Points-to Analysis in Almost Linear Time
paper by Bjarne Steensgaard
23rd ACM Symposium on Principles of Programming Languages (POPL'96)
Microsoft Research Technical Report MSR-TR-95-08
presented by Jeff Blank
CMSC 858Z Spring 2004
Outline of Talk
•
•
•
•
Background
Source Language
Type System
Inference Algorithm
– Examples
Motivation
• Why this paper?
– and which paper, exactly?
• What type of analysis?
– flow-insensitive, context-insensitive,
interprocedural
Example: Factorial
Source Language
fact = fun(x)->(r)
if lessthan(x 1) then
r=1
else
xminusone = subtract(x 1)
nextfac = fact(xminusone)
r = multiply(x nextfac)
fi
result = fact(10)
S ::= x = y
| x = &y
| x = *y
| x = op(y1. . .yn)
| x = allocate(y)
| *x = y
| x = fun(f1…fn)->(r1…rm) S*
| x1…xm = p(y1…yn)
Non-standard types
 ::=  x 
 ::=  | ref()
 ::=  | lam(1…n)(n+1…n+m)
Typing Rules
• “obvious” vs. with partial order
• (review on sheet)
_ = whatever!
Type Inference System
• imposing the rules = performing points-to analysis
• Algorithm:
– Initialization
• assumptions
• all variables set to different types
– Inference
• impose the rules, i.e. merge types as necessary
• one pass
Example Run
a
a = &x
b = &y
if p then
y = &z;
else
y = &x
fi
c = &y
x,z
b
p
y
c
More Examples
original algorithm
m
i
j
j
=
=
=
=
42
m
m
&n
m
i
j
n
More Examples
improved algorithm
m
i
j
j
=
=
=
=
42
m
m
&n
m
i
j
n
More Examples
improved algorithm (joining with pending set)
m
i
j
m
=
=
=
=
42
m
m
&n
m
i
j
n
Efficiency of system
• O(N(N,N))
–  is inverse Ackermann’s function, cost of find
• Compared to others...
Other comments
• no support for separate types in a composite
object (e.g. a struct)
• is fast
– even on mid-nineties computers
• test data (show graph)