Transcript ppt

Pointer Analysis for
CASH Compiler Framework
Deepak Garg
Himanshu Jain
Spring 2005
Project Goal
• Flow insensitive, context insensitive
Pointer analysis for CASH
• Use a constraint based formulation
• Compare with existing pointer analysis in
CASH
Pointer Analysis
• Possible choices:
– Context sensitive vs. insensitive
– Flow sensitive vs. insensitive
• We choose flow insensitive, context
insensitive analysis
– Scalable
– Results reasonably good
Flow & Context Insensitive Analysis
• Two popular analyses
– Andersen’s analysis (O(n3))
– Steensgaard’s analysis (O(n (n,n)))
• Both create points-to graphs for program
locations
• Andersen’s more accurate (we will
implement this)
Example
a
a
a = &b
b = &c
b
d
b,d
c
e
c,e
a = &d
d = &e
Andersen’s analysis
Steensgaard’s analysis
Using Constraints
• Both analysis can be expressed in
constraint-based frameworks
• High-level idea
– Traverse IR and generate constraints that
express points-to information
– Use constraint solver to solve constraints
Implementing Andersen’s
• Traverse program expressions
• Give each expression e a type  written e:
•  is a set of program locations
• e: means “e may evaluate to address of
any location in ”
Implementing Andersen’s
• Typing rules generate constraints on types
• Example:
Solving the Constraints
• Banshee framework
– General purpose constraint solver for setbased constraints
– Given specification of constraint language,
generates a constraint solver for it
• Can be easily used for Andersen’s analysis
Where we are…
• Know how to use Banshee
• Have read about Andersen’s analysis
• TODO:
– Are studying the existing pointer analysis in
CASH
– Design a constraint generation procedure for
CASH IR
– Interface with Banshee