\documentclass[sans]{beamer}
\usetheme{metropolis}

\usepackage{lmodern}
\usepackage{tikz}
\usepackage{pdfpages}
\usepackage{listings}
\usepackage{multirow}
\usepackage[utf8]{inputenc}
\usepackage{graphicx}
\usepackage{ulem}
\usetikzlibrary{arrows, positioning, shapes.geometric}
\usetikzlibrary{shadows.blur}

% hide the footline navigation
\setbeamertemplate{footline}[frame number]{}
\setbeamertemplate{navigation symbols}{}
%\setbeamertemplate{footline}{}

\tikzset{
    %Define standard arrow tip
    >=stealth',
}

\tikzset{
    invisible/.style={opacity=0,text opacity=0},
    visible on/.style={alt=#1{}{invisible}},
    alt/.code args={<#1>#2#3}{%
      \alt<#1>{\pgfkeysalso{#2}}{\pgfkeysalso{#3}}
    },
}

\tikzset{
  setstyle/.style={#1},
  %bcg/.default={white},
  setstyle on/.style={alt=#1{}{setstyle}},
}

\tikzset{
  background fill/.style={fill=#1},
  background fill/.default={white},
  fill on/.style={alt=#1{}{background fill}},
}

\tikzset{
  background draw/.style={draw=#1},
  background draw/.default={white},
  draw on/.style={alt=#1{}{background draw}},
}

\tikzset{
  background filldraw/.style 2 args={draw=#1, fill=#2},
  background filldraw/.default={white}{white},
  filldraw on/.style={alt=#1{}{background filldraw}},
}

\tikzset{
  background shade/.style={#1},
  background shade/.default={top color=white, bottom color=white},
  shade on/.style={alt=#1{}{background shade}},
}

\tikzset{
  background shadedraw/.style 2 args={draw=#1, #2},
  background shadedraw/.default={white}{top color=white, bottom color=white},
  shadedraw on/.style={alt=#1{}{background shadedraw}},
}

 \lstset{escapeinside={<@}{@>}, columns=fullflexible, basicstyle=\ttfamily}

 \title{Pointer Analysis}
 \subtitle{Haven't We Solved This Problem Yet?}
 \author{Michael Hind, presented by Marek Chalupa}
 \date {Paradise Seminar, 20. 11. 2017}

\begin{document}
  %% -------------------------------------------------------------------
  \maketitle
  %% -------------------------------------------------------------------

\section{The Answer}
  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Publications on Pointer Analyses}
  In the year 2001:
  \begin{itemize}
  \item Over 75 papers
  \item 9 PhD theses
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Publications on Pointer Analyses}
  In the year 2017\footnote{source: Google Scholar}:
  \begin{itemize}
  \item "Pointer Analysis" -- 282 publications
  \item "Points-to Analysis" -- 202 publications
  \item "Alias Analysis" -- 165 publications
  \item "Analysis of Pointer(s)" -- 61 publications
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Publications on Pointer Analyses}
  Between 2001 and 2017 there were approximately 35 publications about pointer
  analyses per year.\\
\pause
  $$\downarrow$$
  \centering
  The problem does not seem to be solved.
  \end{frame}
  %% -------------------------------------------------------------------



\section{Pointer Analysis}

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Pointer vs. Alias Analysis}
  {\bf Pointer Analysis:}\\
  {\it What memory locations may be referenced by a pointer?} \\
  \vspace*{10mm}
\pause
  {\bf Alias Analysis:}\\
  {\it May these two pointers reference the same memory?}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Flow-Sensitivity}
  \begin{itemize}
  \item {\bf Flow-sensitive} pointer analysis respects the flow of data in the
        CFG (i.e.~it behaves like a usual data-flow analysis)
  \item {\bf Flow-insensitive} pointer analysis ignores the CFG completely
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Flow-Sensitive Pointer Analysis}
  \begin{center}
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }
    \node[nd] (1) at (0,1) {\texttt{p = NULL;}};
    \node[nd] (2) at (0,0) {\texttt{if (...)}};
    \node[nd] (3) at (1,-1) {\texttt{p = \&a;}};
    \node[nd] (4) at (1,-2) {\texttt{*p = 1;}};
    \node[nd] (5) at (0,-3) {\texttt{*p = 0;}};

    \draw[->] (1) edge (2);
    \draw[->] (2) edge (3);
    \draw[->] (3) edge (4);
    \draw[->] (4) edge (5);
    \draw[->, bend right] (2) edge (5);
\pause
    \node[pts] (pts1) at (3.5, 1) { p $\rightarrow$ \{NULL\}};
\pause
    \node[pts] (pts2) at (3.5, 0) { p $\rightarrow$ \{NULL\}};
\pause
    \node[pts] (pts3) at (3.5, -1) { p $\rightarrow$ \{a\}};
\pause
    \node[pts] (pts4) at (3.5, -2) { p $\rightarrow$ \{a\}};
\pause
    \node[pts] (pts5) at (3.5, -3) { p $\rightarrow$ \{a, NULL\}};
  \end{tikzpicture}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Flow-Insensitive Pointer Analysis}
  \begin{center}
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }
    \node[nd] (1) at (0,1) {\texttt{p = NULL;}};
    \node[nd] (2) at (0,0) {\texttt{if (...)}};
    \node[nd] (3) at (1,-1) {\texttt{p = \&a;}};
    \node[nd] (4) at (1,-2) {\texttt{*p = 1;}};
    \node[nd] (5) at (0,-3) {\texttt{*p = 0;}};

    \draw[->] (1) edge (2);
    \draw[->] (2) edge (3);
    \draw[->] (3) edge (4);
    \draw[->] (4) edge (5);
    \draw[->, bend right] (2) edge (5);

    \node[pts] (pts1) at (3.5, 1) { p $\rightarrow$ \{a, NULL\}};
    \node[pts] (pts2) at (3.5, 0) { p $\rightarrow$ \{a, NULL\}};
    \node[pts] (pts3) at (3.5, -1) { p $\rightarrow$ \{a, NULL\}};
    \node[pts] (pts4) at (3.5, -2) { p $\rightarrow$ \{a, NULL\}};
    \node[pts] (pts5) at (3.5, -3) { p $\rightarrow$ \{a, NULL\}};
  \end{tikzpicture}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Subset-Based Flow-Insensitive Pointer Analysis}
  \begin{center}
  \begin{tabular}{c p{1cm} c}
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }
    \node[nd] (2) at (0,0) {\texttt{p = \&a}};
    \node[nd] (3) at (0,-1) {\texttt{p = \&b;}};
    \node[nd] (4) at (0,-2) {\texttt{r = p;}};
    \node[nd] (5) at (0,-3) {\texttt{r = \&c;}};
  \end{tikzpicture}
  &&
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }
    \node[] (2) at (0,0) {\texttt {$a \in p$}};
    \node[] (3) at (0,-1) {\texttt{$b \in p$}};
    \node[] (4) at (0,-2) {\texttt{$p \subseteq r$}};
    \node[] (5) at (0,-3) {\texttt{$c \in r$}};
  \end{tikzpicture}
  \end{tabular}
  $$p = \{a, b\};~r = \{a, b, c\}$$
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Flow-Insensitive Pointer Analysis on Memory Graphs}
  \begin{center}
  \begin{tabular}{c p{1cm} c}
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, color=blue},
    }
    \node[nd] (2) at (0,0) {\texttt{p = \&a}};
    \node[nd] (3) at (0,-1) {\texttt{p = \&b;}};
    \node[nd] (4) at (0,-2) {\texttt{r = p;}};
    \node[nd] (5) at (0,-3) {\texttt{r = \&c;}};

    \only<2>{\node[pts] (m1) at (-1.5, 0) {  $\rightarrow$ };}
    \only<3>{\node[pts] (m2) at (-1.5, -1) { $\rightarrow$ };}
    \only<4>{\node[pts] (m3) at (-1.5, -2) { $\rightarrow$ };}
    \only<5>{\node[pts] (m4) at (-1.5, -3) { $\rightarrow$ };}
  \end{tikzpicture}
  &&
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }
    \node[nd] (a) at (0,0) {\texttt{a}};
    \node[nd] (b) at (0,-1) {\texttt{b}};
    \node[nd] (c) at (0,-2) {\texttt{c}};
    \node[nd] (p) at (-2,-1) {\texttt{p}};
    \node[nd] (r) at (2,-1) {\texttt{r}};
\pause
    \draw[->] (p) edge (a);
\pause
    \draw[->] (p) edge (b);
\pause
    \draw[->] (r) edge (a);
    \draw[->] (r) edge (b);
\pause
    \draw[->] (r) edge (c);
  \end{tikzpicture}
  \end{tabular}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Flow-Insensitive Pointer Analysis on Memory Graphs (2)}
  \begin{center}
  \begin{tabular}{c p{1cm} c}
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, color=blue},
    }
    \node[nd] (2) at (0,0) {\texttt{p = \&a}};
    \node[nd] (3) at (0,-1) {\texttt{p = \&b;}};
    \node[nd] (4) at (0,-2) {\texttt{r = p;}};
    \node[nd] (5) at (0,-3) {\texttt{r = \&c;}};

    \only<1>{\node[pts] (m1) at (-1.5, 0) {  $\rightarrow$ };}
    \only<2-4>{\node[pts] (m2) at (-1.5, -1) { $\rightarrow$ };}
    \only<5-7>{\node[pts] (m3) at (-1.5, -2) { $\rightarrow$ };}
    \only<8->{\node[pts] (m4) at (-1.5, -3) { $\rightarrow$ };}
  \end{tikzpicture}
  &&
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw, fill=white},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }

  \only<-2>{
    \node[nd] (a) at (0,0) {\texttt{a}};
    \node[nd] (b) at (0,-1) {\texttt{b}};
  }

  \only<3>{
    \node[nd, color=blue, fill=white] (a) at (0,0) {\texttt{a}};
    \node[nd, color=blue, fill=white] (b) at (0,-1) {\texttt{b}};
  }

  \only<4-8>{
    \node[nd] (ab) at (0,-1) {\texttt{a, b}};
    \draw[->] (p) edge (ab);
  }

  \only<1-3>{
    \draw[->] (p) edge (a);
  }
  \only<2-3>{
    \draw[->] (p) edge (b);
  }

  \only<5-6>{
    \draw[->] (r) edge (ab);
  }

  \only<-5>{
    \node[nd] (p) at (-2,-1) {\texttt{p}};
    \node[nd] (r) at (2,-1) {\texttt{r}};
  }

  \only<6>{
    \node[nd, color=blue, fill=white] (p) at (-2,-1) {\texttt{p}};
    \node[nd, color=blue, fill=white] (r) at (2,-1) {\texttt{r}};
  }

  \only<7-9> {
    \node[nd] (pr) at (-2, -1) {\texttt{p, r}};
  }
  \only<7-9>{
    \draw[->] (pr) edge (ab);
  }

  \only<8-9> {
    \draw[->] (pr) edge (c);
  }

  \only<-8>{
    \node[nd] (c) at (0,-2) {\texttt{c}};
  }
  \only<9> {
    \node[nd, color=blue, fill=white] (c) at (0,-2) {\texttt{c}};
    \node[nd, color=blue, fill=white] (ab) at (0,-1) {\texttt{a, b}};
  }
  \only<10> {
    \node[nd] (pr2) at (-2, -1) {\texttt{p, r}};
    \node[nd] (abc) at (0,  -1) {\texttt{a, b, c}};
    \draw[->] (pr2) -- (abc);
  }

  \end{tikzpicture}
  \end{tabular}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Semi-Sparse Pointer Analysis}
  \begin{itemize}
    \item Sometimes we need flow-sensitivity, but flow-sensitive analyses do not scale well
    \item Possible solution:
    \begin{enumerate}
      \item Compute fast flow-insensitive analysis
      \item Compute definition-use relation between instructions
      \item Perform flow-sensitive analysis using definition-use chains
    \end{enumerate}
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}[fragile]
  \frametitle{Semi-Sparse Pointer Analysis}
  \begin{center}
  \begin{tikzpicture}
    \tikzset {
      nd/.style={draw},
      pts/.style={overlay, font=\scriptsize, color=blue},
    }
    \node[nd] (1) at (0,1) {\texttt{DEF(p)}};
    \node[nd] (2) at (0,0) {\texttt{DEF(q)}};
    \node[nd] (3) at (1,-1) {\texttt{}};
    \node[nd] (4) at (1,-2) {\texttt{USE(p)}};
    \node[nd] (5) at (0,-3) {\texttt{USE(p, q)}};
    \node[nd] (6) at (1,-4) {\texttt{}};
    \node[nd] (7) at (2,-3) {\texttt{}};
    \node[nd] (8) at (2,-4) {\texttt{}};

  \only<1>{
    \draw[->] (1) edge (2);
    \draw[->] (2) edge (3);
    \draw[->] (3) edge (4);
    \draw[->] (4) edge (5);
    \draw[->, bend right] (2) edge (5);
    \draw[->] (5) edge (6);
    \draw[->, bend left] (4) edge (6);
    \draw[->, bend right] (6) edge (7);
    \draw[->] (7) edge (4);
    \draw[->] (7) edge (8);
  }

  \only<2>{
    \draw[->, color=gray!30] (1) edge (2);
    \draw[->, color=gray!30] (2) edge (3);
    \draw[->, color=gray!30] (3) edge (4);
    \draw[->, color=gray!30] (4) edge (5);
    \draw[->, color=gray!30, bend right] (2) edge (5);
    \draw[->, color=gray!30] (5) edge (6);
    \draw[->, color=gray!30, bend left] (4) edge (6);
    \draw[->, color=gray!30, bend right] (6) edge (7);
    \draw[->, color=gray!30] (7) edge (4);
    \draw[->, color=gray!30] (7) edge (8);

    \draw[->, dashed, bend left=60] (1) edge (4);
    \draw[->, dashed, bend right=60] (1) edge (5);
    \draw[->, dashed, bend right=50] (2) edge (5);

  }

  \end{tikzpicture}
  \end{center}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Full-Sparse Pointer Analysis}
  \begin{itemize}
    \item To compute pointer information we need to compute definition-use relation
  \pause
    \item To compute definition-use relation we need pointer information
  \pause
    \item However, there exist analyses that can handle it
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------


  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Other Traits of Pointer Analyses}
  {\bf Context-sensitivity:}\\
  {\it  Is the calling context taken into account?}\\
  \vspace*{10mm}
\pause
  {\bf Field-sensitivity:}\\
    {\it Does analysis differentiate between elements of arrays and other aggregate types (e.g. structs)?}
  \end{frame}
  %% -------------------------------------------------------------------

 %%% -------------------------------------------------------------------
 %\begin{frame}
 %\frametitle{Heap Modeling}
 %There are several options:
 %\begin{itemize}
 %  \item Heap is one object
 %  \item Every allocation site is one object
 %  \item Different runtime objects are differentiated (up to some precision)
 %\end{itemize}
 %\end{frame}
 %%% -------------------------------------------------------------------

 %%% -------------------------------------------------------------------
 %\begin{frame}[fragile]
 %\frametitle{Heap Modeling}
 %\begin{center}
 %\begin{tikzpicture}
 %  \tikzset {
 %    nd/.style={draw},
 %    pts/.style={overlay, font=\scriptsize, color=blue},
 %  }
 %  \node[nd] (1) at (0,1) {\texttt{i = 0;}};
 %  \node[nd] (11) at (0,0) {\texttt{int *array[10];}};
 %  \node[nd] (2) at (0,-1) {\texttt{while (i < 10)}};
 %  \node[nd] (3) at (0,-2.5) {\texttt{array[i++] = malloc(...);}};
 %  \node[overlay] (e) at (3,-1) {};

 %  \draw[->] (1) edge (11);
 %  \draw[->] (11) edge (2);
 %  \draw[->] (2) edge (3);
 %  \draw[->] (2) edge (e);
 %  \draw[->, bend left] (3) edge (2);

 %\only<1>{
 %  \node[pts] (pts1) at (3.8, 2) { array[0] $\rightarrow$ \{malloc.*\}};
 %  \node[pts] (pts2) at (3.8, 1.5) { array[1] $\rightarrow$ \{malloc.*\}};
 %  \node[pts] (pts3) at (3.8, 1) { array[2] $\rightarrow$ \{malloc.*\}};
 %  \node[pts] (pts4) at (3.8, 0.5) { ...};
 %  \node[pts] (pts5) at (3.8, 0) { array[*] $\rightarrow$ \{malloc.*\}};
 %}

 %\only<2>{
 %  \node[pts] (pts1) at (3.8, 2) { array[0] $\rightarrow$ \{malloc.0\}};
 %  \node[pts] (pts2) at (3.8, 1.5) { array[1] $\rightarrow$ \{malloc.1\}};
 %  \node[pts] (pts3) at (3.8, 1) { array[2] $\rightarrow$ \{malloc.2\}};
 %  \node[pts] (pts4) at (3.8, 0.5) { ...};
 %  \node[pts] (pts5) at (3.8, 0) { array[9] $\rightarrow$ \{malloc.9\}};
 %}

 %\end{tikzpicture}
 %\end{center}
 %\end{frame}
 %%% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Tradeoff Between Speed and Precision}
  Crucially depends on user's needs.
  \begin{itemize}
    \item Flow-sensitive analysis may be faster than flow-insensitive
    \item A consumer of flow-sensitive points-to information may work faster than when flow-insensitive analysis is used
    \item The same with field-sensitivity, context-sensitivity, etc.
  \end{itemize}
  \end{frame}
  %% -------------------------------------------------------------------

  %% -------------------------------------------------------------------
  \begin{frame}
  \frametitle{Conclusion}
  {\bf There is no universal pointer analysis.}\\
  \vspace*{10mm}
  Different consumers of points-to information need different precision and speed
  of pointer analysis.  \\
  \vspace*{10mm}
\pause
  \hfill Thank you!
  \end{frame}
  %% -------------------------------------------------------------------


\end{document}
