Fig 4 - uploaded by Yulei Sui
Content may be subject to copyright.
Memory SSA form and sparse value-flows constructed interprocedurally for an example modified from Figure 2 with its four swap instructions moved into a separate function, called swap. 8 and 13 correspond to the FUNENTRY and FUNEXIT of swap.

Memory SSA form and sparse value-flows constructed interprocedurally for an example modified from Figure 2 with its four swap instructions moved into a separate function, called swap. 8 and 13 correspond to the FUNENTRY and FUNEXIT of swap.

Source publication
Article
Full-text available
We present a new demand-driven flow- and context-sensitive pointer analysis with strong updates for C programs, called SUPA, that enables computing points-to information via value-flow refinement, in environments with small time and memory budgets such as IDEs. We formulate SUPA by solving a graph reachability problem on an inter-procedural value-f...

Contexts in source publication

Context 1
... addition, appropriate χ and µ operators are also added for the FUNENTRY and FUNEXIT instructions of these callees in order to mimic passing parameters and returning results for address-taken variables. Figure 4(a) gives an example modified from Figure 3(a) by moving the four swap in- structions into a function, swap. For read side-effects, µpaq and µpcq are added before callsite 7 to represent the potential uses of a and c in swap. ...
Context 2
... that the versions i and j of an SSA variable a in different functions may be different. For example, Figure 4(c) illustrates the four inter-procedural value-flows Figure 3, as Andersen's flow-and context-insensitive pointer analysis is fast but imprecise. However, this representation allows imprecise points-to information to be refined by performing sparse whole-program flow-sensitive pointer analysis as in prior work [Hardekopf and Lin 2011;Nagaraj and Govindarajan 2013;Sui et al. 2016a;Ye et al. 2014b]. ...
Context 3
... the pre-analysis (for com- puting the sparse value-flow graph of the program) is sound, then the def-use chains built for all the address-taken variables are over-approximate. According to its inference rules in Figure 4, SUPA performs essentially a flow-sensitive analysis on-demand, by re- stricting the propagation of points-to information along the precomputed def-use chains, and falls back to the sound points-to information computed by the pre-analysis when running out of its given budgets. Thus, SUPA is sound if the pre-analysis is sound. ...
Context 4
... Figure 14(a) shows the average analysis time per query for all the pro- grams under a given budget, with about 0.18 seconds when B " 10000 and about 2.76 seconds when B " 200000. Both axes are logarithmic. ...

Similar publications

Article
Full-text available
This paper presents a novel approach for motion segmentation by using strategies of splitting and remerging. The presented approach, Mossar, hybridizes two existing ones to obtain their potential advantages while covering weaknesses: (1) velocity-based, one of the most widely used approaches that has fairly low accuracy but provides computational s...
Conference Paper
Full-text available
We address problems underlying the algorithmic question of automating the co-design of robot hardware in tandem with its appo-site software. Specifically, we consider the impact that degradations of a robot's sensor and actuation suites may have on the ability of that robot to complete its tasks. Expanding upon prior work that addresses similar que...