On abstraction refinement for program analyses in Datalog

Zhang, Xin; Mangal, Ravi; Grigore, Radu; Naik, Mayur; Yang, Hongseok

doi:10.1145/2594291.2594327

Cited by 70 publications

(55 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Note that existing parametric program analyses are typically monotone with respect to their parameters; that is, the analysis precision is monotonically increasing (or decreasing) with respect to the parameters of the analysis (e.g. [Jeong et al 2017;Zhang et al 2014]). That is, if p ⊑ p ′ then proved(F P (p)) ⊆ proved(F P (p ′ )) (or proved(F P (p)) ⊇ proved(F P (p ′ ))).…”

Section: Parametric Program Analysismentioning

confidence: 99%

“…Our work presents a new instance of parametric program analysis. Previously, parametric program analyses have been used for context-sensitivity [Jeong et al 2017;Oh et al 2014;Tan et al 2017;Zhang et al 2014], flow-sensitivity [Oh et al 2015], variable clustering for relational analysis [Heo et al 2016], and widening thresholds [Cha et al 2016]. Typically, the goal of these analyses is to find a parameter which is as scalable as possible while sacrificing as little precision as possible.…”

Section: Parametric and Data-driven Program Analysismentioning

confidence: 99%

See 1 more Smart Citation

Precise and scalable points-to analysis via data-driven context tunneling

Jeon

Jeong

2018

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We present context tunneling, a new approach for making k -limited context-sensitive points-to analysis precise and scalable. As context-sensitivity holds the key to the development of precise and scalable points-to analysis, a variety of techniques for context-sensitivity have been proposed. However, existing approaches such as k -call-site-sensitivity or k -object-sensitivity have a significant weakness that they unconditionally update the context of a method at every call-site, allowing important context elements to be overwritten by more recent, but not necessarily more important, context elements. In this paper, we show that this is a key limiting factor of existing context-sensitive analyses, and demonstrate that remarkable increase in both precision and scalability can be gained by maintaining important context elements only. Our approach, called context tunneling, updates contexts selectively and decides when to propagate the same context without modification. We attain context tunneling via a data-driven approach. The effectiveness of context tunneling is very sensitive to the choice of important context elements. Even worse, precision is not monotonically increasing with respect to the ordering of the choices. As a result, manually coming up with a good heuristic rule for context tunneling is extremely challenging and likely fails to maximize its potential. We address this challenge by developing a specialized data-driven algorithm, which is able to automatically search for high-quality heuristics over the non-monotonic space of context tunneling. We implemented our approach in the Doop framework and applied it to four major flavors of context-sensitivity: call-site-sensitivity, object-sensitivity, type-sensitivity, and hybrid context-sensitivity. In all cases, 1-context-sensitive analysis with context tunneling far outperformed deeper context-sensitivity with k =2 in both precision and scalability.

show abstract

Section: Parametric Program Analysismentioning

confidence: 99%

Section: Parametric and Data-driven Program Analysismentioning

confidence: 99%

Precise and scalable points-to analysis via data-driven context tunneling

Jeon

Jeong

2018

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…Several other approaches exist that selectively refine the precision of points-to analysis in accordance with the needs of a given client analysis [Guyer and Lin 2003;Sridharan and Bodík 2006;Zhang et al 2014]. Our approach is empirically more scalable than some of these approaches.…”

Section: Novelty Of Our Approachmentioning

confidence: 99%

“…This technique has been found to be both more scalable and more precise than other alternatives [Lhoták and Hendren 2006;Smaragdakis et al 2011]. Several recently proposed points-to analysis approaches are based on object sensitivity [Smaragdakis et al 2011;Tan et al 2016;Zhang et al 2014]. It has also been implemented in popular static analysis tools such as Wala [Wala [n. d.]], Doop [Doop [n. d.]], and Petablox [Petablox [n. d.]].…”

Section: Introductionmentioning

confidence: 99%

“…A basic idea that has been employed in the literature to deal with this conundrum is clientdriven refinement [Guyer and Lin 2003;Sridharan and Bodík 2006;Zhang et al 2014]. The intuition here is that given a specific client query regarding the points-to set of a given variable, a subset of method invocations that are pertinent to resolving the query are somehow identified.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Refinement in object-sensitivity points-to analysis via slicing

Rama

Komondoor²,

Sharma³

2018

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Object sensitivity analysis is a well-known form of context-sensitive points-to analysis. This analysis is parameterized by a bound on the names of symbolic objects associated with each allocation site. In this paper, we propose a novel approach based on object sensitivity analysis that takes as input a set of client queries, and tries to answer them using an initial round of inexpensive object sensitivity analysis that uses a low object-name length bound at all allocation sites. For the queries that are answered unsatisfactorily, the approach then pin points łbadž points-to facts, which are the ones that are responsible for the imprecision. It then employs a form of program slicing to identify allocation sites that are potentially causing these bad points-to facts to be generated. The approach then runs object sensitivity analysis once again, this time using longer names for just these allocation sites, with the objective of resolving the imprecision in this round. We describe our approach formally, prove its completeness, and describe a Datalog-based implementation of it on top of the Petablox framework. Our evaluation of our approach on a set of large Java benchmarks, using two separate clients, reveals that our approach is more precise than the baseline object sensitivity approach, by around 29% for one of the clients and by around 19% for the other client. Our approach is also more precise on most large benchmarks than a recently proposed approach that uses SAT solvers to identify allocation sites to refine.

show abstract

Rethinking Static Analysis by Combining Discrete and Continuous Reasoning

Naik

2019

Static Analysis

View full text Add to dashboard Cite

On abstraction refinement for program analyses in Datalog

Cited by 70 publications

References 30 publications

Precise and scalable points-to analysis via data-driven context tunneling

Precise and scalable points-to analysis via data-driven context tunneling

Refinement in object-sensitivity points-to analysis via slicing

Rethinking Static Analysis by Combining Discrete and Continuous Reasoning

Contact Info

Product

Resources

About