Demand-driven pointer analysis

TL;DR: This paper describes a demand-driven flow-insensitive, subset-based, con text-inssensitive points-to analysis, and proves that the algorithm is correct and optimal in the sense that it does not do more work than necessary.

Abstract: Known algorithms for pointer analysis are “global” in the sense that they perform an exhaustive analysis of a program or program component In this paper we introduce a demand-driven approach for pointer analysis Specifically, we describe a demand-driven flow-insensitive, subset-based, con text-insensitive points-to analysis Given a list of pointer variables (a query), our analysis performs just enough computation to determine the points-to sets for these query variables Using deductive reachability formulations of both the exhaustive and the demand-driven analyses, we prove that our algorithm is correct We also show that our analysis is optimal in the sense that it does not do more work than necessary We illustrate the feasibility and efficiency of our analysis with an implementation of demand-driven points-to analysis for computing the call-graphs of C programs with function pointers The performance of our system varies substantially across benchmarks - the main factor is how much of the points-to graph must be computed to determine the call-graph For some benchmarks, only a small part of the points-to graph is needed (eg pouray emacs and gcc), and here we see more than a 10x speedup For other benchmarks (eg burlap and gimp), we need to compute most (> 95%) of the points-to graph, and here the demand-driven algorithm is considerably slower, because using the demand-driven algorithm is a slow method of computing the full points-to graph