;; Function foo (foo) Points-to analysis Constraints: ANYTHING = &ANYTHING READONLY = &READONLY ESCAPED = *ESCAPED ESCAPED = ESCAPED + UNKNOWN *ESCAPED = NONLOCAL NONLOCAL = &NONLOCAL NONLOCAL = &ESCAPED INTEGER = &ANYTHING b = &NONLOCAL q = &NONLOCAL a = &y p_4 = q p_1 = &a p_1 = p_4 x_6 = *p_1 i = NONLOCAL derefaddrtmp = &i *x_6 = derefaddrtmp y.1_7 = y derefaddrtmp = &NULL *y.1_7 = derefaddrtmp Collapsing static cycles and doing variable substitution Building predecessor graph Detecting pointer and location equivalences Rewriting constraints and unifying variables Uniting pointer but not location equivalent variables Finding indirect cycles Solving graph Points-to sets ANYTHING = { ANYTHING } READONLY = { READONLY } ESCAPED = { NULL ESCAPED NONLOCAL i } NONLOCAL = { ESCAPED NONLOCAL } STOREDANYTHING = { } INTEGER = { ANYTHING } b = { NONLOCAL } q = { NONLOCAL } same as b a = { y } y = { i } same as y.1_7 p_4 = { NONLOCAL } same as b p_1 = { NONLOCAL a } x_6 = { ESCAPED NONLOCAL y } i = { NULL ESCAPED NONLOCAL } derefaddrtmp = { i } y.1_7 = { i } derefaddrtmp = { NULL } Alias information for foo Aliased symbols y, UID D.1209, int *, is addressable a, UID D.1210, int * *, is addressable i, UID D.1205, int, is addressable, is global .MEM, UID D.1207, void, is global, default def: .MEM_8(D) Call clobber information ESCAPED, points-to non-local, points-to NULL, points-to vars: { i } (includes global vars) Flow-insensitive points-to information p_1, points-to non-local, points-to vars: { a } p_4, points-to non-local, points-to vars: { } x_6, points-to non-local, points-to escaped, points-to vars: { y } y.1_7, points-to vars: { i } (includes global vars) foo (long int b, long int q) { int * * * p; int * * x; int * * a; int * y; int * y.1; : a = &y; if (b_2(D) != 0) goto ; else goto ; : p_4 = (int * * *) q_3(D); : # p_1 = PHI <&a(2), p_4(3)> x_6 = *p_1; *x_6 = &i; y.1_7 = y; *y.1_7 = 0; return; } ;; Function main (main) (executed once) Points-to analysis Constraints: ANYTHING = &ANYTHING READONLY = &READONLY ESCAPED = *ESCAPED ESCAPED = ESCAPED + UNKNOWN *ESCAPED = NONLOCAL NONLOCAL = &NONLOCAL NONLOCAL = &ESCAPED INTEGER = &ANYTHING i = NONLOCAL i = &NONLOCAL ESCAPED = &NONLOCAL ESCAPED = &NULL ESCAPED = &NULL i.0_1 = i ESCAPED = &NULL Collapsing static cycles and doing variable substitution Building predecessor graph Detecting pointer and location equivalences Rewriting constraints and unifying variables Uniting pointer but not location equivalent variables Finding indirect cycles Solving graph Points-to sets ANYTHING = { ANYTHING } READONLY = { READONLY } ESCAPED = { NULL ESCAPED NONLOCAL } NONLOCAL = { ESCAPED NONLOCAL } same as i STOREDANYTHING = { } INTEGER = { ANYTHING } i = { ESCAPED NONLOCAL } i.0_1 = { ESCAPED NONLOCAL } same as i Alias information for main Aliased symbols .MEM, UID D.1215, void, is global, default def: .MEM_2(D) i, UID D.1205, int, is addressable, is global Call clobber information ESCAPED, points-to non-local, points-to NULL, points-to vars: { } Flow-insensitive points-to information main () { int i.0; : i = 1; foo (0, 0); i.0_1 = i; if (i.0_1 != 0) goto ; else goto ; : abort (); : return 0; }