2026/02/28 by Peisen Yao, Zinan Gu, Qingkai Shi
Computer Science · #cs.PL
paper · pdf · doi:10.48550/arxiv.2602.01720
Accepted in the Tool Demonstration Track, Joint Conference of ISSTA and SPLASH (SPLASH/ISSTA 2026)
arxiv created 2026/08/02 · arxiv updated 2026/08/04
We present Phoenix, a modular pointer analysis framework for C/C++ that unifies multiple alias analysis algorithms behind a single, stable interface. Phoenix addresses the fragmentation of today's C/C++ pointer analysis ecosystem by cleanly separating IR construction, constraint generation, solver backends, and client-facing queries-making analyses easy to compare, swap, and compose while exposing explicit precision-performance trade-offs. We evaluate two comparisons on 28 GNU coreutils programs: Phoenix-FICI versus SVF-FICI, where both analyses are flow-insensitive and context-insensitive, and Phoenix-FSCS versus SVF-FSCI, where the former is flow- and context-sensitive and the latter is flow-sensitive but context-insensitive. Phoenix-FICI is faster on all benchmarks, with a maximum speedup of 2.88x. For the second comparison, Phoenix-FSCS is faster on 13 benchmarks, slower on 14, and tied on one, with a maximum speedup of 2.91x. In production, Phoenix serves as the analysis substrate for static analysis and fuzzing tools that have uncovered hundreds of new bugs in open-source software and industrial deployments.