Hybrid context-sensitivity for points-to analysis

Abstract

Context-sensitive points-to analysis is valuable for achieving high precision with good performance. The standard flavors of contextsensitivity are call-site-sensitivity (kCFA) and object-sensitivity. Combining both flavors of context-sensitivity increases precision but at an infeasibly high cost. We show that a selective combination of call-site-and object-sensitivity for Java points-to analysis is highly profitable. Namely, by keeping a combined context only when analyzing selected language features, we can closely approximate the precision of an analysis that keeps both contexts at all times. In terms of speed, the selective combination of both kinds of context not only vastly outperforms non-selective combinations but is also faster than a mere object-sensitive analysis. This result holds for a large array of analyses (e.g., 1-object-sensitive, 2-object-sensitive with a context-sensitive heap, type-sensitive) establishing a new set of performance/precision sweet spots.

Set-based pre-processing for points-to analysis

“…heap cloning) for different kinds of context-sensitivity: call-sitesensitive [17,18] (1call, 1call+H), object-sensitive [12,13] (1obj, 1obj+H, 2obj+H), and type-sensitive [19] (2type+H). (Comparing the precision of these known algorithms is outside the scope of this work, but such measurements for our exact setting can be found in past literature [10]. ) We used two different intermediate representations (IRs) in our evaluation.…”

“…(The context variables are used to vary the precision and performance of the analysis, but the mechanism for doing so is not important for our current discussion. A concise 9-rule model sufficient to express a large variety of points-to analyses can be found in Kastrinis et al [10].) VarPointsTo(var, ctx, heap, hctx) <-Alloc(var,heap).…”

“…For instance, as can be seen in models of various kinds of context-sensitivity [10,19], new contexts are created at method call sites and the context remains the same throughout the method body. This means that local variables of the same calling method have the same context throughout the method body, i.e., hold the same values as far as the analysis is concerned.…”

Class hierarchy complementation

“…Consider performing a static analysis of a large Java program. For instance, the Doop framework [6,13] integrates points-to analysis with call-graph construction, computation of heap object points-to information, and various client analyses (escape analysis, virtual call elimination, class cast elimination). Doop uses Soot as a front-end and post-processes the facts generated by Soot.…”

“…We encountered most of these benchmarks in our own work doing static program analysis with the Doop framework [6,13]. For many of the benchmarks it was, upon original encounter, an unexpected discovery that they could not be analyzed due to dependencies to unknown classes in other libraries.…”