Calling-to-reference context translation via constraint-guided CFL-reachability

CaiCheng,; ZhangQirun,; ZuoZhiqiang,; NguyenKhanh,; XuGuoqing,; Su, Zhendong

doi:10.1145/3296979.3192378

Cited by 3 publications

(3 citation statements)

References 71 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…All the context-sensitive pointer analyses that were previously formulated in terms of CFLreachability [Cai et al 2018;Shang et al 2012;Sridharan and Bodík 2006;Thiessen and Lhoták 2017;Xu et al 2009] operate on a graph representation of the program, known as Pointer Assignment Graph (PAG). However, only callsite-sensitivity is assumed.…”

Section: Pointer Assignment Graphmentioning

confidence: 99%

“…The Pointer Assignment Graphs (PAGs) have been widely used in formulating callsite-contextsensitive pointer analyses in terms of CFL reachability [Cai et al 2018;Shang et al 2012;Sridharan and Bodík 2006;Thiessen and Lhoták 2017;Xu et al 2009], and are recently also used for facilitating the incrementalization and parallelization of Andersen's pointer analysis [Liu et al 2019].…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity

Xue

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Object-sensitivity is widely used as a context abstraction for computing the points-to information contextsensitively for object-oriented languages like Java. Due to the combinatorial explosion of contexts in large programs, k-object-sensitive pointer analysis (under k-limiting), denoted k-obj, is scalable only for small values of k, where k ⩽ 2 typically. A few recent solutions attempt to improve its efficiency by instructing k-obj to analyze only some methods in the program context-sensitively, determined heuristically by a preanalysis. While already effective, these heuristics-based pre-analyses do not provide precision guarantees, and consequently, are limited in the efficiency gains achieved. We introduce a radically different approach, Eagle, that makes k-obj run significantly faster than the prior art while maintaining its precision. The novelty of Eagle is to enable k-obj to analyze a method with partial context-sensitivity, i.e., context-sensitively for only some of its selected variables/allocation sites. Eagle makes these selections during a lightweight pre-analysis by reasoning about context-free-language (CFL) reachability at the level of variables/objects in the program, based on a new CFL-reachability formulation of k-obj. We demonstrate the advances made by Eagle by comparing it with the prior art in terms of a set of popular Java benchmarks and applications. CCS Concepts: • Theory of computation → Program analysis.

show abstract

Section: Pointer Assignment Graphmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity

Xue

2019

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…That is, CFL-reachability is a kind of graph reachability problem with path constraints given by context-free languages. It is an important problem underlying some fundamental static code analysis like data flow analysis and program slicing [29], alias analysis [8,36], points-to analysis [22] and other [7,18,27], and graph database query evaluation [3,14,16,37].…”

Section: Introductionmentioning

confidence: 99%

Rational index of bounded-oscillation languages

Shemetova¹,

Okhotin²,

Grigorev³

2020

Preprint

View full text Add to dashboard Cite

The rational index of a context-free language L is a function f (n), such that for each regular language R recognized by an automaton with n states, the intersection of L and R is either empty or contains a word shorter than f (n). It is known that the context-free language (CFL-)reachability problem and Datalog query evaluation for context-free languages (queries) with the polynomial rational index is in NC, while these problems is P-complete in the general case. We investigate the rational index of bounded-oscillation languages and show that it is of polynomial order. We obtain upper bounds on the values of the rational index for general bounded-oscillation languages and for some of its previously studied subclasses.

show abstract

Eagle

Xue

2021

ACM Trans. Softw. Eng. Methodol.

View full text Add to dashboard Cite

Object sensitivity is widely used as a context abstraction for computing the points-to information context-sensitively for object-oriented programming languages such as Java. Due to the combinatorial explosion of contexts in large object-oriented programs, k -object-sensitive pointer analysis (under k -limiting), denoted k -obj , is often inefficient even when it is scalable for small values of k , where k ⩽ 2 holds typically. A recent popular approach for accelerating k -obj trades precision for efficiency by instructing k -obj to analyze only some methods in a program context-sensitively, determined heuristically by a pre-analysis. In this article, we investigate how to develop a fundamentally different approach, Eagle , for designing a pre-analysis that can make k -obj run significantly faster while maintaining its precision. The novelty of Eagle is to enable k -obj to analyze a method with partial context sensitivity (i.e., context-sensitively for only some of its selected variables/allocation sites) by solving a context-free-language (CFL) reachability problem based on a new CFL-reachability formulation of k -obj . By regularizing one CFL for specifying field accesses and using another CFL for specifying method calls, we have formulated Eagle as a fully context-sensitive taint analysis (without k -limiting) that is both effective (by selecting the variables/allocation sites to be analyzed by k -obj context-insensitively so as to reduce the number of context-sensitive facts inferred by k -obj in the program) and efficient (by running linearly in terms of the number of pointer assignment edges in the program). As Eagle represents the first precision-preserving pre-analysis, our evaluation focuses on demonstrating its significant performance benefits in accelerating k -obj for a set of popular Java benchmarks and applications, with call graph construction, may-fail-casting, and polymorphic call detection as three important client analyses.

show abstract

Calling-to-reference context translation via constraint-guided CFL-reachability

Cited by 3 publications

References 71 publications

Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity

Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity

Rational index of bounded-oscillation languages

Eagle

Contact Info

Product

Resources

About