Rajeev Alur, Michael Benedikt, Kousha Etessami, Patrice Godefroid, Thomas Reps, and Mihalis Yannakakis. Analysis of recursive state machines. ACM Transactions on Programming Languages and Systems, 27 (4):786--818, 2005. ISSN 0164-0925. doi: 10.1145/1075382.1075387.  Home/Search   Document Not in Database   Summary   Related Articles   Check

....from above, pointer analysis can determine what are the locations that p may point to. In addition, pointer analysis determines which function addresses may be stored in a given function pointer. Because of the importance of such points to information, a variety of analyses have been developed [10, 9, 5, 1, 18, 17, 20, 15, 11, 7, 4, 6, 3, 14, 8]. These analyses provide different tradeoffs between cost and precision. For example, flow and context insensitive pointer analyses [1, 17, 20, 15, 4] ignore the flow of control between program points and do not distinguish between different calling contexts of procedures. As a result, such ....

....FA analysis may provide sufficient precision for the purposes of call graph construction. In this context, the use of more expensive pointer analyses may not be necessary. 6 Related Work There is a large body of work on various pointer analyses for C with different degrees of cost and precision [10, 9, 5, 1, 18, 17, 20, 15, 11, 7, 4, 6, 3, 14, 8]. Traditionally, the precision of these analyses has been evaluated with respect to the disambiguation of indirect memory reads and writes (e.g. in p=1) Our work evaluates the precision of pointer analysis with respect to indirect procedure calls and call graph construction. Existing work ....

M. Hind, M. Burke, P. Carini, and J. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848-- 894, May 1999.

....string approach approximates calling context by a chain of k enclosing call sites. Both techniques have served as the basis for a large number of subsequent context sensitive analyses. Since N and L are finite and H is monotone, this sequence has a well defined limit. Some analyses (e.g. [33]) compute separate solutions for each procedure; our results can be trivially extended to such analyses. Whenever we discuss flow and context insensitive analyses in the rest of the thesis, we refer to analyses that compute a single solution for the entire program. 10 2.2 Fragment Dataflow ....

....Side e#ect analysis for languages like C is di#cult because pointers allow indirect memory accesses and indirect procedure calls. Typically, mod analysis uses the output of a points to analysis to resolve pointer dereferences. Various whole program points to analyses have been developed [35, 33, 21, 4, 68, 60, 69, 56, 36, 25, 17, 23, 12, 32, 54]. In this chapter we focus on the category of flow and context insensitive analyses [4, 60, 69, 56, 17, 32] Such analyses ignore the flow of control between program points and do not distinguish between di#erent calling contexts of procedures. As a result, analyses from this category are e#cient ....

M. Hind, M. Burke, P. Carini, and J. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, May 1999.

.... methods through v (for ease of explanation, we assume that the program is formatted in such a way that virtual method calls are invoked through variables) During 1 Similar approaches have been used to resolve indirect calls through function pointers in points to analysis of C programs (e.g. [10, 11]) 1 class A (b.1) this2 s1 s2 this1 h4 h10 h11 p p (c.1) 2 int[ p; 3 public A( 4 this1.p=new int[2] 5 6 public void set(int v) 7 this2.p[0] v; 8 9 public static void main(String [ av) 10 A s1 = new A( 11 A s2 = new A( 12 s1.set(0) 13 ....

M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

....usual way [2, 16] Pointer analysis algorithms can di#er in the way in which they assign names to memory locations. Such di#erences can significantly impact the precision and the e#ciency of the program analyses that use the pointer information. Many existing pointer analysis algorithms (e.g. [1, 3, 5, 6, 8, 11, 14, 15, 18, 19]) use the same name to identify a memory location throughout the program. Because a memory location may be accessed throughout the program, its name can appear in several procedures. Therefore, a program analysis that uses this pointer information usually treats such a name as if it were a global ....

M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

....at analysis time. It has been shown that in about half of the sealed packages in rt.jar, 560 of the virtual calls to non final methods are identi ed as sealed. 5 Related Work Data ow algorithms generally use static abstractions of dynamic behavior. Alias analysis or point to analysis [13, 15, 16] use abstractions of dynamic data structures that include pointers (like in C or C ) or references (like in Java) These abstractions capture connectivity relationships between variables. For example, Ghiya and Hendren [15] present a pointer analysis to detect invariant variables over a region, ....

M. Hind, M. Burke, P. Carini, and J.D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4), 1999.

.... C language [7] and is as such known technology (the bindingtime is polyvariant across C structure instances, which is equivalent to class polyvariance) Polyvariant alias analyses have been studied for imperative languages both formally and in practice, and are well documented in literature [12]. 9.2 Partial evaluation for Java We have implemented a complete partial evaluator for Java; this partial evaluator is based on the principles presented in this paper, extended (mostly) as described in Section 9.1 to support larger and more realistic programs [24 26] Our partial evaluator, ....

M. Hind, M. Burke, P. Carini, and J. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

....usual way [2, 18] Pointer analysis algorithms can di#er in the way in which they assign names to memory locations. Such di#erences can significantly impact the precision and the e#ciency of the program analyses that use the pointer information. Many existing pointer analysis algorithms (e.g. [1, 3, 5, 6, 8, 12, 16, 17, 21, 23]) use the same name to identify a memory location throughout the program. Because a memory location may be accessed throughout the program, its name can appear in several procedures. Therefore, a program analysis that uses this pointer information usually treats such name as if it were a global ....

M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

.... and the object name (containing a single dereference) which points to it (e.g. ##p,x# means p points to x) This representation, like a points to representation, requires a closure step to obtain object names containing multiple levels of dereferences [CBC93, MLR 93, BCCH94, BCCH97, HBCC99] For example, in order to determine the fixed locations potentially experiencing side e#ects in p= the implicit representation pairs ##p,q# and ##q,r# must be combined to yield ###p,r#. FSAlias [LR92] the flow context sensitive alias approximation algorithm uses an explicit ....

....that statement, ##q,r#, obtaining the spurious alias ####p,s#. This occurs because neither representation encodes enough information to remember that the two incoming aliases do not exist concurrently on a path 7 The implicit representation is called compact in [CBC93, BCCH94, BCCH97, HP98, HBCC99] 10 in the program. These examples are simple instances of the general problem. S1: x = y; S2: p = x; S3: x = z; S4: p = S1: q = z; S2: if ( S3: p = q; else S4: q = y; S5: p = S1: if ( S2: p = q; else S3: r = s; S4: q = r; S5: p = a) Implicit representation more precise (b) ....

[Article contains additional citation context not shown here]

Michael Hind, Nichael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, 1999.

.... Steensgaard s algorithm [22] or Das algorithm [7] have been investigated, and Steensgaard s algorithm is considered to be the fastest [14] For object oriented languages, dynamic binding must be approximated, and in fact for C dynamic binding can be analysed similar to function pointers in C [13]. For Java, however, the situation is di erent: there are no pointer arithmetics and no pointers to pointers, arrays have di erent semantics, type casts are type safe, and dynamic loading of classes is quite common. It is the aim of this article to generalize well known points to algorithms such ....

....to formal parameters, return values and this pointers. In the presence of dynamic binding or function pointers, however, the situation becomes more complex. Steensgaard s algorithm can be extended for function pointers without using an additional xpoint iteration [8] However, Hind et al. [13] observed that the precise analysis of function pointers requires extensions of the basic mechanism. They proposed to use the points to sets for function pointers in order to determine the possible call targets, and to extend the points to graph according to these targets. For Java, the analysis ....

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848-894, July 1999.

....Cg B fB; Cg C fA; B; Cg (b) Alias sets for A, B, and C Figure 3: An example of alias sets. 4. ALIAS VERSIONING FOR JAVA Our compiler infrastructure (more specifically, the Toronto Portable Optimizer, as described in Section 5) employs context sensitive interprocedural pointer analysis [11, 14, 25] for Fortran 90 and C to develop more precise alias information. However, this interprocedural analysis is not currently available for Java because of difficulties associated with handling the dynamic features of the language and ensuring binary compatibility of the generated code. Binary ....

....numerical applications typically run on large memory systems, and that their data sets are much larger than the code, we believe that code expansion is a small price to pay for the enormous boost in performance. 7. RELATED WORK The analysis of aliasing relationships in programs is well studied [10, 11, 14, 15, 25, 27]. Our work is complementary to this pre Table 3: Code expansion for the eight benchmarks. benchmark Executable size baseline versioning parallelization (bytes) bytes) growth) bytes) growth) MATMUL 11986 16858 41 17950 50 MICRODC 15978 18098 13 17950 12 LU 14160 14656 4 15328 8 ....

M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):847--893, July 1999. available as IBM Research Report RC28752.

....[17] which allows e#cient node merges. One of the variables in each class is used as an equivalence class representative (ECR) 15] During the analysis, every reference to a variable v is translated into a reference to the ECR for the equivalence class to which v 2 Some analyses (e.g. [7, 9]) only ignore intraprocedural flow of control. currently belongs. Shapiro and Horwitz [14] propose a family of points to analyses whose cost and precision range from those of Steensgaard s analysis to those of Andersen s analysis. Similarly to Steensgaard s analysis, the nodes in the points to ....

....o# line variable substitution in the context of Andersen s analysis, the technique is applicable to other kinds of points to analysis. For example, it could be useful in investigating tradeo#s between cost and precision for pointer analyses with some degree of flow or context sensitivity (e.g. [8, 7, 4, 18, 9]) a = b b = c b = d q = b p = a #(a) x #(p) x #(b) y #(q) y x = y y = c y = d R G # S x y c d R Gamma Gamma Gamma Gamma R GS a b c p q d GA = GS (a, q) p, q) Figure 3: O# line variable substitution example. ....

[Article contains additional citation context not shown here]

M. Hind, M. Burke, P. Carini, and J. D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

....[17] which allows efficient node merges. One of the variables in each class is used as an equivalence class representative (ECR) 15] During the analysis, every reference to a variable v is translated into a reference to the ECR for the equivalence class to which v 2 Some analyses (e.g. [7, 9]) only ignore intraprocedural flow of control. 2 currently belongs. Shapiro and Horwitz [14] propose a family of points to analyses whose cost and precision range from those of Steensgaard s analysis to those of Andersen s analysis. Similarly to Steensgaard s analysis, the nodes in the ....

....off line variable substitution in the context of Andersen s analysis, the technique is applicable to other kinds of points to analysis. For example, it could be useful in investigating tradeoffs between cost and precision for pointer analyses with some degree of flow or context sensitivity (e.g. [8, 7, 4, 18, 9]) 3 a = b b = c b = d q = b p = a oe(a) x oe(p) x oe(b) y oe(q) y x = y y = c y = d R G 0 S x y c d R Gamma Gamma Gamma Gamma R GS a b c p q d GA = GS Gamma f(a; q) p; q)g Figure 3: Off line variable ....

[Article contains additional citation context not shown here]

M. Hind, M. Burke, P. Carini, and J. D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

....attempts to serve this role, as well as categorizing existing work. 2. BACKGROUND A pointer alias analysis attempts to determine when two pointer expressions refer to the same storage location. A points to analysis [27, 22, 2] or similarly, an analysis based on a compact representation [13, 5, 38], attempts to determine what storage locations a pointer can point to. This information can then be used to determine the aliases in the Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or ....

.... Is control ow information of a procedure used during the analysis By not considering control ow information, and therefore computing a conservative summary, ow insensitive analyses compute one solution for either the whole program (such as [2, 94, 108, 91] or for each method (such as [5, 38, 55]) whereas a ow sensitive analysis computes a solution for each program point. Flowinsensitive analyses thus can be more ecient, but less precise than a ow sensitive analysis. Flow insensitive analyses are either equality based [94, 108] which treat assignments as bidirectional and typically ....

[Article contains additional citation context not shown here]

M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848-894, July 1999.

....prototype tool, based on the model checker Spin, to study and experiment with alias analysis. There are many known algorithms and tools that can be used to determine may alias relations, 13 with varying degrees of accuracy (for papers including broad references to alias analysis see for instance [HBCC99]) At the best of our knowledge, we ignore of any previous application of model checker technology to this goal. However, there are various studies about the application of model checking to flow analysis, e.g. Ste91,DS97] In these works, it has been shown how many problems usually solved by ....

M. Hind, M. Burke, P. Carini and J. Choi, Interprocedural Pointer Alias Analysis, ACM Transaction on Programming Languages and Systems, Vol. 21, 4, 1999, 848-894.

....PCG, i.e. main, and three lists of functions (similar to the OM CFG) creation order, topological order, and reverse topological order. The last two orders are useful for interprocedural analysis. For problems where information flows from caller to callee and vice versa, such as pointer analysis [9] and constant propagation [17] it is not clear which order to visit functions. We have experimented with topological order, reverse topological order, and alternating topological order in our flow sensitive pointer analysis, and have found not much difference in the convergence of the analysis. ....

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4), July 1999.

.... The main contributions of this paper are the following: ffl empirical results that measure the precision and efficiency of five pointer alias analysis algorithms with varying degrees of flow sensitivity and alias data structures: Address taken, Steensgaard [34] Andersen [1] Burke et al. [4, 12], Choi et al. 5, 12] ffl empirical data on how the pointer analyses solutions affect the precision and efficiency of the following client analyses: Mod Ref, live variable analysis and dead assignment identification, reaching definition analysis, dependence analysis, and interprocedural ....

.... of this paper are the following: ffl empirical results that measure the precision and efficiency of five pointer alias analysis algorithms with varying degrees of flow sensitivity and alias data structures: Address taken, Steensgaard [34] Andersen [1] Burke et al. 4, 12] Choi et al. [5, 12]; ffl empirical data on how the pointer analyses solutions affect the precision and efficiency of the following client analyses: Mod Ref, live variable analysis and dead assignment identification, reaching definition analysis, dependence analysis, and interprocedural conditional constant ....

[Article contains additional citation context not shown here]

M. Hind, M. Burke, P. Carini, and J.-D. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, July 1999.

....any object used as a thread, or any object that is reachable from such a thread object globally escapes. Note that this does not mean that objects created during the execu 6 We could further refine the call graph by constructing the graph in tandem with the construction of the points to graph [19]. 7 We ignore back edges in determining the reverse topological order. 6 class ListElement int data; ListElement next; static ListElement g = null; ListElement( data = 0; next = null; static void L(int p, int q) S0: ListElement u = new ListElement( ListElement t = u; while(p ....

....graph and the summary graph makes our approach for escape analysis well suited for dynamic Java compilation systems such as Jalapeno at IBM Research [8] 4. 6 Escape Analysis versus Points to Analysis Connection graph for escape analysis and points to graphs for pointer induced alias analysis [16, 19] are similar to each other in that both are static abstractions of dynamic data structures with pointers (or references in Java) The main goal of alias analysis, however, is memory disambiguation to answer the question whether two reference (pointer) expressions (of the form a.b.c.d. can ....

Michael Hind, Michael Burke, Paul Carini, and JongDeok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems. To appear.

.... set for the entire program and uses a union find data structure to avoid iteration; AN ( Andersen ) an iterative implementation of Andersen s flow insensitive algorithm [1] that computes one solution set for entire program; FI ( Flow Insensitive ) a flow insensitive algorithm by Burke et al. [4, 18] that computes a solution set for every function; FIK ( Flow Insensitive with Kill ) a flow insensitive algorithm by Burke et al. 4, 18] that computes a solution set for every function, but attempts to improve precision by using precomputed (flow sensitive) kill information; FS ....

.... flow insensitive algorithm [1] that computes one solution set for entire program; FI ( Flow Insensitive ) a flow insensitive algorithm by Burke et al. 4, 18] that computes a solution set for every function; FIK ( Flow Insensitive with Kill ) a flow insensitive algorithm by Burke et al. [4, 18] that computes a solution set for every function, but attempts to improve precision by using precomputed (flow sensitive) kill information; FS ( Flow Sensitive ) a flow sensitive algorithm by Choi et al. 9, 18] that computes a solution set for every program point. The program is represented ....

[Article contains additional citation context not shown here]

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems. to appear.

No context found.

Rajeev Alur, Michael Benedikt, Kousha Etessami, Patrice Godefroid, Thomas Reps, and Mihalis Yannakakis. Analysis of recursive state machines. ACM Transactions on Programming Languages and Systems, 27 (4):786--818, 2005. ISSN 0164-0925. doi: 10.1145/1075382.1075387.

No context found.

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, 1999.

No context found.

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848-894, 1997. 185

No context found.

M. Hind, M. Burke, P. Carini, and J. Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, May 1999.

No context found.

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, 1999.

No context found.

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems (TOPLAS), 21 (4):848--894, 1999. ISSN 0164-0925.

No context found.

Michael Hind, Michael Burke, Paul Carini, and Jong-Deok Choi. Interprocedural pointer alias analysis. ACM Transactions on Programming Languages and Systems, 21(4):848--894, 1999.

First 50 documents

Online articles have much greater impact   More about CiteSeer.IST   Add search form to your site   Submit documents   Feedback  

CiteSeer.IST - Copyright Penn State and NEC