IncSFS: Incremental Full-Sparse Flow-Sensitive Pointer Analysis for C/C++

2026-08-25

AI Summary

为解决C/C++程序指针分析的可扩展性问题，提出IncSFS算法，通过增量式全稀疏流敏感方法提高效率和精度。

Abstract

Pointer analysis is a fundamental technique for compiler optimization and program analysis. Flow-sensitive pointer analysis provides high precision but is difficult to scale to large projects. Tailored for rapid iteration scenarios where software evolves continuously, we introduce IncSFS, the first incremental full-sparse flow-sensitive pointer analysis algorithm for C/C++ programs. IncSFS first transforms the value-flow graph into a constraint graph and performs strongly connected component detection to ensure precision. It then propagates increases and decreases in points-to sets in an interleaved manner, supporting code deletion and insertion within a single analysis pass. IncSFS is guaranteed to terminate and compute the least fixed point when the points-to relation remains object-acyclic during analysis. Experiments on six large-scale real-world projects show that IncSFS is precise and efficient, achieving average speedups of 9.60x over full flow-sensitive pointer analysis and 5.84x over the traditional reset-recompute approach. It also improves efficiency by 15.8% over state-of-the-art incremental pointer analysis algorithms that propagate points-to-set changes.

Problem

• Pointer Analysis
• Flow-Sensitive
• Incremental
• Scalability
• C/C++

Innovation

• incremental pointer analysis
• flow-sensitive
• full-sparse
• constraint graph
• strongly connected component