analyses extend trivially from sequential programs to multithreaded programs. Because they are insensitive to the statement order, they trivially model all of the interleavings of the parallel ....

P. Stocks, B. Ryder, W. Landi, and S. Zhang. Comparing flow and context sensitivity on the modification side-effects problem. In 1998 International Symposium on Software Testing and Analysis, Clearwater, FL, March 1998.

....can also lead to much less precise results than those provided by the Common Initial Sequence algorithm. The Offsets approach is similar to the one used by Ryder et al. in the alias analysis algorithms that they implemented as part of their work on the modification side effects problem [SRLZ98] Essentially, everything is encoded in a base offset manner; casting that overlaps fields causes more approximate information to be kept about aliases, while casting that matches up fields preserves alias accuracy. The Offsets approach is also similar to the approach used by Wilson and Lam ....

P. Stocks, B. Ryder, W. Landi, and S. Zhang. Comparing flow and context sensitivity on the modification-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, March 1998.

....two interface initial values are not equal at a call site that invokes a public interface method. 5. 4 Applications of points to solution In order to test the quality of the solution computed by Points to Algo, we used the solution for two di#erent applications: side e#ect analysis or MOD [LRZ93, SRLZ98] and virtual function resolution [PR96] The results for MOD are shown in Table 5.6. The Column AvConcrete MOD shows the average number of heap names whose fields are modified by a pointer assignment statement according to the Phase III pta solution. In object oriented programs, since a method is ....

P.A. Stocks, B.G. Ryder, W.A. Landi, and S. Zhang. Comparing flow- and context-sensitivity on the modification side-e#ects problem. In Proceedings of the International Symposium on Software Testing and Analysis, pages 21--31, March 1998. Also available as DCS-TR-335.

....in each case, so that the results only vary the usage of flow sensitivity. In particular, all analyses are context insensitive, name heap objects based on their allocation site, collapse aggregate components, and use the compact points to representation. This work differs from previous studies [33, 35, 7, 21] in the following ways: 1 The minor difference between the compact and points to representations [12] is not relevant to this work. ffl The breadth of pointer algorithms studied; in the only two studies [35, 21] that also include a flow sensitive analysis, the analysis they study [18] also ....

....compact points to representation. This work differs from previous studies [33, 35, 7, 21] in the following ways: 1 The minor difference between the compact and points to representations [12] is not relevant to this work. ffl The breadth of pointer algorithms studied; in the only two studies [35, 21] that also include a flow sensitive analysis, the analysis they study [18] also benefits from being context sensitive and uses a different alias representation (an explicit one) than the (points to) flowinsensitive analyses it is compared with. ffl The number of client analyses reported; this ....

[Article contains additional citation context not shown here]

P. A. Stocks, B. G. Ryder, W. A. Landi, and S. Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, Mar. 1998.

....information. Among the metrics they report is the number of thru deref assigns, which corresponds to the write metric reported in Figure 14. However, since their results included compiler introduced temporaries in their thru deref count [Landi 1997] a direct comparison is not possible. Stocks et al. 1998] and Landi et al. 1998] use the same metric without including temporaries. Using the flow sensitive context sensitive analysis of Landi and Ryder [1992] the average number of objects ranges from 1.0 to 2.0 on the benchmarks we have in common (allroots, lex315, loader, football, compiler, ....

....freed, and thus as a pointer dereference [Landi 1997] where our analysis does not. On the three programs (allroots, lex315, simulator) in which our analysis reports the same, or close to the same, number of writes as thru derefs, our precision is either identical or close to that reported in Stocks et al. 1998]. The relative precision of the flow insensitive analysis compared to the flowsensitive analysis is in contrast to the study of Stocks et al. 1998] which compares the flow sensitive analysis mentioned above with a flow insensitive analysis described in Zhang et al. 1996] For the eight common ....

[Article contains additional citation context not shown here]

Stocks, P. A., Ryder, B. G., Landi, W. A., and Zhang, S. 1998. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis. 21--31.

....information. Among the metrics they report is the number of thru deref assigns, which corresponds to the write metrics reported in Fig. 6. However, since their results include compiler introduced temporaries in their thru deref count [25] a direct comparison is not possible. Stocks et al. [47] use the same metric without including temporaries for the flow sensitive context sensitive analysis of Landi and Ryder [26] They report the average number of objects ranges from 1.0 to 2.0 on the nine common benchmarks. On these benchmarks our flow sensitive context insensitive analysis ranges ....

.... as modifying the structure deallocated, and thus as a pointer dereference [25] In fact, on the programs in which our analysis reports the same, or close to the same, number of writes as thru derefs (allroots, fixoutput, lex315, simulator) our precision is identical to that reported in [47]. Stocks et al. 47] also compare the flow sensitive analysis of Landi and Ryder [26] with a flow insensitive analysis described in [52] which shares the property of Steensgaard s analysis [46] called ST in this paper) in that it groups all objects pointed to by a variable into an equivalence ....

[Article contains additional citation context not shown here]

Philip A. Stocks, Barbara G. Ryder, William A. Landi, and Sean Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, March 1998.

....by Lackwit would not be distinguishable by a context insensitive analysis, because Morphin reuses the same abstract data types (for example, queues) in different contexts. Furthermore, those instances all have the same heap allocation point in the program text, so even flow sensitive analyses [SRL97, WL95] that identify abstract heap storage locations with malloc call sites will not be able to distinguish such instances. A key claim about Lackwit is that it scales to handle large programs. Here is a table of the performance obtained for queries on some sample programs: Program Source (kloc) ....

....except for algorithms based on type inference, such as Steensgaard s [S96] discussed in Section 7.1.6. For some reason, few connections have been drawn between closure analysis and alias analysis, even though they both compute the same kind of information. 26 Stocks, Ryder and Landi [SRL97] give a comparison of the efficiency and accuracy of two of their alias analysis algorithms for first order C programs, applied to the problem of computing an approximation of the side effects of each procedure. Their performance results are similar to Grove et al. they conclude that ....

P. Stocks, B. Ryder, and W. Landi. Comparing Flow- and Contextsensitivity on the Modification-side-effects Problem. Department of Computer Science, Rutgers University, Number DCS-TR-335, August, 1997.

.... Even though a flow and context sensitive aliasing analysis [LR92] is utilized, the problem decomposition also allows plugging a di#erent type of aliasing analysis (e.g. a flowinsensitive one [Cou86, Gua88, BCCH94, And94, SH97b, Ste96, Wei80, ZRL96, HP98] which is more e#cient, but less precise [SRLZ98] in the computation. An alias, called a reaching alias at the entry of the procedure containing program point n, is used to approximate the calling context under which we are performing analysis at statement n, 2 and ALIAS(n, RA) denotes such a conditional aliasing analysis. By tagging the ....

....e#ect algorithm based on their flow and context sensitive pointer aliasing analysis [CBC93, MLR 93] where they use both the call site and reaching aliases as the context. Further studies of the interprocedural side e#ect analysis using various aliasing methods can be found in [LRS 98, SRLZ98] Another approach to side e#ect analysis is to perform an interprocedural pointer aliasing analysis and then identify all variables that get modified through dereference of a pointer using the found aliases [SH97a, ZRL96, ZRL98, YRL98] 3.3 Incremental Data Flow Analyses Many incremental ....

[Article contains additional citation context not shown here]

P.A. Stocks, B.G. Ryder, W.A. Landi, and S. Zhang. Comparing flow- and context-sensitivity on the modification side-e#ects problem. In Proceedings of the International Symposium on Software Testing and Analysis, pages 21--31, March 1998. Also available as DCS-TR-335.

....aliasing. In fact, it starts with the assumption that all objects referencing the same field name are aliased. On the other hand, there are analyses that are specifically designed to capture aliasing relationships, like the various flow insensitive points to analyses previously designed for C C [23, 4, 20, 24]. The results of such an analysis can also be used to estimate the types of receivers. In a points to analysis, each allocation (or each invocation of a constructor in Java) is associated with a allocation site, which can be considered to be a unique label. In Java, unlike in C, each allocation ....

....Plevyak s algorithm. Our work is also related to flow insensitive points to analysis for C [23, 4, 20] Our refers to analysis is a simpler version of the linear points to algorithm of Steensgaard [23] There has been considerable work evaluating flow insensitive and flow sensitive analyses for C [4, 24, 13, 20]. However, we feel that the tradeoffs in Java will be different, because many pointer relationships in C are simple call by reference relationships, while all pointer relationships in Java are always due to references to dynamically allocated objects. Our work build on the Soot framework under ....

Philip A. Stocks, Barbara G. Ryder, William A. Landi, and Sean Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, Mar. 1998.

....in Section 2) The fourth algorithm [SH97b] can be parameterized between the ST and AN analysis. The authors measure the precision of these analyses by implementing three data flow analyses (GMOD, live variables, and truly live variables) and an interprocedural slicing algorithm. Stocks et al. SRLZ98] extend the work of Landi et al. LRZ93] by reporting precision results for the computation of the interprocedural MOD problem using the flow sensitive context sensitive analysis of Landi and Ryder [LR92] They compare this analysis with a flow insensitive analysis described in [ZRL96] which ....

Philip A. Stocks, Barbara G. Ryder, William A. Landi, and Sean Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, March 1998.

....information. Among the metrics they report is the number of thru deref assigns, which corresponds to the write metrics reported in Table 2. However, since their results include compiler introduced temporaries in their thru deref count [21] a direct comparison is not possible. Stocks et al. [39] use the same metric without including temporaries. Using the flow sensitive context sensitive analysis of Landi and Ryder [22] the average number of objects ranges from 1.0 to 2.0 on the benchmarks we have in common (allroots, lex315, loader, football, compiler, assembler, simulator) On these ....

.... allroots are treated as modifying the structure freed, and thus as a pointer dereference [21] In fact, on the three programs where our analysis reports the same, or close to the same, number of writes as thru derefs (allroots, lex315, simulator) our precision is identical to that reported in [39]. The relative precision of the flow insensitive analysis compared to the flow sensitive analysis is in contrast to the study of Stocks et al. 39] which compares the flow sensitive analysis of Landi and Ryder [22] with a flow insensitive analysis described in [42] For the seven common ....

[Article contains additional citation context not shown here]

Philip A. Stocks, Barbara G. Ryder, William A. Landi, and Sean Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. Technical Report DCS-TR-335, Department of Computer Science, Rutgers University, August 1997.

....information. Among the metrics they report is the number of thru deref assigns, which corresponds to the write metrics reported in Fig. 3. However, since their results include compiler introduced temporaries in their thru deref count [30] a direct comparison is not possible. Stocks et al. [50] use the same metric without including temporaries for the flow sensitive context sensitive analysis of Landi and Ryder [31] They report the average number of CFG FS Program LOC Nodes Time LOC Sec Nodes Sec allroots 227 157 0.10 2,270 1,570 052.alvinn 272 223 0.09 3,022 2,478 01.qbsort 325 173 ....

.... are treated as modifying the structure deallocated, and thus as a pointer dereference [30] In fact, on the three programs in which our analysis reports the same, or close to the same, number of writes as thruderefs (allroots, lex315, simulator) our precision is identical to that reported in [50]. The relative precision of the flow insensitive analysis compared to the flow sensitive analysis is in contrast to the study of Stocks et al. 50] which compares the flow sensitive analysis of Landi and Ryder [31] with a flow insensitive analysis described in [54] For the eight common ....

[Article contains additional citation context not shown here]

Philip A. Stocks, Barbara G. Ryder, William A. Landi, and Sean Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, March 1998.

....information. Among the metrics they report is the number of thru deref assigns, which corresponds to the write metrics reported in Fig. 3. However, since their results include compiler introduced temporaries in their thru deref count [26] a direct comparison is not possible. Stocks et al. [46] use the same metric without including temporaries for the flow sensitive context sensitive analysis of Landi and Ryder [27] They report the average number of objects ranges from 1.0 to 2.0 on the eight common benchmarks. On these benchmarks our flow sensitive context insensitive analysis ranges ....

.... as modifying the structure deallocated, and thus as a pointer dereference [26] In fact, on the three programs in which our analysis 14 reports the same, or close to the same, number of writes as thru derefs (allroots, lex315, simulator) our precision is identical to that reported in [46]. The relative precision of the flow insensitive analysis compared to the flowsensitive analysis is in contrast to the study of Stocks et al. 46] which compares the flow sensitive analysis of Landi and Ryder [27] with a flow insensitive analysis described in [49] For the eight common ....

[Article contains additional citation context not shown here]

Philip A. Stocks, Barbara G. Ryder, William A. Landi, and Sean Zhang. Comparing flow and context sensitivity on the modifications-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, March 1998.

....and the space needed to store it are prohibitive [1] In many cases, the programs are incomplete the source code for parts of the program (e.g. libraries) is not available. Empirical evidence suggests that precise interprocedural flow sensitive analysis does not scale for large programs [18]. In some cases the analysis results are not needed for the whole program, but only for a relatively small part of it for example, a maintenance task for a specific program fragment may only require data flow information for program points inside the fragment, both before and after the ....

....in order to obtain better information for important program fragments. This approach can be used for programs that are too big to be analyzed by flow sensitive wholeprogram analysis, yet al..low flow insensitive whole program analysis for example, C programs with around 100,000 lines of code [1, 18, 17]. We describe the design of two fragment analyses derived from a wholeprogram flow and context sensitive pointer alias analysis [10] for C programs. We present empirical evaluation of the cost and precision of these two fragment pointer alias analyses. We show that the time and space costs ....

[Article contains additional citation context not shown here]

P. Stocks, B.G. Ryder, W. Landi, and S. Zhang. Comparing flow- and contextsensitivity on the modification side-e#ects problem. In Proc. International Symposium on Software Testing and Analysis, pages 21--31, 1998.

....of procedures. As a result, analyses from this category are very e#cient and can be used in productionstrength compilers with little additional cost. Several combinations of a mod analysis and a flow and context insensitive points to analysis have been investigated theoretically and empirically [21, 25, 20, 14]. Similarly to [21, 14] we consider a whole program mod analysis based on Andersen s whole program flow and context insensitive points to analysis [2] Even though we investigate these particular analyses, our results also apply to similar flow and context insensitive points to analyses (e.g. ....

....library module. Such summary based analyses can compute more precise pointsto and mod information for the client module, compared to worst case analyses. This improvement is important because the precision of the analysis solution has significant impact on subsequent analyses and optimizations [21, 20, 25, 14]. The summary information encodes the e#ects of the library module on the rest of the program. Such information can be constructed at the time when the library module is compiled, and can be stored together with the library binary. The library summary can later be used during the separate ....

P. Stocks, B. G. Ryder, W. Landi, and S. Zhang. Comparing flow- and context-sensitivity on the modification side-e#ects problem. In International Symposium on Software Testing and Analysis, pages 21--31, 1998.

.... calculation of potential non aliases, because we believe they can be useful for other applications (e.g. analyzing libraries, testing etc) In order to test the quality of the solution computed by RCI, we used the solution for two different applications: side effect analysis or MOD [LRZ93, SRLZ98] and virtual function resolution [PR96] The results for MOD are shown in Table 4. The column AvConcrete MOD shows the average number of heap names whose fields are modified by a pointer assignment statement according to the Phase III solution. In object oriented programs, since a method is ....

P.A. Stocks, B.G. Ryder, W.A. Landi, and S. Zhang. Comparing flow- and context-sensitivity on the modification side-effects problem. In Proceedings of the International Symposium on Software Testing and Analysis, pages 21--31, March 1998. Also available as DCS-TR-335.

....analysis is designed to achieve the following goals: Precision. The separate analysis is designed to be as precise as the whole program analysis. This is important because the precision of the points to information can greatly a#ect the cost and precision of subsequent analyses and applications [18, 22, 11]. Practicality. The cost of computing and storing the summary should be practical. In particular, the time to compute the summary should not be excessive (e.g. no more than a few minutes for a medium sized library) and the disk space needed to store the summary should be reasonable (e.g. ....

P. Stocks, B. G. Ryder, W. Landi, and S. Zhang. Comparing flow- and context-sensitivity on the modification side-e#ects problem. In Proc. International Symposium on Software Testing and Analysis, pages 21--31, 1998.

.... calculation of potential non aliases, because we believe they can be useful for other applications (e.g. analyzing libraries, testing etc) In order to test the quality of the solution computed by RCI, we used the solution for two di#erent applications: side e#ect analysis or MOD [LRZ93, SRLZ98] and virtual function resolution [PR96] The results for MOD are shown in Table 4. The column AvConcrete MOD shows the average number of heap names whose fields are modified by a pointer assignment statement according to the Phase III solution. In object oriented programs, since a method is ....

P.A. Stocks, B.G. Ryder, W.A. Landi, and S. Zhang. Comparing flow- and context-sensitivity on the modification side-e#ects problem. In Proceedings of the International Symposium on Software Testing and Analysis, pages 21--31, March 1998. Also available as DCS-TR-335.

....and the space needed to store it are prohibitive [1] In many cases, the programs are incomplete the source code for parts of the program (e.g. libraries) is not available. Empirical evidence suggests that precise interprocedural flow sensitive analysis does not scale for large programs [15]. In some cases the analysis results are not needed for the whole program, but only for a relatively small part of it for example, a maintenance task for a specific program fragment may only require data flow information for program points inside the fragment, both before and after the ....

....in order to obtain better information for important program fragments. This approach can be used for programs that are too big to be analyzed by flow sensitive wholeprogram analysis, yet al..low flow insensitive whole program analysis for example, C programs with around 100,000 lines of code [1, 15, 14]. We describe the design of two fragment analyses derived from a wholeprogram flow and context sensitive pointer alias analysis [8] for C programs. We present empirical evaluation of the cost and precision of these two fragment pointer alias analyses. We show that the time and space cost ....

[Article contains additional citation context not shown here]

P. Stocks, B.G. Ryder, W. Landi, and S. Zhang. Comparing flow- and contextsensitivity on the modification side-e#ects problem. In Proceedings of the International Symposium on Software Testing and Analysis, pages 21--31, March 1998.

....calls through function pointers, unions and type casting [22] For the first combined analysis, we repeat the comparison in [23] using more data. We wish to explore the cost precision tradeoffs in the three methods. At present, FS is not scalable to all large ( 10,000 lines of code) programs [19]. Investigating the application of FS to certain segments of large programs is of interest, because it has better precision than flowinsensitive methods. For the second combined analysis, we use another flow insensitive and context insensitive aliasing method (PT) 22] on those segments which have ....

....handle features of C programs such as indirect calls through function pointers, unions and type casting [22] and have used this general decomposition for the experiments described here. In Figure 1, we present the test programs, which include Unix utilities, Spec benchmarks, and programs used in [10, 19]. The programs are ordered by the number of nodes in their internal representation (ICFG) a better size estimate than lines of code. Also shown are the number of indirect calls, unions, and ptr assignments with type casting. 3 Experiments: Combined Analysis Combined analysis chooses an aliasing ....

[Article contains additional citation context not shown here]

Philip Stocks, Barbara Ryder, William Landi, and Sean Zhang. Comparing flow and context sensitivity on the modification-sideeffects problem. In Proceeding of the International Symposium on Software Testing and Analysis, March 1998. To Appear. Also available as DCS-TR-335.

No context found.

P. Stocks, B. G. Ryder, W. Landi, and S. Zhang. Comparing flow and context sensitivity on the modification-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, 1998.

No context found.

Phillip Stocks, Barbara G. Ryder, William Landi, and Sean Zhang. Comparing flow and context sensitivity on the modification-side-effects problem. In International Symposium on Software Testing and Analysis, pages 21--31, 1998.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC