# Precise Null Pointer Analysis Through Global Value Numbering

## TL;DR

This paper introduces a semantics-preserving program transformation based on Global Value Numbering that significantly enhances the precision of null pointer alias analysis with minimal overhead.

## Contribution

It presents a novel program transformation technique that improves null pointer alias analysis precision using Global Value Numbering, without sacrificing scalability.

## Key findings

- Precision of null pointer analysis improved from 86.56% to 98.05%.
- Transformation incurs insignificant overhead.
- Applicable to real-world code for better static analysis accuracy.

## Abstract

Precise analysis of pointer information plays an important role in many static analysis techniques and tools today. The precision, however, must be balanced against the scalability of the analysis. This paper focusses on improving the precision of standard context and flow insensitive alias analysis algorithms at a low scalability cost. In particular, we present a semantics-preserving program transformation that drastically improves the precision of existing analyses when deciding if a pointer can alias NULL. Our program transformation is based on Global Value Numbering, a scheme inspired from compiler optimizations literature. It allows even a flow-insensitive analysis to make use of branch conditions such as checking if a pointer is NULL and gain precision. We perform experiments on real-world code to measure the overhead in performing the transformation and the improvement in the precision of the analysis. We show that the precision improves from 86.56% to 98.05%, while the overhead is insignificant.