dependencies - Points-to analysis - A definition -


i'm looking perform dependence analysis using call-graph build using soot framework. read in guide using 'points-to' analysis can improve precision of call graph. 'points-to' analysis , how improve accuracy of call-graph?

a key problem in understanding data flow know date each pointer can reference. if know nothing pointer object, , object updated via pointer (e.g., p.=3) possible object in entire system might modified. if know p references specific object o1, know o1 might modified. knowledge of p can point to, important in understand side effects , scope of such effects.

now, imagine have pointers functions. if don't know function pointer p points to, , function call made indirectly through p, function might called, , side effects side effect function. if know p can point foo, side effects foo might cause can occur.

when computing call graph, function calls go 1 place. function calls can go variety of places because in fact function calls via pointers; "method" calls in oo languages , done on purpose support polymorphism.

if don't points-to analysis, can't possibly have done function-pointer points-to analysis. means constructed call graph says node bar might call many possible functions through pointer p, means there many side effects have worry about.

a precise points-to analysis leads precise function-points-to analysis, leads precise side effect analysis, leads better understanding of code can do. of course, precision relative; , harder "very precise" points analysis. in limit, impossible perfect points-to anlaysis; analyzing turing machines.

you can see more discussion on flow analysis , example of "more precise" call graph @ http://www.semdesigns.com/products/dms/flowanalysis.html


Comments

Popular posts from this blog

linux - Using a Cron Job to check if my mod_wsgi / apache server is running and restart -

actionscript 3 - TweenLite does not work with object -

jQuery Ajax Render Fragments OR Whole Page -