Store-Based, Flow-Sensitive Points-To Analysis

• The paper introduces a rigorous static analysis technique that explicitly models memory updates using an abstract store, yielding precise may- and must-points-to information.
• Flow sensitivity is achieved by assigning distinct abstract stores to every program point, supporting strong updates and accurate pointer operation tracking.
• Interprocedural analysis, enhanced by demand-driven sparse propagation and generalized points-to graphs, improves scalability and precision in real-world codebases.

Store-based, flow-sensitive points-to analysis is a static program analysis technique that tracks the possible targets of pointer variables with explicit modeling of memory updates over program execution order. Distinguished by its explicit representation of the heap/store (as opposed to variable-equivalence-only or “Datalog-style” inclusion-based formulations), store-based, flow-sensitive approaches maintain a dynamically updated map from abstract locations to abstract locations at every program point, thus capturing the semantics of pointer arithmetic, mutation, and control flow. This paradigm has enabled highly precise may- and must-points-to information, supporting strong updates (write-overwrite semantics), precise detection of uninitialized accesses, and robust context-sensitivity mechanisms. Key advances include sparse value-flow refinement (e.g., SUPA), generalized points-to graphs (GPGs), value-context tabulation, and optimization for large-scale codebases.

1. Memory Model and Abstract Domain

Store-based, flow-sensitive analyses model the program heap as an explicit store map, associating each abstract memory location (corresponding to program variables, allocation sites, struct/field pairs, or SSA definitions) with the set of locations it may contain. The abstract store is generally a relation $P \subseteq \AbstrLoc \times \AbstrLoc$, where each entry $(x, y)$ denotes that $x$ may point to $y$ at a given program point.

Abstract memory models used in production analyses can incorporate:

• Partitioning of locations into top-level variables and address-taken objects (heap, stack, globals).
• SSA-based versions of variables and memory objects.
• Extensions for structs/fields, arrays (field-sensitive modeling), and field-flow mechanisms for object-oriented languages.
• Explicit modeling of stack frames (recency or k-limited context stacks), heap blocks (often allocation-site based), and dynamic features for associative arrays or unbounded-depth objects (0810.0753, Hauzar et al., 2014).
• Lattice-theoretic formulations: the core domain is $\mathcal{P}(\AbstrLoc \times \AbstrLoc)$, with pointwise (set-theoretic) union as join and intersection as meet (0810.0753).

These abstractions satisfy the requirements of abstract interpretation, facilitating provable soundness guarantees under over-approximation semantics (0810.0753).

2. Flow Sensitivity and Strong Updates

Flow sensitivity is achieved by associating a distinct abstract store with every program point, reflecting the sequence and effect of memory updates. Abstract transfer functions for each instruction explicitly account for the directionality and effect of pointer assignments and memory writes:

• A typical assignment $x = y$ induces a strong update (old targets of $x$ are removed) if $x$ is a singleton abstract location, and weak update (old targets retained and unioned with new possible targets) otherwise. The assignment transfers the points-to set:

$\assign^\sharp(P, x := e) = \begin{cases} (P \setminus \{(x, l)\}) \cup \{(x, l) \mid l \in L\} & \text{if } |L| = 1,~x \text{ singleton}\ P \cup \{(x, l) \mid l \in L\} & \text{otherwise} \end{cases}$

• Indirect assignments $*x = y$ and loads $(x, y)$0 are handled via composition of stores, with the possibility of strong updates if the destination is a singleton and not in an over-approximated heap region.

Store-based analyses admit precise strong updates—old contents are killed when it is provable that only one abstract object is targeted, as formalized in reachability and pruning rules such as SUPA's kill set mechanism (Sui et al., 2017). This enables elimination of spurious def-use chains and increases the precision of client analyses such as uninitialized pointer detection (Sui et al., 2017).

3. Interprocedural Analysis and Context Sensitivity

Interprocedural store-based analyses model procedure calls and returns with full flow sensitivity and diverse forms of context sensitivity:

• Value-context sensitivity maintains separate analysis traces for every distinct input abstract store at each function entry, using pairs $(x, y)$1 (function, entry-store) to model contexts. Exit updates are propagated back to all appropriate callers, and termination relies on the finiteness of the lattice (Padhye et al., 2013).
• Call-strings (activation traces), combined with value-based termination, are used to collapse recursive call contexts where the abstract state is equivalent, ensuring finiteness of possible contexts (Khedker et al., 2011).
• Bottom-up summary construction, such as Generalized Points-To Graphs (GPGs), models procedure summaries using generalized edges parameterized by indirection levels, facilitating context-sensitive bottom-up composition without placeholders (Gharat et al., 2016).
• In interprocedural value-flow graphs (e.g., SUPA), call and return are modeled by precise edges between SSA versions of parameters and return values, supporting both call-site and heap object context sensitivity (Sui et al., 2017).

These mechanisms provide a spectrum—from exhaustive context-sensitivity (as in tabulation-style analyses) to staged hybrid frameworks where context-sensitivity can be traded off against efficiency.

4. Sparse Propagation, Demand-Driven Algorithms, and Optimizations

The computational feasibility of store-based, flow-sensitive analyses for medium to large codebases is largely due to algorithmic advances:

• Sparse Value-Flow Graphs (SVFG) and Memory-SSA: SUPA constructs an SVFG whose nodes correspond to SSA definitions of variables and memory objects, and whose edges encode value flow as per SSA and memory use/def sites (Sui et al., 2017). Backward reachability enables demand-driven points-to query answering.
• Demand-driven analysis: Rather than analyzing the entire program, analyses such as SUPA compute points-to information only for user-specified queries, traversing SVFG edges as needed and pruning impossible flows via strong updates, within configurable time/memory budgets (Sui et al., 2017).
• Lazy, liveness-driven propagation: Lazy Pointer Analysis restricts points-to computation to live pointers only, reducing redundant propagation and improving scalability (Khedker et al., 2011).
• Flow-sensitive constraint graphs and optimization: Recent approaches such as CG-FSPTA encode flow-sensitive variable definitions and uses into an edge-labeled constraint graph and apply static graph simplifications (SCC condensation, variable folding), wavefront dynamic propagation, and staged solvers to achieve scalability competitive with flow-insensitive analyses (Zhang et al., 4 Aug 2025).

Analysis/Framework	Flow Sensitivity	Context Sensitivity	Scalability Mechanism
SUPA (Sui et al., 2017)	Full	Optional (stage-based)	Demand-driven SVFG traversal
GPG (Gharat et al., 2016)	Full	Full (bottom-up summaries)	Linear-size GPGs, top-down driver
Lazy (Khedker et al., 2011)	Full	Call-string + value merging	Liveness-driven, sparse propagation
SkipFlow (Kozak et al., 31 Jan 2025)	Partial (SSA)	Context-insensitive	Predicate/pruned propagation
CG-FSPTA (Zhang et al., 4 Aug 2025)	Full	None (per-procedure graph)	FSConsG, graph reduction, staged solve

5. Precision, Soundness, and Theoretical Guarantees

Store-based, flow-sensitive analyses are typically formulated as sound over-approximations:

• Abstract transfer functions are monotone, and concrete store semantics are included in the concretization of abstract store updates at every step (0810.0753).
• Formal soundness theorems assert $(x, y)$2 for each operation.
• Correct handling of strong versus weak updates, filtering on conditionals, and modeling of data-structure features such as arrays and objects is formally justified (0810.0753, Hauzar et al., 2014).

Termination is guaranteed by finite-height abstract domains (for scalar variables and bounded heap abstractions) and explicit value/context bounding strategies (value-contexts, value-based call-string merging) (Padhye et al., 2013, Khedker et al., 2011, Sui et al., 2017). Budgets in demand-driven or staged analyses further prevent nontermination (Sui et al., 2017).

Empirical results demonstrate that, with optimizations, these analyses can scale to real-world codebases:

• SUPA achieves 97.4% of whole-program flow-sensitive precision with an average per-query time of 0.18s and 65KB memory under a 10,000-edge budget on 18 C programs totaling 2.3MLOC (Sui et al., 2017).
• GPGs reduce the number of points-to pairs substantially relative to flow-insensitive analyses (e.g., under 5 pointers per call site on SPEC), and 65% of procedures have empty GPGs (Gharat et al., 2016).
• CG-FSPTA achieves 7.27× speedup and 33.05% memory reduction compared to SVFG-based analyses, at full flow sensitivity (Zhang et al., 4 Aug 2025).

6. Extensions for Dynamic Features and Real-World Languages

Store-based, flow-sensitive analyses have been adapted to languages and domains with complex memory semantics:

• PHP and dynamic associatives: Dynamic indices and object fields are modeled through pairs $(x, y)$3 for location and statically/unknown indices, with flow-sensitive, strong-vs-weak updates according to singleton tests (Hauzar et al., 2014).
• Object-oriented field and context modeling: Direct encoding of per-type field flows, guarded propagation via predicate edges, and context-insensitive or value-context linking for higher scalability (as in SkipFlow) (Kozak et al., 31 Jan 2025, Padhye et al., 2013).
• Dynamic object creation and heap abstraction: Abstract blocks per allocation site, recency-abstraction for stacks, and explicit join/widening for large heap regions (0810.0753, Gharat et al., 2016).

7. Impact and Practical Outcomes

Store-based, flow-sensitive points-to analyses have fundamentally improved the precision of alias information for static verification, security checks, compiler optimization, and automated bug detection. They are crucial for:

• Uninitialized pointer detection with high precision (e.g., identifying 3–0 uninitialized alarms as budget increases in SUPA) (Sui et al., 2017).
• Construction of precise call graphs in object-oriented analysis, drastically reducing spurious paths (e.g., reductions of 62–98% relative to SPARK) (Padhye et al., 2013).
• Scalable whole-program analysis for procedural and OO languages, with empirical evidence from SPEC, DaCapo, and GraalVM environments (Gharat et al., 2016, Zhang et al., 4 Aug 2025, Kozak et al., 31 Jan 2025).
• Enabling multi-stage tradeoffs, e.g., hybrid demand-driven with fallbacks, or bottom-up summaries in GPGs, to tune precision/efficiency per environment (Sui et al., 2017, Gharat et al., 2016).

Store-based, flow-sensitive pointer analysis thus represents a theoretical and engineering foundation for high-precision static analysis of real-world software. Its continued evolution addresses the scaling barrier through algorithmic innovation, abstraction strategies, and pragmatic hybridizations in modern analysis frameworks.