Refinement-based context-sensitive points-to analysis for Java

Abstract

We present a scalable and precise context-sensitive points-to analysis with three key properties: (1) filtering out of unrealizable paths, (2) a context-sensitive heap abstraction, and (3) a context-sensitive call graph. Previous work [21] has shown that all three properties are important for precisely analyzing large programs, e.g., to show safety of downcasts. Existing analyses typically give up one or more of the properties for scalability.We have developed a refinement-based analysis that succeeds by simultaneously refining handling of method calls and heap accesses, allowing the analysis to precisely analyze important code while entirely skipping irrelevant code. The analysis is demanddriven and client-driven, facilitating refinement specific to each queried variable and increasing scalability. In our experimental evaluation, our analysis proved the safety of 61% more casts than one of the most precise existing analyses across a suite of large benchmarks. The analysis checked the casts in under 13 minutes per benchmark (taking less than 1 second per query) and required only 35MB of memory, far less than previous approaches.

Call graphs for languages with parametric polymorphism

“…a high cost, and much work has been done to balance analysis cost against the precision of the analysis results (Sridharan and Bodík 2006;Xu and Rountev 2008;Xu et al 2009;Yan et al 2011;Bravenboer and Smaragdakis 2009;Smaragdakis et al 2011;Kastrinis and Smaragdakis 2013;Smaragdakis et al 2014). In Java, context sensitivity has been found to improve precision of pointer information.…”

Contribution-based call stack abstraction for call string based pointer analysis

“…Pointer analysis has been a hot topic in program analysis for many years [1,[3][4][5][6][7][8][9][10][11][12]20,23,[27][28][29][35][36][37][38][39][40]. We study the pointer alias analysis problem for dependence analysis of heap locations in Ref.…”

“…Different form that work, this paper mainly concerns on the context-sensitive points-to analysis problem. Recently, more and more researches have confirmed the importance of context-sensitivity in assuring the precision of pointer analysis [5][6][7][8][9][10][11]28,29]. For calling context abstraction, Sharir and Pnueli first propose the call string based approach and the functional approach [2].…”

“…Some researches also suggest that to be precise and scalable, a pointer analysis should better be carried out according to the application. So far, there are two typical approaches to make the analysis application-oriented: demand-driven (e.g., [29]) and client-driven (e.g., [35]). Demanddriven algorithms determine which parts of the analysis need to be computed, while client-driven analyses determine which parts need to be computed using more precision [35].…”

Semi-static Detection of Runtime Type Errors in Component-Based Java Programs

“…There have been some works using static analysis to detect runtime type errors caused by unsafe casts [5][6][7][8]. However, these works do not consider runtime type discrepancies caused by class loaders and thus cannot detect many of the runtime type errors.…”