Points-to Analysis for Program Understanding

Abstract

Program understanding activities are more difficult for programs written in languages (such as C) that heavily make use of pointers for data structure manipulation, because the programmer needs to build a mental model of the memory use and of the pointers to its locations. Pointers also pose additional problems to the tools supporting program understanding, since they introduce additional dependences that have to be accounted for.

This paper extends the flow insensitive context insensitive points-to analysis algorithm proposed by Steensgaard, to cover arbitrary combinations of pointer dereferences, array subscripts and field selections. It exhibits interesting properties, among which scalability resulting from the low complexity and good performances. The results of the analysis are valuable by themselves, as their graphical display represents the points-to links between locations. They are also integrated with other program understanding techniques like, e.g., call graph construction, slicing, plan recognition and architectural recovery. The use of this algorithm in the framework of the program understanding environment CANTO is discussed.