Context-Sensitive Points-to Analysis: Is It Worth It?

Abstract

Abstract. We present the results of an empirical study evaluating the precision of subset-based points-to analysis with several variations of context sensitivity on Java benchmarks of significant size. We compare the use of call site strings as the context abstraction, object sensitivity, and the BDD-based context-sensitive algorithm proposed by Zhu and Calman, and by Whaley and Lam. Our study includes analyses that context-sensitively specialize only pointer variables, as well as ones that also specialize the heap abstraction. We measure both characteristics of the points-to sets themselves, as well as effects on the precision of client analyses. To guide development of efficient analysis implementations, we measure the number of contexts, the number of distinct contexts, and the number of distinct points-to sets that arise with each context sensitivity variation. To evaluate precision, we measure the size of the call graph in terms of methods and edges, the number of devirtualizable call sites, and the number of casts statically provable to be safe.The results of our study indicate that object-sensitive analysis implementations are likely to scale better and more predictably than the other approaches; that object-sensitive analyses are more precise than comparable variations of the other approaches; that specializing the heap abstraction improves precision more than extending the length of context strings; and that the profusion of cycles in Java call graphs severely reduces precision of analyses that forsake context sensitivity in cyclic regions.

Call graphs for languages with parametric polymorphism

“…In Java, context sensitivity has been found to improve precision of pointer information. On call graph precision, its effect is more modest (Lhoták and Hendren 2006;Lhoták and Hendren 2008;Smaragdakis et al 2011Smaragdakis et al , 2014, unless very sophisticated context abstractions are used (Feng et al 2015). In Scala, where use of generic type parameters and abstract type members is pervasive, our static-type-based context-sensitive analysis that can precisely model these features significantly improves call graph precision.…”

Andromeda: Accurate and Scalable Security Analysis of Web Applications

“…Livshits and Lam [17] analyze Java EE applications by tracking taint through heap-allocated objects. Their solution requires prior computation of Whaley and Lam's flow-insensitive, context-sensitive may-points-to analysis, based on Binary Decision Diagrams (BDDs) [38], which limits the scalability of the analysis [16]. The pointsto relation is the same for the entire program ignoring control flow.…”

Constructing Call Graphs of Scala Programs

“…Roughly speaking, most call graph construction algorithms can be classified as being either type-based or flow-based [7,13,14,17,18]. The former class of algorithms uses only local information given by static types to determine possible call targets, whereas the latter analyzes the program's data flow.…”