Efficient Computation of Parameterized Pointer Information for Interprocedural Analyses

Transcription

1 Efficien Comuaion of Parameerized Poiner Informaion for Inerrocedural Analyses Donlin Lian and Mary Jean Harrold Collee of Comuin Georia Insiue of Technoloy Alana, GA 30332, USA Absrac Poiner informaion ha is rovided by many alorihms idenifies a memory locaion usin he same name hrouhou a roram. Such oiner informaion is inaroriae for use in analyzin C rorams because, usin such informaion, a roram analysis may roaae a lare amoun of surious informaion across rocedure boundaries. This aer resens a modular alorihm ha efficienly comues arameerized oiner informaion in which symbolic names are inroduced o idenify memory locaions whose addresses may be assed ino a rocedure. Because a symbolic name may idenify differen memory locaions when he rocedure is invoked under differen callsies, usin arameerized oiner informaion can hel a roram analysis reduce he surious informaion ha is roaaed across rocedure boundaries. The aer also resens a se of emirical sudies, ha demonsrae (a) he efficiency of he alorihm, and (b) he benefis of usin arameerized oiner informaion over usin non-arameerized oiner informaion in roram analyses. The sudies show ha usin arameerized oiner informaion may sinificanly imrove he recision and he efficiency of many roram analyses. 1. INTRODUCTION Various oiner analysis echniques have been develoed o faciliae roram analyses of C rorams. To suor hese roram analyses, a oiner analysis mus associae names wih memory locaions. A oiner analysis also mus rovide informaion ha hels roram analyses deermine he memory locaions ha may be accessed hrouh oiner dereferences. Wih his informaion, a roram analysis can firs relace he oiner dereferences in a C roram wih he memory locaions accessed hrouh such dereferences, and hen analyze he roram in he usual way [2, 14]. Poiner analysis alorihms can differ in he way in which Proram 1 1 in x; 2 foo(in ) { 3 =+1; 4 } (a) 5 main() { 6 in y; 7 foo(&x); 8 foo(&y); 9 } (b) x,y nv "nv" bound o "x" a 7 "nv" bound o "y" a 8 (c) Fiure 1: (a) Proram 1, (b) non-arameerized oins-o rah, (c) arameerized oins-o rah. hey assin names o memory locaions. Such differences can sinificanly imac he recision and he efficiency of he roram analyses ha use he oiner informaion. Many exisin oiner analysis alorihms (e.., [1, 3, 5, 6, 10, 12, 13, 16, 17]) use he same name o idenify a memory locaion hrouhou he roram. These alorihms use variable names o idenify memory locaions allocaed on he sack, and use an arificial name o idenify he memory locaions allocaed on he hea a a secific saemen. Because a memory locaion may be accessed hrouhou he roram, is name can aear in several rocedures. Therefore, a roram analysis ha uses his oiner informaion usually reas such name as if i were a lobal variable. Only a few exisin oiner analysis alorihms [7, 19] assin differen names for a memory locaion in differen rocedures. When he address of a memory locaion can be assed ino a rocedure hrouh formal arameers or lobal oiners, hese alorihms use a symbolic name o idenify he memory locaion wihin he rocedure. If he oiner informaion comued for he rocedure is used under more han one callin conex, he symbolic name can be used o idenify differen memory locaions under differen callin conexs. For examle, he alorihms can use a symbolic name nv o idenify he memory locaions whose addresses are assed ino rocedure foo() (Fiure 1(a)) hrouh. When he oiner informaion comued for foo() is used under he conex of saemen 7, nv idenifies x. When his oiner informaion is used under he conex of saemen 8, nv idenifies y. The symbolic names inroduced by hese alorihms ac like reference arameers. Thus, we refer o such symbolic names as auxiliary arameers, and we refer o oiner informaion ha conains auxiliary arameers as arameerized oiner informaion. 1

2 For suorin roram analyses of C rorams, arameerized oiner informaion has several advanaes over nonarameerized oiner informaion. Firs, arameerized oiner informaion for a rocedure is more comac han non-arameerized oiner informaion. In a rocedure, arameerized oiner informaion can use an auxiliary arameer o reresen a se of memory locaions. In conras, non-arameerized oiner informaion may require several names for he same se of memory locaions. Thus, when a roram analysis analyzes a rocedure usin arameerized oiner informaion, i creaes and roaaes less informaion han usin non-arameerized oiner informaion. For examle, usin arameerized oiner informaion, a roram analysis would roaae informaion for nv in rocedure foo() in Fiure 1(a). In conras, usin non-arameerized oiner informaion, he roram analysis would roaae informaion for x or y in foo(). Second, wihou secial consideraion, a roram analysis alorihm ha uses non-arameerized oiner informaion may roaae surious informaion across rocedure boundaries. For examle, usin non-arameerized oiner informaion, a roram analysis finds ha x or y may be modified a saemen 3 in Fiure 1 and roaaes his informaion back o saemen 7. Thus, i reors ha foo() may modify x and y a saemen 7. In conras, usin arameerized oiner informaion, a roram analysis finds ha nv is modified a saemen 3. When his informaion is roaaed back o saemen 7, because nv idenifies he memory locaion for x under he conex of saemen 7, he roram analysis reors ha only x is modified by foo() a saemen 7. Therefore, usin arameerized oiner informaion, he roram analysis can reduce he amoun of surious informaion roaaed across rocedure boundaries. One major roblem wih exisin alorihms ha comue arameerized oiner informaion is efficiency. Firs, exisin alorihms use a flow-sensiive aroach. Emirical resuls sues ha flow-sensiive oiner analysis alorihms may no scale o lare rorams [7, 12, 19]. Second, exisin alorihms may analyze a rocedure more han once [7, 19]. This addiional analysis increases he exense of hese alorihms. Third, exisin alorihms mih comue several versions of oiner informaion for each rocedure. Usin hese differen versions of oiner informaion may increase he comlexiy of roram analyses. To efficienly comue arameerized oiner informaion, we develoed a modular arameerized oiner analysis alorihm (MoPPA). MoPPA efficienly comues oiner informaion for a roram followin a framework similar o he flow-insensiive, conex-sensiive oiner analysis alorihm (FICS) [13], which we reviously develoed. Like FICS, MoPPA comues, in hree hases, oins-o rahs ha reresen he oiner informaion for a roram. Unlike FICS, which idenifies a memory locaion usin he same name hrouhou a roram, MoPPA uses, when ossible, auxiliary arameers o idenify memory locaions whose addresses are assed ino a rocedure. MoPPA also disinuishes he memory locaions ha are dynamically allocaed in a rocedure when he rocedure is invoked under differen callin conexs. Comared o FICS and oher alorihms (e.., [1, 6, 17]) ha are inended o handle lare rorams, a major benefi of MoPPA is ha i rovides arameerized oiner informaion. The arameerized oiner informaion les a roram analysis reduce he surious informaion roaaed across rocedure boundaries. Such reducion may sinificanly imrove boh he efficiency and he recision of roram analyses. Anoher benefi of MoPPA over hese alorihms is ha MoPPA can disinuish he memory locaions dynamically allocaed in a rocedure under differen callin conexs. Therefore, MoPPA may rovide more recise oiner informaion han hese alorihms. Comared o oher exisin alorihms ha comue arameerized oiner informaion, a major benefi of MoPPA is is efficiency. MoPPA rocesses each oiner assinmen only once. In he second and he hird hases, MoPPA roaaes, from one rocedure o anoher, only a small amoun of informaion ha is relaed o arameers. Therefore, MoPPA can efficienly comue he oins-o rahs. Anoher benefi of MoPPA over exisin alorihms is is modulariy only he informaion for he rocedures wihin a sronly conneced comonen on he call rah mus be in memory simulaneously. Therefore, comared o exisin alorihms ha comue arameerized oiner informaion, MoPPA requires less memory. This aer firs discusses he aroach used by MoPPA o assin names o memory locaions. The aer hen resens he deails of he MoPPA alorihm. The aer also resens a se of emirical sudies ha demonsrae (a) he efficiency of MoPPA and (b) he benefis of usin arameerized oiner informaion rovided by MoPPA over usin non-arameerized oiner informaion rovided by FICS in roram analyses. To he bes of our knowlede, hese sudies are he firs ha comare he resuls of roram analyses comued usin arameerized oiner informaion wih ha comued usin non-arameerized oiner informaion. The sudies show ha usin arameerized oiner informaion can sinificanly imrove he recision and he efficiency of many roram analyses. 2. PARAMETERIZED POINTS-TO GRAPHS This secion firs briefly inroduces he oins-o rahs consruced by MoPPA, and hen discusses he aroach used by MoPPA o assin names o memory locaions. 2.1 Poins-o Grahs MoPPA uses oins-o rahs o reresen oiner informaion. In a oins-o rah, a node reresens a se of memory locaions, whose names are associaed wih he node. A field access ede, labeled wih a field name, connecs a node reresenin srucures o a node reresenin a secific field of he srucures. A oins-o ede, labeled wih, reresens oins-o relaions. For examle, he oinso rah in Fiure 1(b) reresens he fac ha may oin o x or y. For efficiency, MoPPA imoses wo consrains on a oins-o rah: (1) each memory locaion can be reresened by only one node; (2) labels are unique amon he edes leavin a node. Similar consrains are also used o imlemen Seensaard s alorihm [17] and FICS [13]. For a iven roram, MoPPA comues a lobal oinso rah ha reresens he oiner informaion relaed o lobal oiners. For each rocedure in he roram, MoPPA comues a rocedural oins-o rah ha reresens he oiner informaion relaed o he local oiners in he rocedure. The searaion of lobal oiner informaion from local oiner informaion les MoPPA reduce he amoun of informaion ha i roaaes across rocedure boundaries. 2

3 For examle, suose ha a saemen in a rocedure forces a lobal oiner o oin o a hea-allocaed memory locaion. Wihou he searaion, his oiner informaion would have o be roaaed o every rocedure in he roram, even if is irrelevan o he comuaion of he oiner informaion for he rocedure. MoPPA avoids such roaaion by makin his informaion available in he lobal oins-o rah. When a roram analysis analyzes a roram, i resolves he dereferences of lobal oiners usin he lobal oins-o rah. 2.2 Namin Memory Locaions Unlike FICS, which uses he same name o idenify each memory locaion hrouhou a roram, MoPPA uses an auxiliary arameer, when ossible, o idenify a memory locaion in he oins-o rah for a rocedure P. To suor roram analyses, MoPPA also rovides bindin informaion ha mas an auxiliary arameer in P o he names ha idenify he same memory locaions a he callsies o P. For examle, MoPPA uses auxiliary arameer nv o idenify memory locaions for x and y in he oins-o rah (Fiure 1(c)) for foo() in roram 1 (Fiure 1(a)). I also rovides informaion o ma nv o x a saemen 7 and o y a saemen 8. Unlike FICS, which uses one arificial name o idenify all he memory locaions allocaed on he hea a a saemen s in a rocedure P, MoPPA aems o disinuish he memory locaions allocaed a s when P is invoked from differen callsies. Unlike oher alorihms (e.., [5]) ha blindly disinuish hese memory locaions by exendin heir names wih call srins, MoPPA makes such disincion only if he disincion may hel he roram analysis comue more recise informaion. To handle hea-allocaed memory locaions and lobal variables effecively, MoPPA inroduces quasi-lobal names. A quasi-lobal name is a name whose scoe may include several rocedures, bu does no necessarily include all rocedures in a roram. MoPPA can idenify a memory locaion loc usin a quasi-lobal name in some rocedures, and idenify loc usin auxiliary arameers in he oher rocedures ha access loc. Such a namin scheme is more flexible han ha used in exisin alorihms, in which a memory locaion mus be idenified eiher usin a lobal name whose scoe includes all he rocedures or usin a se of local names whose scoes include only individual rocedures. MoPPA uses informaion colleced from a roram o deermine he kind of name ha i uses o idenify a memory locaion in a rocedure. We consider lobal variables, local variables, and hea-allocaed memory locaions. For each lobal variable accessed wihin a rocedure P, MoPPA deermines wheher is only accessed usin is address ha is assed ino P hrouh formal arameers. If his is he case, MoPPA uses an auxiliary arameer o idenify in P. For examle, MoPPA uses auxiliary arameer nv o idenify x in foo() in Fiure 1(a). However, if is accessed usin is variable name or usin an address ha is assed ino P hrouh lobal oiners, hen MoPPA uses s variable name as he quasi-lobal name o idenify in P (e.., x in main() in Fiure 1(a)). This quasi-lobal name is also used o idenify in P s direc or indirec callers. For a local variable l ha is declared in P, if l canno be accessed hrouh dereferences of lobal oiners in he roram, MoPPA uses l s variable name as a local name o idenify l in P. In any oher rocedure where l may be accessed, MoPPA uses an auxiliary arameer o idenify l. However, if l can be accessed hrouh dereferences of lobal oiners in he roram, hen MoPPA idenifies l usin a echnique ha is similar o he one used o idenify a lobal variable. In P or in a rocedure where l s address may be assed ino he rocedure hrouh lobal oiners or dereferences of lobal oiners, MoPPA uses l s variable name as a quasi-lobal name o idenify l. In a rocedure where l s address is assed ino he rocedure only hrouh formal arameers or dereferences of formal arameers, MoPPA uses an auxiliary arameer o idenify l. In eneral, MoPPA uses he followin rules o deermine he scoe of a quasi-lobal name N: Rule 1. If N is he variable name of a lobal variable and N synacically aears in a rocedure P, hen N s scoe includes P. Rule 2. If he memory locaion idenified by N is oined o by he memory locaion idenified by anoher quasi-lobal name N 1 accordin o he lobal oins-o rah, and N 1 s scoe includes a rocedure P, hen N s scoe includes P. Rule 3. If N s scoe includes a rocedure P, hen N s scoe includes all he rocedures ha call P. Rule 1 considers lobal variables. Rule 2 deermines wheher he address of a memory locaion can be assed ino a rocedure hrouh lobal oiners or dereferences of lobal oiners. Rule 3 accouns for he fac ha P is a ar of is callers. These rules can be efficienly evaluaed by MoPPA. MoPPA uses a local name, an auxiliary arameer, or a quasi-lobal name o idenify a memory locaion ha is allocaed on he hea wihin a rocedure P. Suose ha a saemen s in P allocaes memory locaions on he hea. We consider hree cases. In he firs case, he addresses of hese memory locaions are no reurned o P s callers. In his case, hese memory locaions can be accessed only wihin P. MoPPA idenifies hese memory locaions usin an auxiliary local name whose scoe includes only P. In he second case, he addresses of hese memory locaions may be reurned o P s callers hrouh he reurn value or dereferences of formal arameers, bu no hrouh lobal oiners or dereferences of lobal oiners. MoPPA uses an auxiliary arameer o idenify hese memory locaions in P. MoPPA also creaes names, usin similar rules, o idenify hese memory locaions in P s callers. Because differen names may be creaed o idenify he memory locaions reurned by P a differen callsies, MoPPA can disinuish, in P s callers, he memory locaions allocaed a s under differen callin conexs. In he hird case, he addresses of hese memory locaions may be reurned o P s callers hrouh lobal oiners or dereferences of lobal oiners. MoPPA inroduces a quasi-lobal name o idenify hese memory locaions. Accordin o Rule 3, his name will be used in all callers of P. Therefore, in his case, MoPPA does no disinuish memory locaions allocaed a s under differen callin conexs. For examle, consider he oins-o rahs (Fiure 3(d)) comued by MoPPA for Proram 3 in Fiure 3(a). Le loc be he memory locaion allocaed a saemen 14. In G alloc(), he oins-o rah for alloc(), MoPPA uses auxiliary arameer nv2 o idenify loc. Tha loc is reurned o alloc() s callers only hrouh f is he basis for his namin decision. When loc is reurned o e() a saemen 3

4 (a) Proram 2: wih recursion hd nv2 nv4 yedef sruc L{ sruc L nex; } Lis; nex l nv1 nex nex G P() nv3 G GO() (b) wihou k limiin Parameer bindin a c1 P(Lis l,in ln) { Lis hd; hd.nex=l; c1: GO(&hd,ln); } hd nv2 nex nex G P() GO(Lis,in ln) { if(ln<0) reurn; c2: P(,ln 1); } l nv1 nex (c) wih k limiin (k=1) Parameer bindin a c2 G GO() Fiure 2: Problem wih recursion and is soluion. 10, MoPPA idenifies loc usin a quasi-lobal name h. Tha loc may be reurned o e() s callers no only hrouh he reurn value, bu also hrouh lobal oiner, is he basis for his namin decision. When loc is reurned o main() a saemen 3, MoPPA idenifies loc usin an auxiliary local name lh. Tha loc canno be reurned o main() s callers is he basis for his namin decision. Comared o he oinso rahs (Fiure 3(e)) consruced by FICS, we can see ha MoPPA comues more recise oiner informaion. 2.3 Handin Recursion In he resence of recursive daa srucures, MoPPA may inroduce an infinie number of auxiliary arameers in rocedures involved in recursion. For examle, MoPPA kees enerain auxiliary arameers o idenify he memory locaions in a linked-lis in consrucion of he oins-o rahs (G P(), G GO() in Fiure 2(b)) for P() and GO() in Fiure 2(a). The same roblem occurs wih oher alorihms [7, 19]. MoPPA solves his roblem usin a varian of k-limiin [11]. The varian considers simle ahs 1 ha conain susicious nodes nodes associaed only wih auxiliary arameers. The varian limis he number of consecuive susicious nodes on a simle ah o k (MoPPA inores field nodes when i looks for consecuive susicious nodes). When MoPPA rocesses a recursive call, if i needs o add a susicious node, i checks he resricion. If addin he new node would creae a simle ah conainin more han k consecuive susicious nodes, MoPPA searches, on he ah, for an exisin susicious node ha reresens memory locaions whose yes overla he yes of he memory locaions reresened by he new node. If MoPPA finds such a node, i uses his node. Oherwise, i uses a new node. For examle, when MoPPA binds nv2 o GO() a callsie c1 in P() (Fiure 2(a)), i aems o add a new susicious node in G GO(). Addin such a node creaes a simle ah ha conains wo consecuive susicious nodes. Thus, if k is 1, MoPPA reuses he node ha is associaed wih nv1 and binds nv2 o nv1. Fiure 2(c) shows he resulin oins-o rahs. 1 A simle ah does no conain wo idenical nodes. 3. COMPUTATION OF PARAMETERIZED POINTS-TO GRAPHS This secion firs inroduces some definiions, and hen ives an overview of MoPPA. 3.1 Definiions Memory locaions in a roram are accessed hrouh objec names, each of which consiss of a variable and a ossibly emy sequence of dereferences and field accesses [12]. Objec name N 1 is exended from objec name N 2 if N 1 can be consruced by alyin a ossibly emy sequence of dereferences and field accesses ω o N 2; in his case, we denoe N 1 as E ω N 2. For examle, suose ha is a oiner ha oins o a sruc wih field a in a C roram. Then E is, E is, and E.a is ( ).a. Given an objec name N, if N is of oiner ye, hen he oins-o node of N in a oins-o rah G is he node ha reresens he memory locaions ha may be oined o by N. To find N s oins-o node in G, an alorihm firs locaes or creaes, in G, a node n 0 ha reresens he variable in N. The alorihm hen locaes or creaes a sequence of nodes n i and edes e i, 1 i k, so ha n 0, e 1, n 1,..., e k, n k is a ah in G, he labels of e 1,..., e k 1 mach he sequence of dereferences and field accesses in N, and e k is a oins-o ede. N s oins-o node is n k. 3.2 Overview of MoPPA In addiion o comuin he oins-o rahs, MoPPA also comues, in various hases, he se of quasi-lobal names whose scoes may include a rocedure P accordin o Rules 1 3 in Secion 2. MoPPA uses his informaion o deermine he kind of name ha i uses o idenify a memory locaion in P. To comue his informaion, MoPPA firs collecs he lobal variable names ha synacically aear in P or in rocedures direcly or indirecly called by P. Accordin o Rules 1 and 3, he scoes of hese names include P. MoPPA hen searches, beinnin from he nodes associaed wih he lobal variable names comued for P, for all reachable nodes in G lob. The names associaed wih hese nodes idenify he memory locaions whose addresses may be assed ino P hrouh lobal oiners or dereferences of lobal oiners. Accordin o Rule 2, he scoes of hese names include P. MoPPA comues he oins-o rahs for a roram in hree hases (Fiure 4). In each hase, MoPPA erforms wo asks. The firs ask deecs each air of objec names ha may oin o common memory locaions. MoPPA meres he oins-o nodes of hese wo objec names in a oins-o rah o ensure ha each common memory locaion oined o by hese wo objec names is reresened by only one node. This merin oeraion is a varian of he join in Seensaard s alorihm [17]. The second ask deermines he memory locaions reresened by each node in he oins-o rahs. MoPPA icks aroriae names o idenify hese memory locaions a he node. We discuss how hese wo asks are erformed in each hase Firs hase: Lines 1 8 In he firs hase, MoPPA rocesses each oiner assinmen lhs = rhs in each rocedure P o build P s oins-o rah G P. If rhs is an objec name, hen MoPPA meres he oins-o nodes of lhs and rhs in G P o caure he fac ha lhs and rhs oin o he same memory locaion 4

5 (a) Proram 3 G lob h,a[] h,a[] a[] G main() G lob G main() Bindin a 10: nv1 o, nv2 o a[] and h. h,a[] G lob 1 main() { 2 char,q; 3 alloc(&); 4 q =e(); 5 =a; 6 } (b) Afer firs hase (c) Afer second hase q h,a[] (d) Resul of MoPPA G (e) Resul of FICS q main() q h,a[] q h,a[] G main() 7 char e() { 8 char =&; 9 if(==null) 10 alloc(); 11 reurn ; 12 } lh h Ge() e e h,a[] f G alloc() Ge() G alloc() Bindin a 3: nv1 o, nv2 o lh. G e() Ge() 13 alloc(char f) { 14 f=malloc(4); 15 } 16 char,a[4]; e h,a[] e G f alloc() f nv1 nv2 f, h,a[] G alloc() Fiure 3: Proram 3 and is oins-o rahs. afer his assinmen (line 3). If rhs is an address-akin exression &x, hen MoPPA adds variable name x o he oins-o node of lhs in G P o indicae ha lhs oins o he memory locaion for x afer he assinmen (line 4). If rhs is a call o a memory allocaion funcion, MoPPA ses a boolean fla HasHea for he oins-o node of lhs in G P (line 5). HasHea of a node is used o indicae ha he node reresens a hea-allocaed memory locaion whose name has no ye been deermined by MoPPA. In various hases of he alorihm, when wo nodes N 1 and N 2 are mered, if HasHea of N 1 or N 2 is se, hen HasHea of he resulin node will be se. In he firs hase, MoPPA inroduces a variable o reresen he reurn value of each funcion and reas a reurn saemen as an assinmen. For examle, MoPPA inroduces e o reresen he reurn value of funcion e() in Fiure 3(a), and reas reurn saemen 11 as assinmen e=. In he firs hase, MoPPA also collecs he lobal variable names ha synacically aear in P (line 8). Fiure 3(b) shows he oins-o rahs consruced by MoPPA durin his hase for Proram 3 in Fiure 3(a). A solid node in he rahs indicaes ha HasHea of his node is se Second hase: Lines 9 30 In he second hase, MoPPA rocesses he callsies in each rocedure P o consider he effecs, on G P, of he rocedures Alorihm inu ouu declare funcion MoPPA P: he roram o be analyzed a se of oins-o rahs GV ars[p ]: lobal variable names colleced for P A c(f): reurn he acual arameer bound o f a c lobals(g): reurn he lobal variable names in G bein MoPPA / Firs hase (lines 1 8) / 1. foreach oiner assinmen lhs = rhs in each rocedure P do 2. case rhs do 3. objec name: mere oins-o nodes of lhs and rhs in G P 4. &x : add x o he oins-o node of lhs in G P 5. malloc(): se HasHea of lhs s oins-o node in G P 6. endcase 7. endfor 8. add lobal variable names in each rocedure P o GV ars[p ] / Second hase (lines 9 30) / 9. add all rocedures in P o workliss W 1 and W while W 1 φ do / W 1: sored in reversed ooloical order/ 11. remove P from he head of W foreach callsie c o Q in P do 13. BindFromCallee(G Q,lobals(G Q),G P,c) 14. foreach oins-o node N of E ω f in G Q where f is a formal arameer do 15. coy names from N o E ω A c(f) s oins-o node in G P 16. if HasHea of N is se hen 17. se HasHea of E ω A c(f) s oins-o node in G P 18. endfor 19. endfor 20. BindToGlobal(G P,lobals (G P ),G lob) 21. foreach oins-o node N of E ω in G P, is lobal do 22. coy names from N o oins-o node of E ω in G lob 23. if HasHea of N is se hen 24. rese HasHea of N add a new name o N 25. add he new name o E ω s oins-o node in G lob 26. endif 27. endfor 28. add rocedures callin P o W 1 if G P is udaed 29. endwhile 30. comue GV ars[p ] for each rocedure P from P s callees / Third hase (lines 31 55) / 31. foreach rocedure P do 32. comue he quasi-lobal names whose scoes include P 33. while W 2 φ do / W 2: sored in ooloical order / 34. remove P from he head of W foreach callsie c o P in P do 36. BindFromCaller(G P,c,G P ) 37. foreach name n in oins-o node of E ω a in G P and a is acual arameer bound o f a c do 38. if n is quasi-lobal name whose scoe includes P hen 39. add n o E ω f s oins-o node in G P 40. elseif no auxil arameer a E ω f s oins-o node in G P 41. creae a auxil arameer a E ω f s oins-o node in G P 42. endif 43. endfor 44. endfor 45. BindFromGlobal(G lob,lobals (G P ),G P ) 46. foreach name n in E ω s oins-o node in G lob where is lobal oiner aeared in G P do 47. add n o E ω s oins-o node in G P 48. foreach node N whose HasHea is se in G P do 49. rese HasHea 50. if no auxiliary arameer associaed wih N hen 51. add a new local name o N 52. endfor 53. add he rocedures called by P o W 2 if G P is udaed 54. endwhile 55. foreach callsie c do comue bindin informaion endfor end MoPPA Fiure 4: MoPPA alorihm. called by P. Le c be a callsie in P and Q be he rocedure ha c invokes. MoPPA firs calls BindFromCallee() o deec airs of arameer-relaed objec names ha may oin o he same memory locaions (line 13). BindFromCallee() searches in G Q for objec names E ω1 and E ω2 q ha oin o he same node. If and q are formal arameers bound o a 1 and a 2 resecively a c, hen afer c is execued, 5

6 E ω1 a 1 and E ω2 a 2 may oin o common memory locaions. Thus, BindFromCallee() meres he oins-o nodes of E ω1 a 1 and E ω2 a 2 in G P. If is a formal arameer bound o a a c and q is a lobal variable, hen afer c is execued, E ω1 a and E ω2 q may oin o common memory locaions. Thus, BindFromCallee() meres he oinso nodes of E ω1 a and E ω2 q in G P. For examle, when MoPPA rocesses saemen 4 in Fiure 3(a), i meres he oins-o nodes of q and in G main() because G e() shows ha e and oin o he same node (MoPPA reas reurn value e as a formal arameer). MoPPA also deermines he memory locaions whose addresses may be reurned o P a callsie c (lines 14 18). If G Q shows ha a name x is associaed wih he oins-o node of E ω f, in which f is a formal arameer bound o a a c, hen, afer c is execued, E ω a may oin o he memory locaions idenified by x. MoPPA adds x o he oins-o node of E ω a in G P (line 15). If HasHea of he oins-o node of E ω f is se, hen afer c is execued, E ω a may oin o memory locaions ha are allocaed from he hea in Q. Thus, MoPPA ses HasHea of he oins-o node of E ω a (line 17). For examle, when MoPPA rocesses saemen 3 in Fiure 3(a), i ses HasHea of he oins-o node of in G main() because G alloc() shows ha HasHea of he oins-o node of f is se. In he second hase, MoPPA also consrucs he lobal oins-o rah G lob usin informaion in G P (lines 20 27). MoPPA calls BindToGlobal() o search in G P for objec names E ω1 1 and E ω2 2, where 1 and 2 are lobal variables ha oin o he same node. BindToGlobal() meres he oins-o nodes of E ω1 1 and E ω2 2 in G lob o indicae ha E ω1 1 and E ω2 2 oin o he same memory locaions. MoPPA also deermines he memory locaions ha may be oined o by objec names exended from lobal variables (lines 21 27). Le be a lobal variable. If G P shows ha x is associaed wih he oins-o node of E ω, hen when P is execued, E ω may oin o he memory locaion idenified by x. MoPPA adds x o he oins-o node of E ω in G lob o caure his informaion (line 22). If G P shows ha HasHea of he oins-o node of E ω is se, hen when P is execued, E ω may oin o a memory locaion allocaed in P. MoPPA creaes a new quasilobal name o idenify his memory locaion, and adds his name o he oins-o node of E ω in boh G P and G lob. MoPPA also reses HasHea of he oins-o node of E ω in G P o indicae ha he hea-allocaed memory locaion has been assined a name. For examle, when MoPPA rocesses e() in Fiure 3(a) in he second hase, i finds ha HasHea of he oins-o node of is se. Thus, he alorihm creaes a name h, and adds his name o he oins-o node of boh in G e() and in G lob. The alorihm also reses HasHea of s oins-o node in G e(). In he second hase, MoPPA furher comues he se of lobal variable names ha aear synacically in rocedure P (line 30). In his hase, MoPPA rocesses he rocedures in a reverse ooloical (boom-u) order on he sronlyconneced comonens of he call rah. Wihin a sronlyconneced comonen, MoPPA ieraes over he rocedures unil he oins-o rah comued for each rocedure sabilizes. Fiure 3(c) shows he oins-o rahs consruced for Proram 3 in Fiure 3(a) afer his hase Third hase: Lines In he hird hase, MoPPA rocesses each rocedure P o deermine he memory locaions reresened by each node in G P and assins aroriae names o idenify hese memory locaions. MoPPA comlees his ask in four ses. Firs, MoPPA comues, by usin G lob and he se of lobal variable names comued for P in he firs wo hases, he se of quasi-lobal names whose scoes include P (lines 31 32). Second, MoPPA rocesses each callsie c ha calls P o caure he oiner informaion inroduced by arameer bindins. Le P be he rocedure ha conains c. MoPPA firs calls BindFromCaller() o deec airs of objec names ha are exended from acual arameers a c and may oin o he same node in G P (line 36). If BindFromCaller() finds ha E ω1 a 1 and E ω2 a 2, in which a 1 and a 2 are bound o f 1 and f 2 resecively a c, may oin o he same node in G P, i meres he oins-o nodes of E ω1 f 1 and E ω2 f 2 in G P. MoPPA also deermines he memory locaions ha may be oined o by objec names exended from formal arameers (lines 37 43). Le a be an acual arameer ha is bound o formal arameer f a c. If G P shows ha name n is associaed wih he oins o node of E ω a, hen when P is invoked a c, E ω f may oin o he memory locaions idenified by n a P s enry. If n is a quasi-lobal name whose scoe includes P, hen MoPPA adds n o he oinso node of E ω f in G P. Oherwise, MoPPA checks o see if here is an auxiliary arameer associaed wih he oinso node of E ω f in G P. If no auxiliary arameer exiss, hen MoPPA creaes a new auxiliary arameer and adds his auxiliary arameer o his node. For examle, when MoPPA rocesses he callsie o alloc() a saemen 10 in Fiure 3(a), i finds ha may oin o. Because s scoe does no include alloc(), MoPPA inroduces auxiliary arameer nv1 o idenify his memory locaion and adds nv1 o he oins-o node of f in G alloc(). Noe ha in he hird hase, if wo nodes N 1 and N 2 are mered, a mos one auxiliary arameer is ke in he resulin node. Third, MoPPA furher deermines, by examinin G lob, he memory locaions ha may be reresened by each node in G P (lines 45 47). Le 1 and 2 be lobal variables ha aear in G P (i.e., 1, 2 lobals(g P)). MoPPA calls BindFromGlobal() o search, in G lob, objec names E ω1 1 and E ω1 1 ha oin o he same node. BindFromGlobal() meres he oins-o nodes of E ω1 1 and E ω1 1 in G P. Le be a lobal variable ha aear in G P. If G lob shows ha name n is associaed wih he oins-o node of E ω, hen MoPPA adds n o he oins-o node of E ω in G P. Fourh, MoPPA assins names for he unnamed heaallocaed memory locaions reresened by nodes in G P (lines 48 52). MoPPA examines, in G P, each node N whose HasHea is se. If an auxiliary arameer aux is associaed wih N, hen N is oined o by an objec name exended from formal arameers. Therefore, he hea-allocaed memory locaions reresened by N may be reurned o P s callers. MoPPA reuses aux o idenify hese memory locaions. However, if no auxiliary arameer is associaed wih N, hen hese hea-allocaed memory locaions are no reurned o P s callers. MoPPA creaes a new local name and add his name o N o idenify hese hea-allocaed memory locaions. In boh cases, MoPPA reses HasHea of N. For examle, when MoPPA examines G alloc(), he oins-o rah for alloc() in Fiure 3(a), i discovers ha HasHea of he oins-o node of f is se and an auxiliary arameer nv2 is 6

7 associaed wih his node. Therefore, i reuses nv2 o idenify he hea-allocaed memory locaions reresened by his node. However, when MoPPA examines G main(), i discovers ha HasHea of he oins-o node of is se bu no auxiliary arameer is associaed wih his node. Therefore, i creaes a local name lh o idenify he hea-allocaed memory locaions reresened by his node (Fiure 3(d)). In he hird hase, MoPPA rocesses he rocedures in a ooloical (o-down) order on he sronly-conneced comonens of he call rah. Wihin a sronly-conneced comonen, MoPPA ieraes over he rocedures unil he oins-o rah for each rocedure sabilizes. Afer all he oins-o rahs sabilize, MoPPA rocesses each callsie c o comue he bindin informaion beween he names in he rocedure conainin c and he auxiliary arameers in he called rocedure (line 55). This se can be done ondemand when he oiner informaion is used. Fiure 3(d) shows he oins-o rahs ha MoPPA comues for Proram 3. Comared o he oins-o rahs (Fiure 3(e)) consruced by FICS for his roram, we can see ha MoPPA comues more comac and more recise oiner informaion han FICS. 3.3 Comlexiy of MoPPA Le be he number of rocedures in a roram P, c be he number of callsies in P, and S be he wors-case acual size of he oins-o rah for a rocedure. Wihou considerin he cos of line 8 and lines 30 32, he ime comlexiy of MoPPA is he same as he ime comlexiy of FICS, which is O(N S α(n S, S)) [13], iven ha α is he inverse Ackermann funcion, N is (c + ) in he absence of recursion, and N is (c + ) S in he resence of recursion. The ses aken a lines 8 and 30 are very similar o hose aken in he comuaion of modificaion side-effecs for he rocedures. Therefore, he ime aken by hese wo lines is O(n 2 ). Line 32 can be done by firs main he names in GV ars[p ] o he nodes in G lob, and hen searchin in G lob beinnin from hese nodes. Therefore, he ime aken by his line is O(n + S lob), where S lob is he size G lob. Thus, he ime comlexiy of MoPPA is O( (n + S lob) + n 2 + N S α(n S, S)). Wih he assumion ha S lob is O(n), he ime comlexiy can be simlified o O(n 2 + N S α(n S, S)). 3.4 Handlin Indirec Calls Because he comlee call rah for a roram ha conains indirec calls hrouh funcion oiners is no direcly available, MoPPA may encouner difficulies in analyzin such a roram. There are wo ossible soluions. The firs soluion uses he call rah comued by anoher alorihm. For examle, we can consruc he call rah for a roram by resolvin indirec calls usin oiner informaion rovided by Seensaard s alorihm. We can furher refine he resul usin funcion rooyes [2]. The second soluion beins he analysis wih a arial call rah, and comues he comlee call rah durin he analysis. This aroach requires ieraions beween he boom-u hase and he o-down hase [4]. To use he second aroach, MoPPA kees an exra shadow oins-o rah G P for each rocedure P. 2 MoPPA uses G P o searae he summary informaion abou P from he oiner 2 G P may be eliminaed if MoPPA can deermine he rocedures ha are direcly or indirecly called by P. Subjec Size Time roram LOC Nodes Procs T M T F dixie learn diff assembler smail lharc simulaor flex rolo sace bison sim mlay esresso moria wmc Table 1: Lef: Sizes of he subjec rorams. Rih: Time in seconds for MoPPA (T M ) and FICS (T F ). informaion comued for P. In he firs hase, MoPPA comues he oiner informaion and us he informaion in boh G P and G P. In he second hase when MoPPA rocesses a callsie c o Q in P, i uses G Q o udae boh G P and G P. In he second hase when MoPPA comues he lobal oins-o rah, i uses he shadow oins-o rahs. In he hird hase, MoPPA uses only he normal oins-o rahs for he rocedures. Before comuin he bindin informaion for each callsie a he end of his hase, MoPPA firs examines each indirec call. If MoPPA discovers new callees, i exands he call rah and reeas he second and hird hases sarin only from he rocedures ha mih be affeced. Oherwise, he alorihm comues he bindin informaion and erminaes. 4. EMPIRICAL STUDIES We have imlemened a rooye of MoPPA usin he PROLANGS Analysis Framework (PAF) [9]. Our rooye handles funcion oiners usin he firs aroach discussed in Secion 3.3. We have also erformed several emirical sudies o evaluae he erformance of MoPPA and he effeciveness of usin he arameerized oiner informaion rovided by MoPPA in roram analyses. We colleced he daa for he sudies on a Sun Ulra 30 worksaion wih 640MB of hysical memory. To allow he alorihm o caure he oiner informaion inroduced by calls o library funcions, we creaed a se of subs ha simulae hese funcions. A similar aroach usin subs has been used in oher rooyes (e.. [12, 13]). The lef side of Table 1 shows he subjec rorams we used. Column LOC shows he number of lines of code, column Nodes shows he number of conrol flow rah nodes creaed o reresen each roram, and column Procs shows he number of rocedures. These subjec rorams have also been used in many oher sudies [12, 13, 15]. 4.1 Sudy 1 The oal of his sudy is o evaluae he erformance of MoPPA. To invesiae he ime efficiency of MoPPA, we comare he ime required o run MoPPA and he ime required o run FICS on each subjec roram. The rih side 7

8 # of hea # of flow deendences roram Mo FI Mo FI Reduce dixie % learn % diff % assembler % smail % lharc % simulaor % flex % rolo % sace % bison % sim % mlay % esresso % moria % wmc % sim conains wo lare rocedures wih over 1000 nodes. Wihou considerin hese wo rocedures, he resul for MoPPA is 2.83, and he resul for FICS is Table 2: Lef: Number of disinc hea-allocaed memory locaions. Rih: Averae number of flow deendences for a saemen. (T M, T F ) of Table 1 shows he comarison. The able shows ha, on he rorams we sudied, alhouh MoPPA can be 2 o 3 imes slower han FICS, i is sill very efficien for all rorams. This resuls sues ha MoPPA will scale o lare rorams as well as FICS. In he sudy, we also invesiae he effeciveness of MoPPA in disinuishin memory locaions allocaed on he hea in a rocedure when he rocedure is invoked under differen callsies. The lef side of able 2 comares he number of disinuishable hea-allocaed memory locaions when he oiner informaion is comued by MoPPA or FICS. Two memory locaions are no disinuishable if hey are are always used in he same way in a roram. Column Mo shows he resuls for MoPPA and column F I shows he resuls for FICS. The able shows ha, for several rorams, MoPPA idenifies many more disinuishable hea-allocaed memory locaions han FICS. These resuls sues ha usin oiner informaion rovided by MoPPA may hel a roram analysis comue more recise informaion. 4.2 Sudy 2 The oal of his sudy is o evaluae he imac of usin oiner informaion rovided by MoPPA and FICS on he comuaion of flow deendence, one variey of daa deendence, wihin a rocedure. A saemen s 1 is flow-deenden on anoher saemen s 2 if s 1 may use he value se by s 2. Flow deendence has been used in imoran asks such as roram oimizaion and roram undersandin. In his sudy, we comued he averae number of saemens on which a saemen is flow-deenden. For each callsie, we use is side-effecs o comue he flow deendences. The rih side of able 2 shows he resuls of his sudy when he oiner informaion is rovided by MoPPA (Mo) or FICS (F I). The able also shows he ercenae of surious flow deendences (Reduce) ha can be eliminaed by usin oiner informaion rovided by MoPPA. The able shows ha, for several rorams (e.., smail), usin oiner informaion rovided by MoPPA can sinificanly (> 10%) Size Time roram Mo FI Reduce Mo FI dixie % learn % diff % assembler % smail % lharc % simulaor % flex % rolo % sace % bison % sim mlay % esresso % moria wmc % Daa are colleced on one daa slice. Daa are unavailable because he sysem does no erminae wihin he ime limi (10 hours) we se. Table 3: Lef: averae size of a daa slice, Rih: averae ime in seconds o comue a daa slice. reduce he surious flow deendences. Thus, on hese rorams, usin oiner informaion rovided by MoPPA may sinificanly imrove he recision of he roram analyses ha require daa-flow informaion. Noe ha, for oher rorams (e.., lharc) on which he reducion in flow deendences is insinifican, usin oiner informaion rovided by MoPPA may sill imrove he recision of roram analyses on hese rorams by reducin he surious informaion roaaed across rocedure boundaries. 4.3 Sudy 3 The oal of his sudy is o evaluae he imac of usin oiner informaion rovided by MoPPA or FICS on he recision and he efficiency of roram analyses ha require ransiive inerrocedural flow deendence. The sudy consiss of wo ars. The firs ar of he sudy considers he imac on he comuaion of ransiive flow deendence. We measure he averae number of saemens ha can ransiively affec a secific saemen s hrouh flow deendence. For convenience, we refer o hese se of saemen as he daa slice wih resec o s. We also measure he averae ime o comue a daa slice. These measuremens can serve as an indicaor o he imac of usin such oiner informaion on roram analyses ha require ransiive inerrocedural flow deendence. Table 3 shows hese wo measuremens we obain when he oiner informaion is rovided by MoPPA (Mo) or FICS (F I). The able also shows he reducion in he size of a daa slice (Reduce) when he oiner informaion is rovided by MoPPA insead of FICS. We obain he daa by runnin a modified version of our reuse-driven slicer [14] on each subjec. The able shows ha, for many rorams we sudied (e.., smail), usin oiner informaion rovided by MoPPA can sinificanly imrove he recision and he efficiency of he comuaion of ransiive flow deendence. The second ar of he sudy considers he imac of usin oiner informaion rovided by MoPPA or FICS on roram slicin [18], a roram analysis ha requires ransiive flow deendences. We measure he averae size of a 8

9 Size Time roram Mo FI Reduce Mo FI dixie % learn % diff % assembler % smail % lharc % simulaor % flex % rolo % sace % bison % sim mlay % esresso % moria wmc % Daa are colleced on one roram slice. Daa are unavailable because he sysem does no erminae wihin he ime limi (10 hours) we se. Table 4: Lef: Averae size of a roram slice, Rih: Averae ime in seconds o comue a roram slice. roram slice and he averae ime o comue a roram slice. Table 4 shows hese wo measuremens obained in he sudy when he oiner informaion is rovided by MoPPA (Mo) or (F I). The able also shows he reducion in he size of a roram slice (Reduce) when he oiner informaion is rovided by MoPPA insead of FICS. We obain he daa by runnin our reuse-driven roram slicer on each subjec. The able shows ha, for many rorams ha we sudied (e.., smail), usin oiner informaion rovided by MoPPA can sinificanly imrove he recision and he efficiency. By considerin he resuls of boh ars of he sudy, we can conclude ha usin arameerized oiner informaion rovided by MoPPA may sinificanly imrove he recision and efficiency of many roram analyses. 5. RELATED WORK Several oher exisin oiner analysis alorihms use a modular aroach for comuin oiner informaion. One such alorihm is Chaerjee, Ryder, and Landi s Relevan Conex Inference (RCI) [3]. Like FICS and MoPPA, RCI firs uses a boom-u hase o consider he effec of a rocedure on each callsie ha calls his rocedure. RCI hen uses a o-down hase o comue he memory locaions whose addresses may be assed ino a rocedure. RCI differs from MoPPA in wo ways. Firs, RCI comues non-arameerized oiner informaion. RCI uses unknown iniial values for arameers and lobals a he enry of a rocedure. A firs lance, hese unknown iniial values seem o serve he same urose as auxiliary arameers. However, because unknown iniial values are creaed before he oiner informaion is comued a he callsies, wo unknown iniial values may reresen he address of he same memory locaion under a callin conex. Therefore, in he final oiner soluion, hese unknown iniial values mus be relaced wih concree values. 3 Second, RCI comues 3 The same arumen alies o non-visible variables used in Landi and Ryder s alorihm [12]. oiner informaion usin a flow-sensiive aroach. Because roaain informaion usin flow-sensiive aroach is exensive, RCI may no scale o lare rorams. Anoher modular oiner analysis alorihm is Chen and Hwu s alorihm [4]. Like MoPPA, Chen and Hwu s alorihm is flow-insensiive. Unlike MoPPA and many oher alorihms ha use exacly one name o idenify each memory locaion a a saemen, Chen and Hwu s alorihm uses access ahs 4 o idenify each memory locaion. One way ha MoPPA disinuishes iself from Chen and Hwu s alorihm is efficiency. We comare hese wo alorihms in hree asecs. Firs, Chen and Hwu s alorihm mus roaae oiner informaion for lobal oiners from rocedure o rocedure. In conras, MoPPA uses a lobal oins-o rah o caure he oiner informaion for he lobal oiners. Therefore, MoPPA roaaes less informaion across rocedure boundaries han Chen and Hwu s alorihm. Second, in he inrarocedural hase, Chen and Hwu s alorihm mus ierae over he oiner assinmens wihin a rocedure in a way similar o ha used in Andersen s alorihm [1]. In conras, MoPPA rocesses each rocedure in he inrarocedural hase usin an aroach similar o Seensaard s alorihm [17], which rocesses each oiner assinmen only once. Third, in he inerrocedural hases, Chen and Hwu s alorihm mus ierae over he oins-o relaions comued for a rocedure when he alorihm discovers a new oins-o relaion. In conras, MoPPA may mere wo nodes or add a name o a node when i discovers a new oins-o relaion. Therefore, MoPPA is more efficien han Chen and Hwu s alorihm. Anoher way ha MoPPA disinuishes iself from Chen and Hwu s alorihm is he suor for inerrocedural roram analyses ha use he oiner informaion. Similar o auxiliary arameers, access ahs used in Chen and Hwu s alorihm can idenify differen memory locaions in a rocedure when he rocedure is invoked a differen callsies. However, because one memory locaion mih be idenified by several access ahs in oiner informaion rovided by Chen and Hwu s alorihm, a roram analysis usin his oiner informaion may have o roaae more informaion across rocedure boundaries han usin oiner informaion rovided by MoPPA. In addiion, main an access ah from a called rocedure o a callin rocedure is more exensive han main an auxiliary arameer. Therefore, usin he informaion rovided by Chen and Hwu s alorihm in roram analyses may be less efficien han usin he informaion rovided by MoPPA. Foser, Fahndrich, and Aiken roosed a olymorhic flowinsensiive oins-o analysis framework ha comues oiner informaion by solvin a se of consrains [8]. This framework also consiss of a boom-u hase and a o-down hase o roaae informaion. When his framework uses erm consrain, he resulin alorihm is very similar o FICS. This framework differs from MoPPA in ha i comues non-arameerized oiner informaion. Sudies show ha heir curren imlemenaion of he framework may no scale o lare rorams [8]. Some exisin oiner analysis alorihms [3, 12] rovide condiional oiner informaion, in which a oins-o relaion may be associaed wih a condiion ha secifies he callin conexs under which his relaion may hold. Al- 4 An access ah is similar o an objec name defined in his aer. 9

10 houh such condiions may hel a roram analysis reduce he amoun of surious informaion roaaed across rocedure boundaries [15], addin condiions o he oins-o relaions may increase he comlexiy of he oiner analysis. Sudies show ha exisin alorihms ha rovide condiional oiner informaion may no scale o lare rorams [3, 12]. 6. CONCLUSION This aer resens MoPPA, a modular alorihm ha comues arameerized oiner informaion for C rorams. The aer also resens a se of emirical sudies ha comare MoPPA wih FICS. The emirical resuls show ha boh MoPPA and FICS can efficienly comue oiner informaion for rorams. The emirical resuls also show ha usin oiner informaion rovided by MoPPA can sinificanly imrove boh he recision and he efficiency of many roram analyses. Due o sace limiaion, his aer does no resen he deails of handlin memory accesses usin knowlede of he hysical layou of a srucure. Several exisin aroaches (e.., [20]) can be incororaed ino MoPPA o handle such accesses. Our fuure work will include invesiaion of he imac of differen aroaches on MoPPA. In fuure work, we will also conduc more emirical sudies on larer rorams o invesiae he effeciveness of usin he oiner informaion rovided by MoPPA in various roram analyses. In addiion, we will comare he effeciveness of usin differen aroaches o handle funcion oiners in MoPPA. Acknowledmens This work was suored in ar by NSF under NYI Award CCR and ESS Award CCR o Ohio Sae Universiy, by funds from o Georia Tech hrouh he Yamacraw Mission, and by a ran from Boein Aerosace Cororaion. Alessandro Orso made many helful suesions ha imroved he resenaion of he aer. REFERENCES [1] L. Andersen. Proram analysis and secializaion for he C rorammin lanuae. Technical Reor 94-19, Universiy of Coenhaen, [2] D. C. Akinson and W. G. Griswold. Effecive wholeroram analysis in he resence of oiners. In 6h Inernaional Symosium on he Foundaions of Sofware Enineerin (FSE-98), aes 46 55, Nov [3] R. Chaerjee, B. G. Ryder, and W. A. Landi. Relevan conex inference. In Proceedins of he 26h Symosium on Princiles of rorammin lanuaes, aes , [4] B. Chen and W. Hwu. Modular inerrocedural oiner analysis usin access ahs: desin, imlemenaion, and evaluaion. In Proceedins of 2000 Conference on Prorammin Lanuae Desin and Imlemenaion, aes 57 69, June [5] J.-D. Choi, M. Burke, and P. Carini. Efficien flow-sensiive inerrocedural comuaion of oinerinduced aliases and side effecs. In Conference record of he Twenieh Annual ACM SIGPLAN-SIGACT Symosium on Princiles of Prorammin Lanuaes, aes , [6] M. Das. Unificaion-based oiner analysis wih direcional assinmens. In Proceedins of 2000 Conference on Prorammin Lanuae Desin and Imlemenaion, June [7] M. Emami, R. Ghiya, and L. J. Hendren. Conexsensiive inerrocedural oins-o analysis in he resence of funcion oiners. In Proceedins of 1994 Conference on Prorammin Lanuae Desin and Imlemenaion, aes , June [8] J. S. Foser, M. Fahndrich, and A. Aiken. Polymorhic verus monomorhic flow-insensiive oins-o analysis for c. In Proceedins of 7h Inernaional Saic Analysis Symosium, June [9] P. L. R. Grou. PROLANGS Analysis Framework. h:// Ruers Universiy, [10] M. Hind, M. Burke, P. Carini, and J.-D. Choi. Inerrocedural oiner alias analysis. ACM Transacions on Prorammin Lanuaes and Sysems, 21(4): , July [11] N. Jones and S. Muchnick. Flow analysis and oimizaion of lis-like srucures. In S. Muchnick and N. Jones, ediors, Proram Flow Analysis: Theory and Alicaions, aes [12] W. Landi and B. G. Ryder. A safe aroximae alorihm for inerrocedural oiner aliasin. In Proceedins of he ACM SIGPLAN 92 Conference on Prorammin Lanuae Desin and Imlemenaion, aes , July [13] D. Lian and M. J. Harrold. Efficien oins-o analysis for whole-roram analysis. In Join 7h Euroean Sofware Enineerin Conference and 7h ACM Symosium on Foundaions of Sofware Enineerin, aes , Se [14] D. Lian and M. J. Harrold. Reuse-driven inerrocedural slicin in he resence of oiners and recursion. In Inernaional Conference on Sofware Mainenance, aes , Se [15] H. D. Pande, W. A. Landi, and B. G. Ryder. Inerrocedural def-use associaions for C sysems wih sinle level oiners. IEEE Transacions on Sofware Enineerin, 20(5): , May [16] E. Ruf. Conex-insensiive alias analysis reconsidered. In Proceedins of SIGPLAN 95 Conference on Prorammin Lanuae Desin and Imlemenaion, aes 13 23, June [17] B. Seensaard. Poins-o analysis in almos linear ime. In Conference Record of he 23rd ACM Symosium on Princiles of Prorammin Lanuaes, aes 32 41, Jan [18] M. Weiser. Proram slicin. IEEE Transacions on Sofware Enineerin, 10(4): , July [19] R. P. Wilson and M. S. Lam. Efficien conex-sensiive oiner analysis for C rorams. In Proceedins of SIG- PLAN 95 Conference on Prorammin Lanuae Desin and Imlemenaion, aes 1 12, [20] S. H. Yon, S. Horwiz, and T. Res. Poiner analysis for rorams wih srucures and casin. ACM SIG- PLAN Noices, 34(5):91 103, May