Points-To Analysis

The Flow-Insensitive Representation

• AssignmentIF : A flow-insensitive representation of a program is a set of AssignmentIF. An AssignmentIF instance represents an assignment in the program which is one of the following forms:
  • Base: lhs = &rhs
  • Simple: lhs = rhs
  • Complex 1: *lhs = rhs
  • Complex 2: lhs = *rhs

For the case of *lhs = *rhs , an auxiliary variable tmp is introduced: tmp = *rhs , *rhs = tmp .

For now, structs and array elements are all invisible for the flow-insensitive representation: so expr.id is abstracted to expr; expr->id is abstracted to *expr; a[I] is abstracted to a; *(p + i), where I is an integer, is abstracted to *p.

For the case of lhs = a op b (or *lhs = a op b), it is abstracted to lhs = a (or *lhs = a) and lhs = b (or *lhs = b)

Read / Write Analysis