Design and implementation of sparse global analyses for C-like languages

Oh, Hakjoo; Heo, Kihong; Lee, Wonchan; Lee, Woosuk; Yi, Kwangkeun

doi:10.1145/2254064.2254092

Cited by 60 publications

(29 citation statements)

References 55 publications

(121 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Other interesting dimensions to consider are field sensitivity [32] and widening, notably widening with thresholds. Finally, we plan to explore other effective ways to design hybrid top-down and bottom-up analysis [54], and investigate sparse inter-procedural analysis for better performance [42].…”

Section: Discussionmentioning

confidence: 99%

Evaluating Design Tradeoffs in Numeric Static Analysis for Java

Wei

Mardziel

Ruef

et al. 2018

Programming Languages and Systems

View full text Add to dashboard Cite

Abstract. Numeric static analysis for Java has a broad range of potentially useful applications, including array bounds checking and resource usage estimation. However, designing a scalable numeric static analysis for real-world Java programs presents a multitude of design choices, each of which may interact with others. For example, an analysis could handle method calls via either a top-down or bottom-up interprocedural analysis. Moreover, this choice could interact with how we choose to represent aliasing in the heap and/or whether we use a relational numeric domain, e.g., convex polyhedra. In this paper, we present a family of abstract interpretation-based numeric static analyses for Java and systematically evaluate the impact of 162 analysis configurations on the DaCapo benchmark suite. Our experiment considered the precision and performance of the analyses for discharging array bounds checks. We found that top-down analysis is generally a better choice than bottom-up analysis, and that using access paths to describe heap objects is better than using summary objects corresponding to pointsto analysis locations. Moreover, these two choices are the most significant, while choices about the numeric domain, representation of abstract objects, and context-sensitivity make much less difference to the precision/performance tradeoff.

show abstract

Section: Discussionmentioning

confidence: 99%

Evaluating Design Tradeoffs in Numeric Static Analysis for Java

Wei

Mardziel

Ruef

et al. 2018

Programming Languages and Systems

View full text Add to dashboard Cite

show abstract

“…Other techniques handle pointers typically by staging the analysis using a pre-analysis to approximate possible definition sites and use sites [3,8,14]. However, as discussed previously, that approach cannot support reachability without sacrificing analysis precision or sparseness.…”

Section: Related Workmentioning

confidence: 99%

“…Previous work on dataflow analysis has demonstrated that sparse analysis is a powerful technique for improving performance of many kinds of static analysis without sacrificing precision [7,8,14,15,20,21], compared to more basic dataflow analysis frameworks [12,13]. The key idea in sparse analysis is that dataflow should be propagated directly from definitions to uses in the program code, unlike "dense" analysis that propagates dataflow along the control-flow.…”

Section: Introductionmentioning

confidence: 99%

“…One way to build sparse analyses for programs with pointers is to use a staged approach where a pre-analysis computes a sound approximation of the memory addresses that are defined or used at each operation in the code, and then establish def-use edges that the main analysis can use for sparse flowsensitive dataflow propagation [8,14]. Unfortunately, this does not work in our setting, unless the pre-analysis is as precise as the main analysis (and in that case, there would be no need for the main analysis, obviously): If the pre-analysis is flow-insensitive, for example, it would establish def-use edges from both x.a and y.a to r in our example, which would destroy the precision of the main analysis.…”

Section: Introductionmentioning

confidence: 99%

“…Unfortunately, this does not work in our setting, unless the pre-analysis is as precise as the main analysis (and in that case, there would be no need for the main analysis, obviously): If the pre-analysis is flow-insensitive, for example, it would establish def-use edges from both x.a and y.a to r in our example, which would destroy the precision of the main analysis. Note that one of the main results of Oh et al [14] is that, in their setting, approximations in the pre-analysis may lead to less sparseness but it will never affect the precision of the main analysis (due to their use of data dependence instead of def-use chains). However, for a language like JavaScript where most operations may throw exceptions, their algorithm largely degrades to a dense analysis if reachability is involved.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Sparse Dataflow Analysis with Pointers and Reachability

Madsen

Möller

2014

Static Analysis

View full text Add to dashboard Cite

Abstract. Many static analyzers exploit sparseness techniques to reduce the amount of information being propagated and stored during analysis. Although several variations are described in the literature, no existing technique is suitable for analyzing JavaScript code. In this paper, we point out the need for a sparse analysis framework that supports pointers and reachability. We present such a framework, which uses static single assignment form for heap addresses and computes def-use information on-the-fly. We also show that essential information about dominating definitions can be maintained efficiently using quadtrees. The framework is presented as a systematic modification of a traditional dataflow analysis algorithm. Our experimental results demonstrate the effectiveness of the technique for a suite of JavaScript programs. By also comparing the performance with an idealized staged approach that computes pointer information with a pre-analysis, we show that the cost of computing def-use information on-the-fly is remarkably small.

show abstract

Selective conjunction of context‐sensitivity and octagon domain toward scalable and precise global static analysis

Heo

2017

Softw Pract Exp

View full text Add to dashboard Cite

We present a practical technique for achieving a scalable and precise global static analysis by selectively applying context-sensitivity and the octagon relational domain. For precise analysis, context-sensitivity and relational analysis are key properties, but it has been hard to practically combine both of them. Our approach turns on those precision improvement features only when the analysis is likely to improve the precision to resolve given queries. The guidance comes from an impact pre-analysis that estimates the impact of a fully context-sensitive and relational octagon analysis. We designed a cost-effective pre-analysis and implemented this method in a realistic octagon analysis for full C. The experimental results show that our approach proves eight times more queries, while saving the time cost by 73.1% compared with a partially relational octagon analysis enabled by a syntactic heuristic. > (i.e., no relational information). We observed that, in real C programs, queries that require such inter-procedural reasoning on variable relationships are prevalent (Section 7). Unfortunately, the previous selective X-sensitive analyses estimate each sensitivity separately so that it cannot select those queries. Furthermore, naively combing the existing pre-analyses suffers from the huge cost of the combinatory sensitivities.In this paper, we present a practical technique that selectively combines context-sensitivity and the octagon relational analysis. The basic idea is the existing selective X-sensitive approach [4]. We take both the octagon domain and context-sensitivity into account simultaneously: (1) we design a pre-analysis that conservatively estimates the 'symbiotic' effect of both the fully context-sensitive and fully relational octagon analysis; (2) the pre-analysis predicts where the combination of the two precision-improving techniques will help to prove given queries; and (3) the selective main analysis is derived from the guidance of the pre-analysis results. Our new analysis is different from the previous one [4] in two aspects. First, our analysis is selective both in tracked variable relations and context-sensitivity while the previous approach is selective only in each sensitivity. Second, we propose a cost-effective pre-analysis equipped with the summary-based context-sensitivity [1]. Instead of computing all possible contexts, the new pre-analysis differentiates only a particular set of contexts related to queries that is derived from a backward pre-analysis.Our experimental results show that the selective context-sensitive and relational analysis is precise and scalable. We implemented the selective analysis on top of our Sparrow framework [5]. In experiments with various C benchmarks, the analysis scaled up to 100KLOC and proved 201 queries among 206 queries. In the comparison with the conventional octagon analysis with syntactic variable packing [3], the new analysis proves eight times more queries, saving 73.1% of the analysis's time overhead on average. Contributions Our contributions are ...

show abstract

Design and implementation of sparse global analyses for C-like languages

Cited by 60 publications

References 55 publications

Evaluating Design Tradeoffs in Numeric Static Analysis for Java

Evaluating Design Tradeoffs in Numeric Static Analysis for Java

Sparse Dataflow Analysis with Pointers and Reachability

Selective conjunction of context‐sensitivity and octagon domain toward scalable and precise global static analysis

Contact Info

Product

Resources

About