Region-based shape analysis with tracked locations

This paper proposes a novel approach to shape analysis: using local reasoning about individual heap locations instead of global reasoning about entire heap abstractions. We present an inter-procedural shape analysis algorithm for languages with destructive updates and formulate it as a dataflow analysis. The key feature is a novel memory abstraction that differs from traditional abstractions in two ways. First, we build the shape abstraction and analysis on top of a pointer analysis. Second, we decompose the shape abstraction into a set of independent configurations, each of which characterizes one single heap location. Our approach: 1) leads to simpler algorithm specifications, because of local reasoning about the single location; 2) leads to efficient algorithms, because of the abstraction decomposition; and 3) makes it easier to develop context-sensitive, demand-driven, and incremental shape analyses. We have developed simple extensions that use the analysis results to find memory errors in programs with explicit deallocation, including memory leaks and accesses through dangling pointers. We have built a prototype system that implements the ideas in this paper and is designed to analyze C programs. Our experimental results support the intuition that local reasoning leads to more scalable analyses.