Analyzing Millions of Lines of Code with Sparse Flow-Sensitive Pointer Analysis

Many program analyses perform better and produce more precise results when they are given precise pointer information. One dimension of precision is flow-sensitive pointer analysis (i.e., an analysis that respects a program’s control-flow), which has been shown to be useful for important applications such as program verification and understanding, among others. However, this type of pointer analysis has historically been unable to scale to programs with hundreds of thousands of lines of code. We present a new interprocedural flow-sensitive pointer analysis that has significantly better performance than the current stateof-the-art. There are two key ideas behind our algorithm: (1) We stage the pointer analysis by first running a flow-insensitive auxiliary pointer analysis that produces conservative def-use information; the primary flow-sensitive analysis can then employ a sparse analysis that efficiently propagates pointer information across these conservative def-use chains; and (2) we exploit a novel notion of equivalence called access equivalence, which allows the algorithm to efficiently apply the conservative def-use information for the sparse analysis even when the conservative nature of the auxiliary analysis produces a huge amount of def-use information. Together, these techniques produce the first flow-sensitive pointer analysis that can analyze a C program with 1.9M lines of code, an order of magnitude improvement over the previous state-of-the-art.