Shape-Based Alias Analysis - Computing Alias Sets from Shape Graphs to Evaluate the Precision of Shape Analyses

Shape analysis is a static code analysis technique for discovering properties of heap-allocated data structures. Such information is crucial to find software bugs at compile-time or to verify high-level correctness properties. Various analyses have been introduced but their relation in terms of precision often remains unclear as analyses cannot be compared directly due to different representations of analysis results. The aim of our work is to compare the precision of shape analyses by extracting alias information from shape analysis results. We propose a significant improvement in precision over an existing 3-valued logic-based algorithm for computing alias sets from shape graphs. Using this algorithm we are able to compare the precision of two graph-based shape analyses, proposed by Sagiv, Reps & Wilhelm (SRW) and Nielson, Nielson & Hankin (NNH). The precision of the shape analysis algorithms is measured by the size of extracted strict may-alias sets, where smaller sets indicate a more precise shape analysis. Comparison of the computed alias sets gives a measure of quality by which NNH is more precise than SRW shape analysis for each of our benchmarks.