Pointsto Analysis in Almost Linear Time

1
Points-to Analysis in Almost Linear Time

• paper by Bjarne Steensgaard
• 23rd ACM Symposium on Principles of Programming
  Languages (POPL'96)
• Microsoft Research Technical Report MSR-TR-95-08

presented by Jeff Blank CMSC 858Z Spring 2004
2
Outline of Talk

• Background
• Source Language
• Type System
• Inference Algorithm
• Examples

3
Motivation

• Why this paper?
• and which paper, exactly?
• What type of analysis?
• flow-insensitive, context-insensitive,
  interprocedural

4
Source Language
Example Factorial
fact fun(x)-gt(r) if lessthan(x 1) then r
1 else xminusone subtract(x 1) nextfac
fact(xminusone) r multiply(x nextfac)
fi result fact(10)

• S x y
• x y
• x y
• x op(y1. . .yn)
• x allocate(y)
• x y
• x fun(f1fn)-gt(r1rm) S
• x1xm p(y1yn)

5
Non-standard types

• ? ? x ?
• ? ? ref(?)
• ? ? lam(?1?n)(?n1?nm)

6
Typing Rules

• obvious vs. with partial order
• (review on sheet)

_ whatever!
7
Type Inference System

• imposing the rules performing points-to
  analysis
• Algorithm
• Initialization
• assumptions
• all variables set to different types
• Inference
• impose the rules, i.e. merge types as necessary
• one pass

8
Example Run
a x b y if p then y z else y
x fi c y
9
More Examplesoriginal algorithm

• m 42
• i m
• j m
• j n

10
More Examplesimproved algorithm

• m 42
• i m
• j m
• j n

11
More Examplesimproved algorithm (joining with
pending set)

• m 42
• i m
• j m
• m n

12
Efficiency of system

• O(N?(N,N))
• ? is inverse Ackermanns function, cost of find
• Compared to others...

13
Other comments

• no support for separate types in a composite
  object (e.g. a struct)
• is fast
• even on mid-nineties computers
• test data (show graph)