一句话：提出 PUS，用因果子图求解包含式指针分析约束，显著加速分析并发现多处真实缺陷。
过程间静态分析的关键性能瓶颈是求解指针分析约束。本文提出 PUS，一个面向包含式（inclusion-based）指针分析的高效约束求解器。与 wave、deep propagation 构建整体约束图不同，PUS 每轮只提取对最终不动点有因果影响的小型因果子图，并证明仅处理该子图即可达到相同全局不动点，避免无关传播。在真实大型复杂程序上，PUS 能在普通笔记本上约 10 分钟分析 PostgreSQL 等数百万行代码；相比 wave 和 deep propagation，上下文敏感求解平均快 7 倍以上，上下文不敏感快 2 倍以上，并已在 Linux、Redis、Memcached 等项目发现数十个未知缺陷。
A crucial performance bottleneck in most interprocedural static analyses is solving pointer analysis constraints. We present Pus, a highly efficient solver for inclusion-based pointer analysis. At the heart of Pus is a new constraint solving algorithm that significantly advances the state-of-the-art. Unlike the existing algorithms (i.e., wave and deep propagation) which construct a holistic constraint graph, at each stage Pus only considers partial constraints that causally affect the final fixed-point computation. In each iteration Pus extracts a small causality subgraph and it guarantees that only processing the causality subgraph is sufficient to reach the same global fixed point. Our extensive evaluation of Pus on a wide range of real-world large complex programs yields highly promising results. Pus is able to analyze millions of lines of code such as PostgreSQL in 10 minutes on a commodity laptop. On average, Pus is more than 7× faster in solving context-sensitive constraints, and more than 2× faster in solving context-insensitive constraints compared to the state of the art wave and deep propagation algorithms. Moreover, Pus has been used to find tens of previous unknown bugs in high-profile codebases including Linux, Redis, and Memcached.