Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity

Abstract

Object-sensitivity is widely used as a context abstraction for computing the points-to information contextsensitively for object-oriented languages like Java. Due to the combinatorial explosion of contexts in large programs, k-object-sensitive pointer analysis (under k-limiting), denoted k-obj, is scalable only for small values of k, where k ⩽ 2 typically. A few recent solutions attempt to improve its efficiency by instructing k-obj to analyze only some methods in the program context-sensitively, determined heuristically by a preanalysis. While already effective, these heuristics-based pre-analyses do not provide precision guarantees, and consequently, are limited in the efficiency gains achieved. We introduce a radically different approach, Eagle, that makes k-obj run significantly faster than the prior art while maintaining its precision. The novelty of Eagle is to enable k-obj to analyze a method with partial context-sensitivity, i.e., context-sensitively for only some of its selected variables/allocation sites. Eagle makes these selections during a lightweight pre-analysis by reasoning about context-free-language (CFL) reachability at the level of variables/objects in the program, based on a new CFL-reachability formulation of k-obj. We demonstrate the advances made by Eagle by comparing it with the prior art in terms of a set of popular Java benchmarks and applications. CCS Concepts: • Theory of computation → Program analysis.

Making pointer analysis more precise by unleashing the power of selective context sensitivity

“…Precision Metrics. To thoroughly measure precision, we consider the most complete set of precision metrics that were used in recent literature [Jeon et al 2019[Jeon et al , 2018Jeong et al 2017;Kastrinis and Smaragdakis 2013;Li et al 2018aLi et al ,b, 2020Lu and Xue 2019;Minseok Jeon and Oh 2020;Smaragdakis et al 2014]. It consists of three general precision metrics, i.e., the total size of points-to sets for all variables (VarPts), the average size of points-to set per variable (AvgPts), and the number of all may-alias variable pairs (Aliases); and four independently useful client analyses that are often adopted in the literature to measure precision.…”

“…As a proof-of-concept, we introduce Baton, an instantiation of the Unity-Relay framework. Given plenty of existing selective context sensitivity approaches [Hassanshahi et al 2017;Jeon et al 2019;Jeong et al 2017;Li et al 2018aLi et al ,b, 2020Lu and Xue 2019;Minseok Jeon and Oh 2020;Oh et al 2014Oh et al , 2015Smaragdakis et al 2014;Wei and Ryder 2015], the design space of Unity-Relay is large. For more precision improvement, the chosen approaches should be diverse so that they could cover precision-useful methods from different perspectives; and they should exhibit good scalability, as explained in Section 3.3.…”

“…Hence PA-Unity 𝑆 is sound. □ Following existing literature[Kastrinis and Smaragdakis 2013;Li et al 2018b;Lu and Xue 2019;Minseok Jeon and Oh 2020], contexts in points-to results are ignored when measuring the precision of context-sensitive pointer analyses. To this end, we use 𝑝𝑡 PA (𝑥) to represent the points-to set of variable 𝑥 in pointer analysis PA, without contexts, e.g., if pt(𝑐, 𝑥) = {⟨𝑐 𝑖 , 𝑜 𝑖 ⟩} and pt(𝑐 ′ , 𝑥) = {⟨𝑐 𝑗 , 𝑜 𝑗 ⟩} in PA, then 𝑝𝑡 PA (𝑥) = {𝑜 𝑖 , 𝑜 𝑗 }.…”

Chianina: an evolving graph system for flow- and context-sensitive analyses of million lines of C code

“…Demand-driven techniques [9,59,75] match call/return edges on the fly for context sensitivity. A body of techniques have also been proposed to perform selective context sensitivity [32,39,40,42,46,50,57,58,78], so as to find sweatspots between scalability and precision. Systems for Static Analyses.…”

“…Given the limited resources to them, it is hard for them to scale to programs with large codebases such as the Linux kernel. Prior work employs sophisticated treatments that tune the level of sensitivity [39,42,78] or explore different forms of sensitivity [32,46,58], to find sweatspots between scalability, generality, and usefulness. Despite their commendable efforts, these treatments are specific to the applications they are developed for and complicated to implement.…”