<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<div class="moz-cite-prefix">On 12/16/16 9:53 PM, 杨至轩(Zhixuan Yang)
via llvm-dev wrote:<br>
</div>
<blockquote
cite="mid:429d218e.14123.1590ab3272d.Coremail.zxyang@pku.edu.cn"
type="cite">Hello, everyone!
<div><br>
</div>
<div>I'm writing an automatic memory leak fixing tool recently.
For my task, I'm using the DSA (Data Structure Analysis) for
alias analysis. In my task, when I detect a memory leak, I need
to find a pointer (in C) 'must-alias' with the corresponding
resource. <br>
</div>
</blockquote>
<br>
If I understand correctly, if you find memory leak, you want to find
the corresponding call(s) to malloc() that allocated the memory
object, correct? Can you more completely explain what you are
trying to accomplish?<br>
<br>
<blockquote
cite="mid:429d218e.14123.1590ab3272d.Coremail.zxyang@pku.edu.cn"
type="cite">
<div><br>
</div>
<div>In DSA, I think if two Value* point to the same DSNode, they
'may-alias'. If two Value* point to different DSNode, they
'not-alias'. However, is it possible to know whether two Value*
'must-alias'? <br>
</div>
</blockquote>
<br>
No. DSA does not track must-alias information.<br>
<br>
<blockquote
cite="mid:429d218e.14123.1590ab3272d.Coremail.zxyang@pku.edu.cn"
type="cite">
<div><br>
</div>
<div>I checked the AliasAnalysis interface before it was removed
from DSA, the interface never returns MustAlias results. I guess
it may not be possible to get 'MustAlias' results from DSA. Will
it be possible to modify the DSA code so that every heap DSNode
tracks all possible malloc() calls it comes from?</div>
</blockquote>
<br>
Interesting question. You could add a "Must-Alias" flag that is
originally set on a DSNode. Whenever two DSNodes are merged due to
a "may-alias" relationship, you could flip the "Must-Alias" flag
off.<br>
<br>
However, DSA is a unification-based analysis, so I would think that
the accuracy of a must-alias feature would be pretty weak. Also,
DSA loses precision as it performs more inter-procedural analysis
(the local analysis will be the most precise but will have many
Incomplete DSNodes; the Bottom-Up and Top-Down propagate information
up and down the call graph but will cause further DSNode merging). <br>
<br>
It may be that you will need a more accurate points-to analysis
algorithm for your work.<br>
<br>
Regards,<br>
<br>
John Criswell<br>
<br>
<blockquote
cite="mid:429d218e.14123.1590ab3272d.Coremail.zxyang@pku.edu.cn"
type="cite">
<div><br>
</div>
<div>Thanks for your help.</div>
<div><br>
</div>
<div>Best regards, Zhixuan Yang</div>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
LLVM Developers mailing list
<a class="moz-txt-link-abbreviated" href="mailto:llvm-dev@lists.llvm.org">llvm-dev@lists.llvm.org</a>
<a class="moz-txt-link-freetext" href="http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev">http://lists.llvm.org/cgi-bin/mailman/listinfo/llvm-dev</a>
</pre>
</blockquote>
<br>
<p><br>
</p>
<pre class="moz-signature" cols="72">--
John Criswell
Assistant Professor
Department of Computer Science, University of Rochester
<a class="moz-txt-link-freetext" href="http://www.cs.rochester.edu/u/criswell">http://www.cs.rochester.edu/u/criswell</a></pre>
</body>
</html>