Extending and evaluating flow-insenstitive and context-insensitive points-to analyses for Java

Abstract

This paper presents extensions to Steensgaard's and Andersen's algorithms to handle Java features. Without careful consideration, the handling of these features may affect the correctness, precision, and efficiency of these algorithms. The paper also presents the results of empirical studies. These studies compare the precision and efficiency of these two algorithms and evaluate the effectiveness of handling Java features using alternative approaches. The studies also evaluate the impact of the points-to information provided by these two algorithms on client analyses that use the information.

Efficient field-sensitive pointer analysis for C

“…Furthermore, there have been numerous studies on the relative precision of these two approaches (see e.g. [Liang et al 2001;Foster et al 2000;Hind and Pioli 2000;Shapiro and Horwitz 1997;Das 2000;Das et al 2001], with the results confirming that set-constraints offer useful improvements in pre- Fig. 12.…”

“…Algorithms for field-sensitive analysis are harder to develop and implement, which may explain why they have received less attention. Furthermore, the majority of those which have been developed are for the analysis of Java [Rountev et al 2001;Liang et al 2001;Whaley and Lam 2002;Lhoták and Hendren 2003]. For C, only three field-sensitive pointer analyses are known [Yong et al 1999;Chandra and Reps 1999a;Johnson and Wagner 2004] and this might stem from the fact that, as will be shown in Section 4, it is a fundamentally harder problem than for Java.…”

“…For Java, there are also several existing extensions to the set-constraint language which support field-sensitive analysis [Rountev et al 2001;Liang et al 2001;Whaley and Lam 2002;Lhoták and Hendren 2003]. However, Java presents a simpler problem than C in this respect, since it does not permit the address of a field to be taken.…”

“…Much work has also been done on context-sensitive analyses which, unlike the analysis studied in this paper, consider a function separately for each calling context (see e.g. [Wilson 1997;Chatterjee et al 1999;Cheng and Hwu 2000;Foster et al 2000;Fähndrich et al 2000;Das et al 2001;Liang et al 2001;Whaley and Lam 2004;Nystrom et al 2004b]). While this can greatly improve precision, it is equivalent to fully inlining each function before performing the analysis and is, generally speaking, impractical for analysing large programs [Whaley and Lam 2004;Nystrom et al 2004a].…”

“…Furthermore, these constraints are considerably more expensive than those for dereferencing a data pointer, since they cause non-trivial value flow. Unfortunately, the overall picture is complicated by a study showing little difference in precision between a fieldbased and field-sensitive analysis, with the latter also running slower [Liang et al 2001]. They argue that this should be expected from the strong encapsulation supported by Java.…”