A Correspondence between Two Approaches to Interprocedural Analysis in the Presence of Join

Abstract

Abstract. Many interprocedural static analyses perform a lossy join for reasons of termination or efficiency. We study the relationship between two predominant approaches to interprocedural analysis, the summarybased (or functional) approach and the call-strings (or k-CFA) approach, in the presence of a lossy join. Despite the use of radically different ways to distinguish procedure contexts by these two approaches, we prove that post-processing their results using a form of garbage collection renders them equivalent. Our result extends the classic result by Sharir and Pnueli that showed the equivalence between these two approaches in the setting of distributive analysis, wherein the join is lossless.We also empirically compare these two approaches by applying them to a pointer analysis that performs a lossy join. Our experiments on ten Java programs of size 400K-900K bytecodes show that the summary-based approach outperforms an optimized implementation of the k-CFA approach: the k-CFA implementation does not scale beyond k=2, while the summarybased approach proves up to 46% more pointer analysis client queries than 2-CFA. The summary-based approach thus enables, via our equivalence result, to measure the precision of k-CFA with unbounded k, for the class of interprocedural analyses that perform a lossy join.

Accelerating program analyses by cross-program training

“…From (14), (15) and repeatedly applying P1 and P2 in (7), we have (16) T k out ⊆ [C](I test ). From (16) and the condition check on line 7 of ONLINE, we have (17) ∀sum ∈ S k : pre(sum) ⊆ [C](I test ). From (1) and (17), we have (18) S k is a set of applicable summaries.…”

“…Next, it computes the initial set of derived tuples T out by running the instrumented analysis on I test with C and blockSet such that all grounded constraints covered by the summaries in sumSet are blocked (line 3). Next, it iterates until every summary in sumSet is either applied or discarded (line [4][5][6][7][8][9][10][11][12][13][14][15][16][17][18][19]. In each iteration, the algorithm applies every summary whose T pre is contained in T out by adding its T post to T out (line [6][7][8][9][10][11][12].…”

“…In each iteration, the algorithm applies every summary whose T pre is contained in T out by adding its T post to T out (line [6][7][8][9][10][11][12]. If no summary can be applied, to make the analysis proceed, it removes an arbitrary summary from the sumSet and unblocks the grounded constraints covered by it (line [13][14][15][16][17]. Here we only discard one summary instead of all, as with new tuples derived in the next iteration, some summaries might become applicable.…”

“…The online phase is not able to make progress. The algorithm avoids this problem by shrinking the blocking set (lines [14][15][16]. Now, the pre-condition of summary S, {t 0 , t 1 , t 2 }, no longer belongs to blockSet.…”

“…Figure 9 specifies the Datalog rules of our Points-To Analysis. This analysis is adapted from the points-to analysis specified in [16], which computes the points-to information at each program point. It is a summarybased context-and flow-sensitive analysis that applies the IFDS algorithm [20].…”