A Principled Approach to Selective Context Sensitivity for Pointer Analysis

Abstract

Context sensitivity is an essential technique for ensuring high precision in static analyses. It has been observed that applying context sensitivity partially, only on a select subset of the methods, can improve the balance between analysis precision and speed. However, existing techniques are based on heuristics that do not provide much insight into what characterizes this method subset. In this work, we present a more principled approach for identifying precision-critical methods, based on general patterns of value flows that explain where most of the imprecision arises in context-insensitive pointer analysis. Using this theoretical foundation, we present an efficient algorithm, Z IPPER , to recognize these flow patterns in a given program and employ context sensitivity accordingly. We also present a variant, Z IPPER e , that additionally takes into account which methods are disproportionally costly to analyze with context sensitivity. Our experimental results on standard benchmark and real-world Java programs show that Z IPPER preserves effectively all of the precision (98.8%) of a highly precise conventional context-sensitive pointer analysis (2-object-sensitive with a context-sensitive heap, 2obj for short), with a substantial speedup (on average, 3.4× and up to 9.4×), and that Z IPPER e preserves 94.7% of the precision of 2obj, with an order-of-magnitude speedup (on average, 25.5× and up to 88×). In addition, for 10 programs that cannot be analyzed by 2obj within a three-hour time limit, on average Z IPPER e can guide 2obj to finish analyzing them in less than 11 minutes with high precision compared to context-insensitive and introspective context-sensitive analyses.

Making pointer analysis more precise by unleashing the power of selective context sensitivity

“…In other words, for past selective context-sensitive analyses, the degree of precision (typically: the proportion of the program to be analyzed context-sensitively) is chosen to be approximately at a point where further improving it would render the analysis non-scalable. According to previous work, treating context-sensitively even a small set of methods may significantly hinder scalability, for the łwrongž choice of methods [Li et al 2020]. Now it seems that we are trapped: if a small step towards precision may hit the scalability wall (in the precision and efficiency balance made by each selective context-sensitivity approach), how can we reap a further noticeable precision improvement in a general, policy-agnostic meta-framework?…”

“…Analyzing more methods context-sensitively may not incur an efficiency decline (sometimes it may even accelerate an analysis as more false data flows are pruned away), as long as the right methods are chosen. Avoiding scalability-threat methods is essential [Li et al 2020;Smaragdakis et al 2014], but the net number of methods analyzed context-sensitively is not.…”

“…By rules in Figure 6, PA-Unity 𝑆 is a standard Andersen-style pointer analysis, and the only difference from other selective context-sensitive pointer analyses is selectCS. Selecting different contexts for methods affects precision but not soundness [Jeon et al 2018;Jeong et al 2017;Li et al 2018bLi et al , 2020Smaragdakis et al 2014 (We informally also use the convenient forms łless precisež, as a synonym of łat most as precisež, and łmore precisež as a synonym of the converse. łLess than or equallyž and łmore than or equallyž would have been more accurate, but inconvenient.…”

“…To deal with this problem, in the past years, various selective context-sensitivity approaches have been presented, based on different insights and policies. For example, the target methods could be selected according to expert experience [WALA 2018], program patterns [Li et al 2018a[Li et al , 2020, abstracted memory capacity [Li et al 2018b], parameterized heuristics [Hassanshahi et al 2017;Smaragdakis et al 2014], or machine learning approaches [Jeon et al 2018;Jeong et al 2017]. In addition, in selective context sensitivity, some approaches apply the same context sensitivity to the selected methods [Hassanshahi et al 2017;Li et al 2018aLi et al , 2020Smaragdakis et al 2014], while in other approaches context elements and lengths may vary for different subsets of the selected methods [Jeon et al 2019;Jeong et al 2017;Li et al 2018b].…”

Effects of Program Representation on Pointer Analyses — An Empirical Study

“…Researchers have proposed various approaches to enhance the precision and soundness of static analyses [6,9,10,14,17,26,30,31]. They use program analysis frameworks to prototype and evaluate their algorithms.…”