Flow sensitivity without control flow graph: An efficient Andersen-style flow-sensitive pointer analysis☆

Jiahao Zhang

doi:10.1016/j.jss.2026.113027

Flow sensitivity without control flow graph: An efficient Andersen-style flow-sensitive pointer analysis☆

2026-07-01

0

PRE

AI

DOI：10.1016/j.jss.2026.113027

Original

Original request for help

Save

Abstract

En 中文

Flow-sensitive pointer analysis constitutes an essential component of precise program analysis for accurately modeling pointer behaviors by incorporating control flows. Flow-sensitive pointer analysis is extensively used in alias analysis, taint analysis, program understanding, compiler optimization, etc. Existing flow-sensitive pointer analysis approaches, which are conducted based on control flow graphs, have significantly advanced the precision of pointer analysis via sophisticated techniques to leverage control flow information. However, they inevitably suffer from computational inefficiencies when resolving points-to information due to the inherent complex structures of control flow graphs. We present Cc-FSPTA, a Flow-Sensitive Constraint Graph (FSConsG) based flow-sensitive pointer analysis to overcome the inefficiency of control-flow-graph-based analysis. Cc-FSPTA uses a flow-sensitive variant to leverage the structural advantages of set-constraint graphs (which are commonly used in flow-insensitive pointer analysis) while keeping the flow sensitivity of variable definitions and uses, allowing the incorporation of sophisticated graph optimization and dynamic solving techniques. In this way, Cc-FSPTA achieves significant efficiency improvements while keeping the precision of flow-sensitive analysis. Experimental evaluations on benchmark programs demonstrate that Cc-FSPTA, which leverages the FSConsG to simplify graph structure and significantly reduces both memory usage and execution time while maintaining precision. In particular, by solving in the FSConsG, Cc-FSPTA achieves an average memory reduction of 33.05% and accelerates flow-sensitive pointer analysis by 7.27 & times; compared to the state-of-art flow-sensitive pointer analysis method. These experimental results underscore the efficacy of Cc-FSPTA as a scalable solution to analyze large-scale software systems, thus establishing a robust foundation for future advancements in efficient program analysis frameworks.

Keywords:

Program analysis

Static analysis

Pointer analysis

Flow-sensitivity

Constraint graph

Performance

Flow sensitivity without control flow graph: An efficient Andersen-style flow-sensitive pointer analysis☆

Abstract

Journal

Organization

Cited Papers