dependencies - Points-to analysis - A definition -
i'm looking perform dependence analysis using call-graph build using soot framework. read in guide using 'points-to' analysis can improve precision of call graph. 'points-to' analysis , how improve accuracy of call-graph?
a key problem in understanding data flow know date each pointer can reference. if know nothing pointer object, , object updated via pointer (e.g., p.=3) possible object in entire system might modified. if know p references specific object o1, know o1 might modified. knowledge of p can point to, important in understand side effects , scope of such effects.
now, imagine have pointers functions. if don't know function pointer p points to, , function call made indirectly through p, function might called, , side effects side effect function. if know p can point foo, side effects foo might cause can occur.
when computing call graph, function calls go 1 place. function calls can go variety of places because in fact function calls via pointers; "method" calls in oo languages , done on purpose support polymorphism.
if don't points-to analysis, can't possibly have done function-pointer points-to analysis. means constructed call graph says node bar might call many possible functions through pointer p, means there many side effects have worry about.
a precise points-to analysis leads precise function-points-to analysis, leads precise side effect analysis, leads better understanding of code can do. of course, precision relative; , harder "very precise" points analysis. in limit, impossible perfect points-to anlaysis; analyzing turing machines.
you can see more discussion on flow analysis , example of "more precise" call graph @ http://www.semdesigns.com/products/dms/flowanalysis.html
Comments
Post a Comment