Aliasing analysis for a million lines of C

Abstract

We will describe the design and implementation of a fast points-to analysis system. On some industrial code bases (about a million lines of unpreprocessed C code) this system performs context-insensitive field-based Andersen-style points-to analysis in less than a second and uses less than 10MB of memory. The two main contributions of the work are a database-centric analysis architecture called compile-link-analyze (CLA), and a new graph-based algorithm for implementing a form of dynamic transitive closure. An open source release of our system should be available soon.