Êtes-vous un étudiant de l'EPFL à la recherche d'un projet de semestre?
Travaillez avec nous sur des projets en science des données et en visualisation, et déployez votre projet sous forme d'application sur GraphSearch.
Concept
Pointer analysis
Résumé
In computer science, pointer analysis, or points-to analysis, is a static code analysis technique that establishes which pointers, or heap references, can point to which variables, or storage locations. It is often a component of more complex analyses such as escape analysis. A closely related technique is shape analysis.
This is the most common colloquial use of the term. A secondary use has pointer analysis be the collective name for both points-to analysis, defined as above, and alias analysis. Points-to and alias analysis are closely related but not always equivalent problems.
For the following example program, a points-to analysis would compute that the points-to set of p is {x, y}.
int x;
int y;
int* p = unknown() ? &x : &y;
As a form of static analysis, fully precise pointer analysis can be shown to be undecidable. Most approaches are sound, but range widely in performance and precision. Many design decisions impact both the precision and performance of an analysis; often (but not always) lower precision yields higher performance. These choices include:
Field sensitivity (also known as structure sensitivity): An analysis can either treat each field of a struct or object separately, or merge them.
Array sensitivity: An array-sensitive pointer analysis models each index in an array separately. Other choices include modelling just the first entry separately and the rest together, or merging all array entries.
Context sensitivity or polyvariance: Pointer analyses may qualify points-to information with a summary of the control flow leading to each program point.
Flow sensitivity: An analysis can model the impact of intraprocedural control flow on points-to facts.
Heap modeling: Run-time allocations may be abstracted by:
their allocation sites (the statement or instruction that performs the allocation, e.g., a call to malloc or an object constructor),
a more complex model based on a shape analysis,
the type of the allocation, or
one single allocation (this is called heap-insensitivity).
Source officielle
À propos de ce résultat
Cette page est générée automatiquement et peut contenir des informations qui ne sont pas correctes, complètes, à jour ou pertinentes par rapport à votre recherche. Il en va de même pour toutes les autres pages de ce site. Veillez à vérifier les informations auprès des sources officielles de l'EPFL.