Verifying pointer and string analyses with region type systems

Pointer analysis statically approximates the heap pointer structure during a program execution in order to track heap objects or to establish alias relations between references, and usually contributes to other analyses or code optimizations. In recent years, a number of algorithms have been presented that provide an efficient, scalable, and yet precise pointer analysis. However, it is unclear how the results of these algorithms compare to each other semantically.In this paper, we present a general region type system for a Java-like language and give a formal soundness proof. The system is subsequently specialized to obtain a platform for embedding the results of various existing context-sensitive pointer analysis algorithms, thereby equipping the computed relations with a common interpretation and verification. We illustrate our system by outlining an extension to a string value analysis that builds on pointer information.

► We define a flexible region type system for a Java-like language.
► The results of many existing pointer analyses can be interpreted as region types.
► We prove the soundness of the type system, and derive an algorithmic version.
► With this method, we get a mechanism to formally verify pointer analysis results.
► Furthermore, we extend the framework to verify string analyses that build on pointer information.