It is typically used at compile time to find software bugs or to verify high-level correctness properties of programs.
Assuming that the process_items function is free of errors, it is clear that the program is safe: it never references freed memory, and it deletes all the objects that it has constructed.
In order to determine points-to sets, a pointer analysis must be able to name a program's objects.
In general, programs can allocate an unbounded number of objects; but in order to terminate, a pointer analysis can only use a finite set of names.
A typical approximation is to give all the objects allocated on a given line of the program the same name.
Shape analysis can approximate this situation using a summary for the first set of elements, a materialized memory location for element i, and a summary for the remaining uninitialized locations, as follows: After the loop terminates, at line [2], there is no need to keep anything materialized.