Alias Analysis Components

Lotus provides several alias analysis algorithms that trade precision against scalability and analysis cost.

Reusable support modules are documented separately:

• Pointer Analysis Metrics for evaluation helpers

• Points-To Set Backends for points-to set backends

• Alias Specification Manager for external-library specification support

Analysis Selection Guide

Choose the right analysis for your needs:

For Large Codebases (Speed Priority):

• SparrowAA (CI mode): Fastest, context-insensitive, inclusion-based

• AserPTA (CI mode): Fast with field sensitivity option

• AllocAA: Lightweight heuristic-based tracking

• FPA (KELP): Specialized for function pointer resolution

• SRAA: Range-based for proving non-aliasing

• DyckAA: Unification-based with Dyck-CFL reachability

For Maximum Precision:

• LotusAA: Flow-sensitive and field-sensitive

• FlowSensitivePTA: Sparse flow-sensitive, inclusion-based

• ValueFlowPTA: Flow-sensitive, field-insensitive analysis that builds and solves value flows directly from LLVM IR

• BootstrapAA: Flow- and context-sensitive analysis with bootstrapped clustering and input-state-tabulated summaries

• Sea-DSA: Unification-based, context-sensitive with heap cloning

• SparrowAA (1-CFA, 2-CFA): Context-sensitive, inclusion-based

• AserPTA (1-CFA, 2-CFA, Origin): Context-sensitive, inclusion-based

Available Analyses

For detailed information about each analysis, see the corresponding documentation:

• AllocAA — Allocation-Based AA - Lightweight heuristic-based alias analysis

• AserPTA — Pointer Analysis - High-performance pointer analysis with multiple context sensitivities

• BootstrapAA - Bootstrapped flow- and context-sensitive pointer analysis

• DyckAA — Dyck-CFL Analysis - Unification-based alias analysis with Dyck-CFL reachability

• Sea-DSA — Memory Graph AA - Context-sensitive, field-sensitive alias analysis based on DSA

• Sparrow Pointer Analysis — Inclusion AA - Inclusion-based points-to analysis

• FPA — Function Pointer Analyses (FLTA/MLTA/MLTADF/KELP) - Function pointer analysis with multiple algorithms

• LotusAA — Lotus AA Engine - Lotus-specific alias analysis framework

• UnderApproxAA — Must-Alias Analysis - Under-approximate must-alias analysis with no false positives

• DynAA — Dynamic Alias AA - Dynamic validation of static alias analysis results

• Strict Relations Alias Analysis — Algorithm - Strict Relations Alias Analysis built on interprocedural range analysis

• Flow-Sensitive Pointer Analysis - Sparse flow-sensitive inclusion-based pointer analysis

• Value-Flow-Based Pointer Analysis - Direct value-flow-based flow-sensitive pointer analysis

• TPA: Flow- and Context-Sensitive Pointer Analysis - Flow- and context-sensitive pointer analysis with semi-sparse representation

• CclyzerAA - Datalog-based pointer analysis powered by cclyzer++

• DDA - Demand-driven alias-analysis infrastructure on SVFG