1. Flow insensitivity and imprecision If you ignore flow, then you lose precision. main() { x := &y;... x := &z; } Flow insensitive analysis tells us that x may point to z here! But, insensitivity may alleviate two bottlenecks: (1) space : mem exhausted by large programs (2) time : need speed for JIT or edit, compile loop

2. Andersen’s : worst case complexity *x = y x abc y def x abc y def Worst case: N 2 per statement at least N 3 for the whole program Andersen’s is in fact O(N 3 )

3. New idea: one successor per node Each node can point to at most one “thing”. “Thing” : everything a var may point to. x a,b,c y d,e,f *x = y x a,b,c y d,e,f

4. x *x = y y More general case for *x = y

5. x *x = y yxy More general case for *x = y

6. x *x = y yxyxy More general case for *x = y

7. x x = *y y Handling: x = *y More general case for x = *y

8. x x = *y yxy Handling: x = *y More general case for x = *y

9. x x = *y yxyxy Handling: x = *y More general case for x = *y

10. x x = y y Handling: x = y More general case for x = y

11. x x = y yxy Handling: x = y More general case for x = y

12. x x = y yxyxy Handling: x = y More general case for x = y

13. x x = y yxyxy Handling: x = y (what about y = x?) More general case for x = y

14. x x = y yxyxy Handling: x = y (what about y = x?) same result for y = x ! More general case for x = y

15. x = &y xy Handling: x = &y More general case for x = &y

16. x = &y xyxy Handling: x = &y More general case for x = &y

17. x = &y xyx y,… xy Handling: x = &y More general case for x = &y

18. Our favorite example, once more! S1: l := new Cons p := l S2: t := new Cons *p := t p := t 1 2 3 4 5

19. Our favorite example, once more! S1: l := new Cons p := l S2: t := new Cons *p := t p := t l S1 t S2 p l S1 l p l t S2 p l S1,S2 tp 1 2 3 4 5 12 3 l S1 t S2 p 4 5

20. Flow insensitive loss of precision S1: l := new Cons p := l S2: t := new Cons *p := t p := t l t S1 p S2 l t S1 p S2 l t S1 p S2 l t S1 p S2 Flow-sensitive Subset-based Flow-insensitive Subset-based l t S1 p S2 l S1,S2 tp Flow-insensitive Unification- based

21. bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i :=...; } void foo(int* p) { printf(“%d”,*p); } 1 2 3 4 Another example

22. bar() { i := &a; j := &b; foo(&i); foo(&j); // i pnts to what? *i :=...; } void foo(int* p) { printf(“%d”,*p); } i a j b p i a i a j b i a j b p i,j a,b p 1 2 3 4 12 Another example 4 3

23. Steensgaard and beyond Well engineered implementation of Steensgaard: 2.1 MLOC in 1 minute (Word97) One Level Flow (Das PLDI 00) extension to Steensgaard achieves higher precision 2.1 MLOC in 2 minutes (Word 97)