Phoenix: A Modular and Versatile Framework for C/C++ Pointer Analysis

2026-02-02

AI Summary

This work addresses the fragmentation in current C/C++ pointer analysis tooling by proposing the first modular pointer analysis framework. By decoupling intermediate representation (IR) construction, constraint generation, solver backends, and client queries, the framework enables plug-and-play integration and systematic comparison of diverse alias analysis algorithms—including flow- and context-sensitive as well as insensitive variants—while explicitly exposing the trade-offs between precision and performance. The design supports multiple solvers and query interfaces, achieving up to a 2.91× speedup over SVF on GNU coreutils. Furthermore, the framework has been successfully deployed in industrial-scale static analysis and fuzzing tools, leading to the discovery of over one thousand real-world vulnerabilities.

Technology Category

• Constraint Satisfaction and Optimization: Solvers and Tools
• Computer Vision: Scene Analysis & Understanding
• Machine Learning: Evaluation and Analysis

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

We present Phoenix, a modular pointer analysis framework for C/C++ that unifies multiple state-of-the-art alias analysis algorithms behind a single, stable interface. Phoenix addresses the fragmentation of today's C/C++ pointer analysis ecosystem by cleanly separating IR construction, constraint generation, solver backends, and client-facing queries, making analyses easy to compare, swap, and compose while exposing explicit precision-performance trade-offs. We evaluate Phoenix against SVF under two representative configurations: a flow- and context-insensitive setting and a more precise flow- and context-sensitive setting, on 28 GNU coreutils programs. Phoenix delivers robust speedups in the baseline configuration (up to 2.88x) and remains competitive, and often faster, even in the stronger precision regime (up to 2.91x), without a systematic runtime penalty. In production, Phoenix serves as the analysis substrate for static analysis and fuzzing tools that have uncovered hundreds of new bugs and enabled deployments reporting more than 1000 bugs found in an industrial toolchain.

Problem

• pointer analysis
• alias analysis
• C/C++
• modular framework
• static analysis

Innovation

• modular pointer analysis
• alias analysis
• C/C++ static analysis
• precision-performance trade-off
• analysis framework