Pointer analysis

In computer science, pointer analysis, or points-to analysis, is a static code analysis technique that establishes which pointers, or heap references, can point to which variables, or storage locations. It is often a component of more complex analyses such as escape analysis. A closely related technique is shape analysis.

(The above is the most common colloquial use of the term. A secondary use has pointer analysis be the collective name for both points-to analysis, defined as above, and alias analysis. Points-to and alias analysis are closely related but not always equivalent problems.)

Example

For the following example program, a points-to analysis would compute that the points-to set of p is {x, y}.

int x;
int y;
int* p = unknown() ? &x : &y;

Introduction

Techniques range widely in performance and precision. For large programs, some tradeoffs may be necessary to make the analysis finish in reasonable time and space. Some examples of these tradeoffs are the following:

Treating all references from a structured object as being from the object as a whole is known as field insensitivity or structure insensitivity.

Ignoring flow of control when analysing which objects are assigned to pointers is known as context-insensitive pointer analysis (when ignoring the context in which function calls are made) or flow-insensitive pointer analysis (when ignoring the control flow within a procedure).

The disadvantage of these simplifications is that the calculated set of objects pointed to may become less precise.

Algorithms

• Steensgaard's algorithm
• Andersen's algorithm

See also

• Alias analysis
• Escape analysis
• Shape analysis (software)