Summary-Based Pointer Analysis Framework for Modular Bug Finding

Modern society is irreversibly dependent on computers and, consequently, on software. However, as the complexity of programs increase, so does the number of defects within them. To alleviate the problem, automated techniques are constantly used to improve software quality. Static analysis is one such approach in which violations of correctness properties are searched and reported. Static analysis has many advantages, but it is necessarily conservative because it symbolically executes the program instead of using real inputs, and it considers all possible executions simultaneously. Being conservative often means issuing false alarms, or missing real program errors. Pointer variables are a challenging aspect of many languages that can force static analysis tools to be overly conservative. It is often unclear what variables are affected by pointer-manipulating expressions, and aliasing between variables is one of the banes of program analysis. To alleviate that, a common solution is to allow the programmer to provide annotations such as declaring a variable as unaliased in a given scope, or providing special constructs such as the "never-null" pointer of Cyclone. However, programmers rarely keep these annotations up-to-date. The solution is to provide some form of pointer analysis, which derives useful information about pointer variables in the program. An appropriate pointer analysis equips the static tool so that it is capable of reporting more errors without risking too many false alarms. This dissertation proposes a methodology for pointer analysis that is specially tailored for "modular bug finding." It presents a new analysis space for pointer analysis, defined by finer-grain "dimensions of precision," which allows us to explore and evaluate a variety of different algorithms to achieve better trade-offs between analysis precision and efficiency. This framework is developed around a new abstraction for computing points-to sets, the Assign-Fetch Graph, that has many interesting features. Empirical evaluation shows promising results, as some unknown errors in well-known applications were discovered

Pointer Analysis for C Programs Through AST Traversal

We present a pointer analysis algorithm designed for source-to-source transformations. Existing techniques for pointer analysis apply a collection of inference rules to a dismantled intermediate form of the source program, making them difficult to apply to source-to-source tools that generally work on abstract syntax trees to preserve details of the source program. Our pointer analysis algorithm operates directly on the abstract syntax tree of a C program and uses a form of standard dataflow analysis to compute the desired points-to information. We have implemented our algorithm in a source-to-source translation framework and experimental results show that it is practical on real-world examples

Pointer Analysis for Source-to-Source Transformations

We present a pointer analysis algorithm designed for source-to-source transformations. Existing techniques for pointer analysis apply a collection of inference rules to a dismantled intermediate form of the source program, making them difficult to apply to source-to-source tools that generally work on abstract syntax trees to preserve details of the source program. Our pointer analysis algorithm operates directly on the abstract syntax tree of a C program and uses a form of standard dataflow analysis to compute the desired points-to information. We have implemented our algorithm in a source-to-source translation framework and experimental results show that it is practical on real-world examples

Escalonamento de instruções em arquiteturas VLIW particionadas explorando Bypassing de operandos

Orientador : Guido Costa Souza de Araujo, Paulo Cesar CentoducatteDissertação (mestrado) - Universidade Estadual de Campinas, Instituto de ComputaçãoResumo: A incansável busca por máquinas mais velozes, aliada aos enormes avanços tecnológicos na concepção de circuitos integrados, retiraram as arquiteturas Very Long Instruction W ord (VLIW) de um estado amórfico para a realidade. Embora tenham surgido como CIs recentemente [1], as máquinas VLIW foram idealizadas há algumas décadas atrás [13, 16, 22, 23]. Os processadores que definem este modelo de processamento não mais obedecem regras clássicas de execução: instruções de um dos possíveis fluxos de controle de um comando de desvio condicional são executadas mesmo antes do término da avaliação da condição, a qual determinará se a transferência de controle deverá ocorrer ou não; executam simultaneamente inúmeras instruções, de diferentes tipos, oriundas do mesmo programa; computam programas que foram compilados de uma forma revolucionária: todo o programa é analisado em busca de operações paralelizáveis, como se fosse um único (macro) bloco. Numa tentativa de contribuição a esta linha de pesquisa, este trabalho visa a detecção e exploração do paralelismo 'escondido' em programas originalmente sequenciais. Esta busca gera resultados que são analisados e quantificados com o intuito de se encontrar uma arquitetura-alvo adequada para uma aplicação específica. Esta metodologia encontra-se inserida no contexto de uma área denominada Embedded Systems, a qual se preocupa em otimizar ao máximo a execução de uma classe restrita de aplicações ou até mesmo uma única aplicação-chave de um sistema dedicado. O modelo de arquitetura considerado neste trabalho é denominado VLIW particionado (do inglês partitioned VLIW). Este modelo difere da máquina VLIW ideal pelo fato de não possuir um único banco de registradores centralizado, mas sim vários bancos de registradores que se comunicam através de barramentos especiais. Com este modelo de arquitetura em mãos, o trabalho desenvolvido nesta dissertação trata da investigação de problemas relacionados com o mapeamento de uma aplicação específica a uma máquina VLIW dedicada. Em um macro-cenário, este trabalho tenta responder a seguinte questão: "Qual é a máquina VLIW adequada para uma dada aplicação ?,'. Ou ainda, "Quantos bancos de registradores e quantas unidades funcionais o processador para esta aplicação deveria ter?"Abstract: The untiring search for faster machines, alIied to the great technological advances in the field of integrated circuits conception, brought out the Very Long Instruction Word architectures from an amorphous status to reality. Although they have appeared recently as real chips [1], the VLIW machines were idealized some decades ago [13, 16, 22, 23]. The microprocessors that define this processing model no longer obey classical rules of execution: instructions coming from one of the possible control flows resulted of a branch instruction are executed even before the finish of the evaluation condition. This evaluation condition will determine if the control transfer should occur or noto Also, these architectures execute simultaneously many instructions, of different kinds, issued from the same programo Moreover, these processors compute programs that were compiled through a revolutionary way: alI the program is analized to search for paralelizable operations. As an attempt to contribute to this research field, this work aim the development of a methodology to detect and exploit the paralelism "hided" in sequential-written programs. The results generated by this search are analized and quantified in order to find a targetarchitecture for a specific application. This work is inserted in the context of an area calIed Embedded Systems. This research field worry about the maximum optimization of an application class or even only one key-application of a embedded system. The architecture model considered in this work is denoted as "Partitioned VLIW Architecture". This model is slightly different of the ideal VLIW architecture model. In the ideal model, there must be only one centralized register file, in order to guarantee the maximum Instruction Levei ParalIelism (ILP). AlI the functional units share the same register file. On the other hand, the architecture model being considered here presents many distributed register files, which have an special bus to communicate data among them. With this architecture model in mind, the work developed in this thesis investigates some of the problems related to mapping one specific application to an embedded VLIW architecture. Roughly speaking, this work tries to answer the following question: "What is the ideal VLIW architecture for a given application'1" or "How many register files and how many functional units the processor for that application should have '1"MestradoMestre em Ciência da Computaçã

Flexible Pointer Analysis Using Assign-Fetch Graphs

We propose a new abstraction for pointer analysis that represents reads and writes to memory instead of traditional points-to relations. Compared to points-to graphs, our Assign-Fetch Graph (AFG) leads to concise procedure summaries that can be used in any calling context. Also, its flexibility supports new analysis techniques with different trade-offs between speed and precision. For efficiency, we build a summary for each procedure that assumes distinct pointers from the environment are not aliased and restore soundness when the summary is used in a context with aliases. We present two pointer analysis techniques based on our AFG. The first takes the flow-insensitive view adopted by many authors; the second considers statement ordering. In addition to being more precise, we find that this "flow-aware" analysis runs faster. We conclude with experimental results showing it is practical

ATLANTIC-PRIMATES: a dataset of communities and occurrences of primates in the Atlantic Forests of South America

Primates play an important role in ecosystem functioning and offer critical insights into human evolution, biology, behavior, and emerging infectious diseases. There are 26 primate species in the Atlantic Forests of South America, 19 of them endemic. We compiled a dataset of 5,472 georeferenced locations of 26 native and 1 introduced primate species, as hybrids in the genera Callithrix and Alouatta. The dataset includes 700 primate communities, 8,121 single species occurrences and 714 estimates of primate population sizes, covering most natural forest types of the tropical and subtropical Atlantic Forest of Brazil, Paraguay and Argentina and some other biomes. On average, primate communities of the Atlantic Forest harbor 2 ± 1 species (range = 1–6). However, about 40% of primate communities contain only one species. Alouatta guariba (N = 2,188 records) and Sapajus nigritus (N = 1,127) were the species with the most records. Callicebus barbarabrownae (N = 35), Leontopithecus caissara (N = 38), and Sapajus libidinosus (N = 41) were the species with the least records. Recorded primate densities varied from 0.004 individuals/km 2 (Alouatta guariba at Fragmento do Bugre, Paraná, Brazil) to 400 individuals/km 2 (Alouatta caraya in Santiago, Rio Grande do Sul, Brazil). Our dataset reflects disparity between the numerous primate census conducted in the Atlantic Forest, in contrast to the scarcity of estimates of population sizes and densities. With these data, researchers can develop different macroecological and regional level studies, focusing on communities, populations, species co-occurrence and distribution patterns. Moreover, the data can also be used to assess the consequences of fragmentation, defaunation, and disease outbreaks on different ecological processes, such as trophic cascades, species invasion or extinction, and community dynamics. There are no copyright restrictions. Please cite this Data Paper when the data are used in publications. We also request that researchers and teachers inform us of how they are using the data. © 2018 by the The Authors. Ecology © 2018 The Ecological Society of Americ

Pointer Analysis for C Programs Through AST Traversal

We present a pointer analysis algorithm designed for source-to-source transformations. Existing techniques for pointer analysis apply a collection of inference rules to a dismantled intermediate form of the source program, making them difficult to apply to source-to-source tools that generally work on abstract syntax trees to preserve details of the source program. Our pointer analysis algorithm operates directly on the abstract syntax tree of a C program and uses a form of standard dataflow analysis to compute the desired points-to information. We have implemented our algorithm in a sourceto-source translation framework and experimental results show that it is practical on real-world examples.

Pointer analysis for source-to-source transformations

We present a pointer analysis algorithm designed for source-to-source transformations. Existing techniques for pointer analysis apply a collection of inference rules to a dismantled intermediate form of the source program, making them difficult to apply to source-to-source tools that generally work on abstract syntax trees to preserve details of the source program. Our pointer analysis algorithm operates directly on the abstract syntax tree of a C program and uses a form of standard dataflow analysis to compute the desired points-to information. We have implemented our algorithm in a sourceto-source translation framework and experimental results show that it is practical on real-world examples.