Points-to Analysis

This analysis computes the set of objects or components that a pointer can reference to. There are a lot of different categories of methods. The method described here is based on:

• flow-sensitive analysis: control-flow information is considered during analysis;
• context-sensitive analysis: when calling a function, values flow from one call through the function and return to another caller;
• heap modeling: objects named by allocation site
• aggregate modeling: elements of struct/array are distinguished