Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Phoenix: A Modular and Versatile Framework for C/C++ Pointer Analysis

Peisen Yao, Zinan Gu, Qingkai Shi

TL;DR

Phoenix tackles fragmentation in C/C++ pointer analysis by providing a modular framework that unifies multiple alias analyses behind a stable query interface. Its architecture cleanly separates IR construction, constraint generation, solver backends, and client queries, enabling easy substitution and composition of precision settings. Empirical results show robust speedups over SVF in baseline configurations and competitive performance under more precise settings, with real-world impact demonstrated through production-quality bug finding in industry tools. The framework is poised to accelerate research and production development by promoting reuse, reproducibility, and rapid integration of new analyses.

Abstract

We present Phoenix, a modular pointer analysis framework for C/C++ that unifies multiple state-of-the-art alias analysis algorithms behind a single, stable interface. Phoenix addresses the fragmentation of today's C/C++ pointer analysis ecosystem by cleanly separating IR construction, constraint generation, solver backends, and client-facing queries, making analyses easy to compare, swap, and compose while exposing explicit precision-performance trade-offs. We evaluate Phoenix against SVF under two representative configurations: a flow- and context-insensitive setting and a more precise flow- and context-sensitive setting, on 28 GNU coreutils programs. Phoenix delivers robust speedups in the baseline configuration (up to 2.88x) and remains competitive, and often faster, even in the stronger precision regime (up to 2.91x), without a systematic runtime penalty. In production, Phoenix serves as the analysis substrate for static analysis and fuzzing tools that have uncovered hundreds of new bugs and enabled deployments reporting more than 1000 bugs found in an industrial toolchain.

Phoenix: A Modular and Versatile Framework for C/C++ Pointer Analysis

TL;DR

Phoenix tackles fragmentation in C/C++ pointer analysis by providing a modular framework that unifies multiple alias analyses behind a stable query interface. Its architecture cleanly separates IR construction, constraint generation, solver backends, and client queries, enabling easy substitution and composition of precision settings. Empirical results show robust speedups over SVF in baseline configurations and competitive performance under more precise settings, with real-world impact demonstrated through production-quality bug finding in industry tools. The framework is poised to accelerate research and production development by promoting reuse, reproducibility, and rapid integration of new analyses.

Abstract

We present Phoenix, a modular pointer analysis framework for C/C++ that unifies multiple state-of-the-art alias analysis algorithms behind a single, stable interface. Phoenix addresses the fragmentation of today's C/C++ pointer analysis ecosystem by cleanly separating IR construction, constraint generation, solver backends, and client-facing queries, making analyses easy to compare, swap, and compose while exposing explicit precision-performance trade-offs. We evaluate Phoenix against SVF under two representative configurations: a flow- and context-insensitive setting and a more precise flow- and context-sensitive setting, on 28 GNU coreutils programs. Phoenix delivers robust speedups in the baseline configuration (up to 2.88x) and remains competitive, and often faster, even in the stronger precision regime (up to 2.91x), without a systematic runtime penalty. In production, Phoenix serves as the analysis substrate for static analysis and fuzzing tools that have uncovered hundreds of new bugs and enabled deployments reporting more than 1000 bugs found in an industrial toolchain.
Paper Structure (10 sections, 3 figures, 3 tables)

This paper contains 10 sections, 3 figures, 3 tables.

Table of Contents

  1. Introduction
  2. Overview
  3. Pointer Analyses in Phoenix
  4. The Querying Interfaces of Phoenix
  5. Applications of Phoenix
  6. Existing Use Cases
  7. Prospective Users
  8. Evaluation
  9. Related Work
  10. Conclusion

Figures (3)

  • Figure 1: Phoenix framework architecture.
  • Figure 2: Runtime comparison of SVF-FICI vs. Phoenix-FICI. We report the runtime ratio $\text{Time}(\text{SVF})/\text{Time}(\text{Phoenix})$; Values $>1$ indicate Phoenix is faster.
  • Figure 3: Runtime comparison of SVF-FSCI vs. Phoenix-FSCS. We report the runtime ratio $\text{Time}(\text{SVF})/\text{Time}(\text{Phoenix})$; Values $>1$ indicate Phoenix is faster.