Zhang, S., Ryder, B. G., and Landi, W.: 1996, `Program Decomposition for Pointer Aliasing: A Step towards Practical Analyses'. In: Symposium on the Foundations of Software Engineering. pp. 81--92.  Home/Search   Document Details and Download   Summary   Related Articles   Check

....precision have the advantage of being independent of the speci c choices made in using the analysis information by a particular tool. 2 Related Work Andersen s [And94] and Steensgaard s [Ste96] points to analyses are only two choices in a vast array of possible alias analyses, among them [BCCH94, CRL99, Das00, DMW98, Deu94, DRS98, EGH94, FRD00, HP98, LR92, SRW99, SH97, WL95, YHR99, ZRL96]. As our results suggest, the bene t of polymorphism (more generally, context sensitivity) may vary greatly with the particular analysis. Hindley Milner style polymorphism [Mil78] has been studied extensively. The only direct applications of Hindley Milner polymorphism to C of which we are aware ....

Sean Zhang, Barbara G. Ryder, and William A. Landi. Program Decomposition for Pointer Aliasing: A Step toward Practical Analyses. In Fourth Symposium on the Foundations of Software Engineering, October 1996.

....that analyzing all pointers simultaneously, as most of the existing approaches do, is the primary obstacle to efficient pointer analysis. To address the efficiency of pointer analysis, researchers have recently explored techniques to partition the pointer analysis into a group of subproblems [ZRL96, Ruf97, ZRL98] int a, p, q, pp; main ( s1: pp = p; s2: foo( s3: p = s4: pp = q; s5: foo( s6: q = void foo( s7: pp = a; call foo call foo analyzing main analyzing foo (a) An example program. b) Interleaving the intraprocedural analysis with the ....

....to their approach, we also separate the analysis of recursive data structures and non recursive data structures. We focus on the efficiency in analyzing nonrecursive data structures. Zhang et al. put the pointers that may contain the same value in the same group for the purpose of partitioning [ZRL96, ZRL98] Ruf groups variables by their types (declared types or inferred types) and analyzes one variable group at a time [Ruf97] A partitioned approach, in general, can improve efficiency due to several reasons: Separating subproblems with different characteristics allows the flexibility of ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder and William Landi. Program Decomposition for Pointer Aliasing: A Step towards Practical Analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering, Oct. 1996.

....if either reference is a write. This assumption is true for Fortran 90 and Fortran 77 programs, but may be false for C programs. Before performing array data flow analysis on C programs, alias analysis must first be performed. Alias analysis has been studied extensively in recent literature [8, 11, 14, 27, 28, 39, 44, 45]. 16 5 Effectiveness and Efficiency In this section, we first discuss how GAR s are used for array privatization and loop parallelization. We then present experimental results to show the effectiveness and efficiency of array data flow analysis. 5.1 Array Privatization and Loop ....

S. Zhang and B.G. Ryder and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. Proc. of the 4th Symposium on the Foundations fo Software Engineering, October, 1996.

....Existing algorithms for data flow analysis vary in their flow and context sensitivity; they compute approximate solutions which are safe approximations of the precise solution. The least expensive, but most imprecise, are the flow and context insensitive approaches [Wei80, And94, Ste96, ZRL96, SH97] In contrast, the flow and contextsensitive techniques [LR92, CBC93, MLR 93, EGH94, Deu94, CHS95, WL95, RHS95, Ruf95, PR96] are the most precise but also the most expensive (in time and memory) Approaches like [PS91, PC94, GDDC97] are in between the above two extremes. 1.3 ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering, October 1996.

....a large body of work on pointer analysis. Some of the analyses concentrate on pointers that point to heapallocated memory (e.g. 6, 13] Others analyze pointers that point to stack based memory; among them, some are flow sensitive (e.g. 8, 7, 4, 18] while others are flow insensitive (e.g. [2, 7, 15, 19, 14, 9]) Several analyses use placeholder variables to represent sets of related variables. The use of equivalence class representatives in Steensgaard s and Shapiro Horwitz s analyses was already discussed in Section 2. Other examples are the non visible names from [8] the invisible names from [4] ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proc. Symposium on the Foundations of Software Engineering, pages 81--92, 1996.

....a large body of work on pointer analysis. Some of the analyses concentrate on pointers that point to heapallocated memory (e.g. 6, 13] Others analyze pointers that point to stack based memory; among them, some are flow sensitive (e.g. 8, 7, 4, 18] while others are flow insensitive (e.g. [2, 7, 15, 19, 14, 9]) Several analyses use placeholder variables to represent sets of related variables. The use of equivalence class representatives in Steensgaard s and Shapiro Horwitz s analyses was already discussed in Section 2. Other examples are the non visible names from [8] the invisible names from [4] ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proc. Symposium on the Foundations of Software Engineering, pages 81--92, 1996. 10

....[34] a flow insensitive algorithm that computes one solution set for the entire program and employs a fast union find [36] data structure to represent all alias relations. This results in an almost linear time algorithm that makes one pass over the program. Similar algorithms are discussed in [42, 24, 2]. Andersen [1] an iterative implementation of Andersen s context insensitive flow insensitive algorithm, which was originally described using constraint solving [1] Although it also uses one solution set for the entire program, it can be more precise than Steensgaard s algorithm because it ....

....open question whether a flow sensitive analysis will follow this pattern. Landi et al. 20, 35] report precision results for the computation of the interprocedural Mod problem using the flowsensitive context sensitive analysis of Landi and Ryder [18] They compare this analysis with an analysis [42] that is similar to Steensgaard s analysis. They found that the more precise analysis provided improved precision, but exhausted memory on some programs that the less precise analysis was able to process. Emami et al. 8] report precision results for a flow sensitive context sensitive algorithm. ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In 4th Symposium on the Foundations of Software Engineering, pages 81--92, Oct. 1996.

....of relative precision have the advantage of being independent of the speci c choices made in using the analysis information by a particular tool. 2 Related Work Andersen s [4] and Steensgaard s [29] points to analyses are only two choices in a vast array of possible alias analyses, among them [5, 6, 7, 8, 9, 10, 11, 15, 19, 20, 27, 28, 31, 33, 34]. As our results suggest, the bene t of polymorphism (more generally, context sensitivity) may vary greatly with the particular analysis. Hindley Milner style polymorphism [21] has been studied extensively. The only direct applications of Hindley Milner polymorphism to C of which we are aware are ....

S. Zhang, B. G. Ryder, and W. A. Landi. Program Decomposition for Pointer Aliasing: A Step toward Practical Analyses. In Fourth Symposium on the Foundations of Software Engineering, Oct. 1996.

....that may be implemented in somewhat non conventional ways can be dicult to represent and (sometimes impossible to) match. This is especially true for interaction features whose implementation may be delocalised [LS86] or involve multi valued constant propagation [MGHM95] and pointer aliasing [ZRL96] An e ective way of improving the expressiveness of the pattern notation and, consequently, the e ectiveness of the matching mechanism is to augment pattern description with ow information [TFAM96] By allowing constraints to be expressed in terms of data and control ow relations, it is ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program Decomposition for Pointer Aliasing: A Step Toward Practical Analyses. In Proceedings of the 4th ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE), pages 81-92. ACM Press, October 1996. |

....flow insensitive points to algorithm that conservatively groups all objects pointed to by a variable into one object. He utilizes a fast union find algorithm, which results in an almost linear time complexity for his algorithm, making it less precise but more efficient than Andersen s algorithm. Zhang et al. 1996] present an algorithm, which shares a property of Steensgaard s analysis [Steensgaard 1996] in that it groups all objects pointed to by a variable into an equivalence class. This algorithm and Steensgaard s algorithm have been shown to be fast in practice [Shapiro and Horwitz 1997b; Steensgaard ....

.... to that reported in Stocks et al. 1998] The relative precision of the flow insensitive analysis compared to the flowsensitive analysis is in contrast to the study of Stocks et al. 1998] which compares the flow sensitive analysis mentioned above with a flow insensitive analysis described in Zhang et al. 1996]. For the eight common benchmarks, our flowinsensitive algorithm ranges from 1.0 to 2.8 objects on average for a write dereference, compared to 1.0 to approximately 6.3 for the less precise flow insensitive analysis they studied. Emami et al. 1994] report precision results for a context and ....

[Article contains additional citation context not shown here]

Zhang, S., Ryder, B. G., and Landi, W. 1996. Program decomposition for pointer aliasing: A step toward practical analyses. In 4th Symposium on the Foundations of Software Engineering. 81--92.

.... the same, or close to the same, number of writes as thru derefs (allroots, fixoutput, lex315, simulator) our precision is identical to that reported in [47] Stocks et al. 47] also compare the flow sensitive analysis of Landi and Ryder [26] with a flow insensitive analysis described in [52], which shares the property of Steensgaard s analysis [46] called ST in this paper) in that it groups all objects pointed to by a variable into an equivalence class. For the eight common benchmarks, the ST analysis ranges from 1.0 to approximately 6.3 for the flow insensitive analysis they ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In 4th Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

....not necessarily imply that similar methods will be perform well for my tasks. 7.1.7. Hybrid Analyses Hybrid approaches to closure analysis and alias analysis have been proposed, that combine traditional flow analysis of abstract values with type inference. Ruf [R97] and Zhang, Ryder and Landi [ZRL96] suggest similar schemes for alias analysis that first apply a fast type inference analysis, and then use the results to select a subset of the program to be analyzed with a more expensive flow analysis to obtain more precise information for a certain set of values. In fact, this approach can ....

S. Zhang, B. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. Proceedings of the 4 th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, October 1996.

.... analysis, the sequencing and control flow of a program is ignored, that is, the program is regarded as a set of statements, and a data flow algorithm will examine the statements one by one and process the aliasing e#ect it may contribute [Cou86, Gua88, BCCH94, And94, SH97b, Ste96, Wei80, ZRL96, HP98] 7 int x,y,z; int p, q; foo( p= x; p= y; a: bar(p) d: q= u: x z; b: bar( z) bar(int w) c: q=w; w,y w,z q,y q,z p,x p,x , p,y q,y , q,z q,y , q,z q,y , q,z Figure 2.2: Aliasing solution by flow sensitive and context insensitive ....

....is the pointer aliasing problem at program point n. Even though a flow and context sensitive aliasing analysis [LR92] is utilized, the problem decomposition also allows plugging a di#erent type of aliasing analysis (e.g. a flowinsensitive one [Cou86, Gua88, BCCH94, And94, SH97b, Ste96, Wei80, ZRL96, HP98] which is more e#cient, but less precise [SRLZ98] in the computation. An alias, called a reaching alias at the entry of the procedure containing program point n, is used to approximate the calling context under which we are performing analysis at statement n, 2 and ALIAS(n, RA) denotes ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

....technique that identifies the potential memory locations each pointer dereference may access. The accuracy of such information directly affects many other analyses and optimizations. Most of the recent published research works on alias analysis have focused on interprocedural techniques [16, 17, 4, 7, 6, 24, 25, 13, 23, 14], because we may obtain very imprecise results when limiting the analysis within each subroutine. These analysis techniques can be classified into two broad categories: context sensitive and context insensitive. A context sensitive approach distinguishes a subroutine s effect in different calling ....

....can control the context sensitive level of the algorithm. Our approach has the following features: ffl It enables the use of a syntax directed flow sensitive analysis technique which is generally more efficient than its iterative counterpart [1] ffl It facilitates a combined analysis technique [25, 20, 26] which applies different algorithms to analyze different data structure groups in order to improve the precision and the efficiency of the algorithm. ffl It can provide a spectrum of context sensitive algorithms, ranging from a context insensitive algorithm to a full context sensitive algorithm, ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering, October 1996.

....first NS elements of IPCO and IPCE. 6 Comparison with other work Related work includes: ffl work on alias analysis: although this mostly addresses programs written in C in which array accesses are not a notable feature but it is rather the analysis of pointers which poses a problem, the work of [12] and [9] can be compared to ours; ffl type inference in the Lackwit system [8] The aim of the work described in both [12] and [9] is flow insensitive pointer alias analysis for C programs. 12] consider not only (as we do) different names in different sub programs for the same memory location or ....

.... this mostly addresses programs written in C in which array accesses are not a notable feature but it is rather the analysis of pointers which poses a problem, the work of [12] and [9] can be compared to ours; ffl type inference in the Lackwit system [8] The aim of the work described in both [12] and [9] is flow insensitive pointer alias analysis for C programs. 12] consider not only (as we do) different names in different sub programs for the same memory location or pointer, but also all the different names (access paths) which can be obtained in C using pointers, dereferencing and ....

[Article contains additional citation context not shown here]

Zhang, S., Ryder, B. G., and Landi, W. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering, San Francisco, October, 1996 (1996). Available at http://www.prolangs.rutgers.edu.

....analysis [1, 6, 18, 14, 21] The goal of points to analysis is to compute, for each pointer variable p, a set of variables whose address p might contain. The physical typechecking algorithm has most in common with algorithms for points to analysis that distinguish between fields of structures [18, 20, 21, 22]. Like much of this work, our analysis tracks fields in terms of a base pointer and a numeric offset. Consequently, the information obtained from the analysis is specific to a given platform. The first point to note is that the nature of the information obtained from physical type checking and ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In Fourth ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, San Francisco, October 1996.

.... et al. SRLZ98] extend the work of Landi et al. LRZ93] by reporting precision results for the computation of the interprocedural MOD problem using the flow sensitive context sensitive analysis of Landi and Ryder [LR92] They compare this analysis with a flow insensitive analysis described in [ZRL96] which shares the property of Steensgaard s analysis [Ste96] ST) in that it groups all objects pointed to by a variable into an equivalence class, resulting in an almost linear time algorithm. Emami, et al. EGH94] report precision results for a flow sensitive context sensitive algorithm. Ghiya ....

....and describes how dependence analysis uses the computed information to parallelize loops in two SPEC benchmarks. Ruf [Ruf97] describes a program partitioning technique that is used for a flow sensitive points to analysis, achieving a storage savings of 1.3 7.2 over existing methods. Zhang et al. ZRL96, ZRL98] investigate the effectiveness of a program decomposition technique for pointer aliasing of well typed C programs. After the program is decomposed, they investigate various combinations of three pointer alias analyses, one flow and context sensitive and two different flow and ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996.

....the same value. They form the core of present day optimizing parallelizing compilers. The problem of calculating pointer induced aliases, termed pointer analysis, has also received significant attention from the research community over the past few years [LR92, CBC93, EGH94, WL95, Ruf95, Ste96, ZRL96, SH97b] This emphasis has mainly stemmed from the increasing popularity of languages supporting pointers such as C, C and Fortran90. Further emphasis comes from application areas which primarily use pointer based dynamic data structures. 1 Call by reference parameters can be considered as a ....

....for analyzing industry scale large programs. They can provide accurate information for programs with simple call structure. For more complex programs, the information provided by them can be used to reduce the search space of more precise pointer analyses. Such an approach is proposed in [ZRL96] However, these approaches also provide a very conservative approximation for heap, based on malloc sites. 1.2.2 Heap Pointer Analysis Much of the earlier work on pointer analysis, was devoted to heap analysis, more specifically to analysis of heap based recursive data structures. This was ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering, October 1996.

....analyses can be used for a wide variety of compiler applications. That is, once the relationships between pointers are computed, what can we do with it How do we put pointer analysis to work A variety of effective techniques have been proposed to estimate points to or alias relationships for C [6, 10, 19, 26, 29, 31, 33, 35]. A common feature of all these techniques is that they approximate relationships between named objects. For objects that are on the stack, the appropriate variable names are used, while dynamically allocated objects are handled by associating them to some set of static names. 1 This approach, ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering, October 1996.

....analysis effort and remaining within a particular time or space budget. Zhang et al. describe how, for pointer alias analysis of C programs, a program can be partitioned such that objects in different partitions can be analyzed independently of each other, possibly using different algorithms [19]. They show that a judicious mix of flow sensitive and flow insensitive pointer alias analyses can reduce analysis costs without significantly sacrificing the quality of the information obtained. While their goals are conceptually very similar to ours, the technical details are very different. ....

S. Zhang, B. G. Ryder, and W. Landi, "Program Decomposition for Pointer Aliasing: A Step toward Practical Analyses", Proc. Fourth Symposium on the Foundations of Software Engineering, Oct. 1996.

.... is identical to that reported in [39] The relative precision of the flow insensitive analysis compared to the flow sensitive analysis is in contrast to the study of Stocks et al. 39] which compares the flow sensitive analysis of Landi and Ryder [22] with a flow insensitive analysis described in [42]. For the seven common benchmarks, our flowinsensitive algorithm ranges from 1.0 to 2.38, compared to 1.0 to approximately 6.3 for the flow insensitive analysis they studied. We attribute this to the fact that our flow insensitive analysis does not treat pointer related assignments as symmetric, ....

....common benchmarks, our flowinsensitive algorithm ranges from 1.0 to 2.38, compared to 1.0 to approximately 6.3 for the flow insensitive analysis they studied. We attribute this to the fact that our flow insensitive analysis does not treat pointer related assignments as symmetric, as is done in [42]. Emami et al. 13] report precision results for a context and flow sensitive algorithm. Their results range from 1.0 to 1.77 for all indirect accesses using a heap naming scheme that represents all heap objects with one name. Because we were unable to obtain the benchmarks from their suite, a ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996. A Appendix

.... is identical to that reported in [50] The relative precision of the flow insensitive analysis compared to the flow sensitive analysis is in contrast to the study of Stocks et al. 50] which compares the flow sensitive analysis of Landi and Ryder [31] with a flow insensitive analysis described in [54]. For the eight common benchmarks, our flowinsensitive algorithm ranges from 1.0 to 2.81 objects on average for a write dereference, compared to 1.0 to approximately 6.3 for the flow insensitive analysis they studied. The analysis described in [54] shares the property of Steensgaard s analysis ....

....[31] with a flow insensitive analysis described in [54] For the eight common benchmarks, our flowinsensitive algorithm ranges from 1.0 to 2.81 objects on average for a write dereference, compared to 1.0 to approximately 6.3 for the flow insensitive analysis they studied. The analysis described in [54] shares the property of Steensgaard s analysis [49] in that it groups all objects pointed to by a variable into an equivalence class. Although this can lead to spurious alias relations not present in the FI analysis, it does allow for an almost linear time algorithm, which has been shown to be ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In 4th Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

.... is identical to that reported in [46] The relative precision of the flow insensitive analysis compared to the flowsensitive analysis is in contrast to the study of Stocks et al. 46] which compares the flow sensitive analysis of Landi and Ryder [27] with a flow insensitive analysis described in [49]. For the eight common benchmarks, our flow insensitive algorithm ranges from 1.0 to 2.81 objects on average for a write dereference, compared to 1.0 to approximately 6.3 for the flow insensitive analysis they studied. The analysis described in [49] shares the property of Steensgaard s analysis ....

....with a flow insensitive analysis described in [49] For the eight common benchmarks, our flow insensitive algorithm ranges from 1.0 to 2.81 objects on average for a write dereference, compared to 1.0 to approximately 6.3 for the flow insensitive analysis they studied. The analysis described in [49] shares the property of Steensgaard s analysis [45] in that it groups all objects pointed to by a variable into an equivalence class. Although this can lead to spurious alias relations not present in the FI analysis, it does allow for an almost linear time algorithm, which has been shown to be ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step toward practical analyses. In 4th Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

No context found.

Zhang, S., Ryder, B. G., and Landi, W.: 1996, `Program Decomposition for Pointer Aliasing: A Step towards Practical Analyses'. In: Symposium on the Foundations of Software Engineering. pp. 81--92.

....enable indirect memory accesses through pointer dereferences, as well as indirect procedure calls (e.g. through function pointers in C) Such indirect accesses and calls can be disambiguated with pointer analysis. In this paper we evaluate the precision of a pointer analysis by Zhang et al. [20, 19] for the purposes of call graph construction for C programs with function pointers. The analysis is implemented in the context of a productionstrength code browsing tool from Siemens Corporate Research. The analysis uses an inexpensive, almost linear, flow and context insensitive algorithm. To ....

....an inexpensive, almost linear, flow and context insensitive algorithm. To measure analysis precision, we compare the call graph computed by the analysis with the most precise call graph obtainable by a large category of pointer analyses. Surprisingly, for all our data programs the analysis from [20, 19] achieves the best possible precision. This result indicates that for the purposes of call graph construction, even inexpensive analyses can provide very good precision, and therefore the use of more expensive analyses may not be justified. 1 Introduction In languages like C, the use of pointers ....

[Article contains additional citation context not shown here]

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996.

....Side e#ect analysis for languages like C is di#cult because pointers allow indirect memory accesses and indirect procedure calls. Typically, mod analysis uses the output of a points to analysis to resolve pointer dereferences. Various whole program points to analyses have been developed [35, 33, 21, 4, 68, 60, 69, 56, 36, 25, 17, 23, 12, 32, 54]. In this chapter we focus on the category of flow and context insensitive analyses [4, 60, 69, 56, 17, 32] Such analyses ignore the flow of control between program points and do not distinguish between di#erent calling contexts of procedures. As a result, analyses from this category are e#cient ....

....mod analysis uses the output of a points to analysis to resolve pointer dereferences. Various whole program points to analyses have been developed [35, 33, 21, 4, 68, 60, 69, 56, 36, 25, 17, 23, 12, 32, 54] In this chapter we focus on the category of flow and context insensitive analyses [4, 60, 69, 56, 17, 32]. Such analyses ignore the flow of control between program points and do not distinguish between di#erent calling contexts of procedures. As a result, analyses from this category are e#cient and can be used in production strength tools without introducing substantial time space overhead. Several ....

[Article contains additional citation context not shown here]

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996.

....enable indirect memory accesses through pointer dereferences, as well as indirect procedure calls (e.g. through function pointers in C) Such indirect accesses and calls can be disambiguated with pointer analysis. In this paper we evaluate the precision of a pointer analysis by Zhang et al. [17] for the purposes of call graph construction for C programs with function pointers. The analysis uses an inexpensive, almost linear, flow and context insensitive algorithm. To measure analysis precision, we compare the call graph computed by the analysis with the most precise call graph ....

....an inexpensive, almost linear, flow and context insensitive algorithm. To measure analysis precision, we compare the call graph computed by the analysis with the most precise call graph obtainable by a large category of pointer analyses. Surprisingly, for all our data programs the analysis from [17] achieves the best possible precision. This result indicates that for the purposes of call graph construction, even inexpensive analyses can provide very good precision, and therefore the use of more expensive analyses may not be justified. 1 Introduction In languages like C, the use of pointers ....

[Article contains additional citation context not shown here]

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996. 5

.... calling context sensitive approximation algorithm for pointer induced aliasing, called FSAlias [LR92] MODC (F IAlias) uses a flow insensitive, calling context insensitive approximation algorithm for pointer induced aliasing, called FIAlias, which is similar to the algorithm described in [ZRL96, Zha98] The actually implemented algorithms handle unions and casting in C programs. The MODC schema is independent of the aliasing algorithm chosen and can use any aliasing algorithm, given a suitable interface. These MODC algorithms have extensive implementation results reported; these ....

....at calls and for procedures are presented and discussed in Section 4. The empirical results show the utility of both analyses for specific applications and demonstrate the precision gains from sensitivity for certain data flow information. Recent work in partitioning programs for analyses [ZRL98, ZRL96, Ruf97] yields hope that analyses of varying cost and precision can be applied to di#erent parts of a program to obtain desired data flow information at practical cost. The experiments reported here can be viewed as the initial investigation into the cost precision tradeo#s involved when using ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

....analysis, because the two analysis problems are essentially identical. Side e#ect analysis for languages like C is di#cult because of pointer usage; typically, a points to analysis is needed to resolve pointer dereferences. Our work is focused on flow and context insensitive points to analyses [1, 18,21, 17, 5], which ignore the flow of control and the calling contexts of procedures. Such analyses are very e#cient and can be used in production strength compilers with little additional cost. Several combinations of a mod analysis and a flow and context insensitive points to analysis have been ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996.

....been many investigations of pointer aliasing algorithms which vary in cost and precision. Several concentrate on aliases in heap storage [HPR89, CWZ90, Deu94, HN90, EGH94, JM82, LH88, SRW96] Others calculate program wide (flow insensitive) aliases [Cou86, Gua88, BCCH94, And94, SH97, Ste95, Wei80, ZRL96] Still other work concentrated on aliases in higher order functional languages [Deu90, NPD87] Incremental algorithms update data flow information after a program change rather than recomputing it from scratch, with the belief that the change impact will be limited and that the update cost will ....

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

....As described in Sect. 3.2, in this case the whole program information I contains a whole program flow insensitive solution and the program call graph. Analysis Input. The flow insensitive solution S FI is obtained using a wholeprogram flow and context insensitive analysis similar to the one in [21]. Intuitively, the names in the program are partitioned into equivalence classes; if two names can be aliases, they belong to the same class in the final solution. Every name starts in its own equivalence class and then classes are joined as possible aliases are discovered. For example, statement ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proc. Symp. on the Foundations of Software Engineering, pages 81--92, 1996.

....di#cult because pointers allow indirect memory accesses and indirect procedure calls. Typically, mod analysis uses the output of 1 a points to analysis to resolve indirect memory accesses and to determine the targets of indirect calls. Various wholeprogram points to analyses have been developed [15, 13, 7, 2, 27, 24, 28, 22, 16, 11, 6, 9, 4]. Our work is focused on the category of flow and context insensitive analyses [2, 24, 28, 22, 6] Such analyses ignore the flow of control between program points and do not distinguish between di#erent calling contexts of procedures. As a result, analyses from this category are very e#cient and ....

....of 1 a points to analysis to resolve indirect memory accesses and to determine the targets of indirect calls. Various wholeprogram points to analyses have been developed [15, 13, 7, 2, 27, 24, 28, 22, 16, 11, 6, 9, 4] Our work is focused on the category of flow and context insensitive analyses [2, 24, 28, 22, 6]. Such analyses ignore the flow of control between program points and do not distinguish between di#erent calling contexts of procedures. As a result, analyses from this category are very e#cient and can be used in productionstrength compilers with little additional cost. Several combinations of ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Symposium on the Foundations of Software Engineering, pages 81--92, 1996. 12

.... MODC (FSAlias) uses a flow sensitive, calling context sensitive approximation algorithm for pointer induced aliasing [9] MODC (FIAlias) uses a flowinsensitive, calling context insensitive approximation algorithm for pointer induced aliasing which is similar to the algorithm described in [21]. 1 MODC (FSAlias) reports program point specific possible modification side effects; the results are more precise than information derivable using the same alias summary for all statements of a procedure. MODC (FIAlias) also reports program point specific possible modification side effects, ....

....presented in the empirical section. In summary, the empirical results show the utility of both analyses for specific applications and demonstrate the precision gains from sensitivity in the aliases and thus in the side effect information obtained. Recent work in partitioning programs for analyses [21, 17] yields hope that analyses of varying cost and precision can be applied to different parts of a program to obtain desired data flow information at practical cost. 2 BASIC CONCEPTS Iterative data flow analysis is a fixed point calculation for recursive equations defined on a graph representing a ....

[Article contains additional citation context not shown here]

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, Oct. 1996.

....scalability because they ignore the flow of control between program statements. Some such analyses only take into account the control flow between procedures [9, 11] in some cases, this approach allows certain degree of context sensitivity. Other analyses ignore the flow of control completely [2, 21, 26, 19]; such analyses are both flow and context insensitive. Andersen s analysis [2] is one of the more precise flow and context insensitive points to analyses. It has been shown to scale for large programs [6, 23, 15] and is a natural candidate for use in industrial strength software tools. We only ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proc. Symp. Foundations of Software Engineering, pages 81--92, 1996. 12

....As described in Section 3.2, in this case the whole program information I contains a whole program flow insensitive solution and the program call graph. Analysis Input. The flow insensitive solution S FI is obtained using a wholeprogram flow and context insensitive analysis similar to the one in [18]. Intuitively, the names in the program are partitioned into equivalence classes; if two names can be aliases, they belong to the same class in the final solution. Every name starts in its own equivalence class and then classes are joined as possible aliases are discovered. For example, statement ....

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

....focuses on the accuracy of the information derived by a methodology rather than examining its applicability. 2) Is there a way of harnessing analyses of varying precision to achieve appropriate cost benefit goals This question can be considered, for example, in the field of pointer analysis[Zhang et al. 1996]. Recently, there have been significant advances in the approximate analyses of difficult program constructs such as pointers[Choi et al. 1993; Marlowe et al. 1993; Burke et al. 1994; Landi and Ryder 1992; Steensgaard 1996] These approximate analysis methods are difficult to compare in terms of ....

Zhang, S., Ryder, B. G., and Landi, W. 1996. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Symposium on the Foundations of Software Engineering (October 1996).

.... results compare the performance of two dissimilar MODC algorithms: MODC (FSAlias) uses a flow sensitive, calling contextsensitive interprocedural alias analysis [LR92] MODC (FIAlias) uses a flow insensitive, callingcontext insensitive alias analysis which is much faster, but less accurate [ZRL96] These two algorithms were profiled on 45 programs ranging in size from 250 to 30,000 lines of C code, and the results demonstrate dramatically the possible cost precision tradeoffs. This first comparative implementation of MODC analyses offers insight into the differences between ....

.... the flow sensitive, calling context sensitive approximation algorithm for pointer induced aliasing, FSAlias [LR92] MODC (FIAlias) uses a flow insensitive, calling context insensitive approximation algorithm for pointer induced aliasing, F IAlias, which is similar to the algorithm described in [ZRL96] 3 The MODC schema is independent of the aliasing algorithm chosen and can use any aliasing algorithm, given a suitable interface. These are the first MODC algorithms with extensive implementation results reported. These experiments are the first investigations of the cost precision trade offs ....

[Article contains additional citation context not shown here]

Sean Zhang, Barbara G. Ryder, and William Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, October 1996.

.... MODC (FSAlias) uses a flowsensitive, calling context sensitive approximation algorithm for pointer induced aliasing [9] MODC (FIAlias) uses a flow insensitive, calling context insensitive approximation algorithm for pointer induced aliasing which is similar to the algorithm described in [21]. 1 MODC (FSAlias) reports program point specific possible modification side effects; the results are more precise than information derivable using the same alias summary for all statements of a procedure. MODC (FIAlias) also reports program point specific possible modification side effects, but ....

....presented in the empirical section. In summary, the empirical results show the utility of both analyses for specific applications and demonstrate the precision gains from sensitivity in the aliases and thus in the sideeffect information obtained. Recent work in partitioning programs for analyses [21, 17] yields hope that analyses of varying cost and precision can be applied to different parts of a program to obtain desired data flow information at practical cost. BASIC CONCEPTS Iterative data flow analysis is a fixed point calculation for recursive equations defined on a graph representing a ....

[Article contains additional citation context not shown here]

S. Zhang, B. G. Ryder, and W. Landi. Program decomposition for pointer aliasing: A step towards practical analyses. In Proceedings of the 4th Annual ACM SIGSOFT Symposium on the Foundations of Software Engineering, pages 81--92, Oct. 1996.

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC