The Pointer Constraint System provides a set-constraint based pointer analysis, which is flow- and context-insensitive. It accepts, as input, simple constraints of the form:
Where
p and
q are constraint variables and * is the usual dereference operator. We can think of each variable as containing the set of variables it points to. To perform the analysis we translate the source program into this language, by compiling with
scc and running the suifcgen tool which accompanies the PCS distribution. For example, consider the following where the solution (shown below the line) is obtained using the inference rules of Figure 1:
int *f(int *p) { |
return p; | (1)  |
} |
int g() { |
int x,y,*p,*q,**r,**s; |
s=&p; | (2)  |
if(...) p=&x; | (3)  |
else p=&y; | (4)  |
r=s; | (5)  |
q=f(*r); | (6)  |
} | (7)  |
|
| (8)  |  |
| (9)  |  |
| (10)  |  |
| (11)  |  |
| (12)  |  |
| (13)  |  |
| (14)  |  |
| (15)  |  |
Figure 1. An inference system for pointer analysis
Notice that variable names are augmented with scope information to ensure their uniqueness. From the derivation, we can build the target set of a variable
v by collecting all constraints of the form
v 
{ x }.
Thus, in the example, constraints 14+15 give
q = { gx,gy } which means that q can target { g
x,g
y } at any point in the program. An important point here is that
we must derive all facts to obtain a sound solution.