Boomerang: Demand-Driven Flow- and Context-Sensitive Pointer Analysis for Java

Späth, Johannes; Quang, Lisa Nguyen; Ali, Karim; Bodden, Eric

doi:10.4230/lipics.ecoop.2016.22

Cited by 27 publications

(14 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Demand-driven analyses (e.g., [Shang et al 2012;Späth et al 2016;Sridharan and Bodík 2006;Sridharan et al 2005;Sui and Xue 2016;Wang et al 2017;Yan et al 2011]) typically only compute points-to information for program points that may affect a particular site of interest for specific clients. In contrast, the Zipper and Zipper e analyses as well as other whole-program pointer analyses [Bravenboer and Smaragdakis 2009;Hassanshahi et al 2017;Jeon et al 2019Jeon et al , 2018Jeong et al 2017;Hendren 2003, 2006;Li et al 2018b;Milanova et al 2002Milanova et al , 2005Smaragdakis et al 2011Smaragdakis et al , 2014Tan et al , 2017Thiessen and Lhoták 2017;Whaley and Lam 2004] compute points-to information for all sites, thereby providing information for all possible clients.…”

Section: Related Workmentioning

confidence: 99%

A Principled Approach to Selective Context Sensitivity for Pointer Analysis

Tan

Møller

et al. 2020

ACM Trans. Program. Lang. Syst.

View full text Add to dashboard Cite

Context sensitivity is an essential technique for ensuring high precision in static analyses. It has been observed that applying context sensitivity partially, only on a select subset of the methods, can improve the balance between analysis precision and speed. However, existing techniques are based on heuristics that do not provide much insight into what characterizes this method subset. In this work, we present a more principled approach for identifying precision-critical methods, based on general patterns of value flows that explain where most of the imprecision arises in context-insensitive pointer analysis. Using this theoretical foundation, we present an efficient algorithm, Z IPPER , to recognize these flow patterns in a given program and employ context sensitivity accordingly. We also present a variant, Z IPPER e , that additionally takes into account which methods are disproportionally costly to analyze with context sensitivity. Our experimental results on standard benchmark and real-world Java programs show that Z IPPER preserves effectively all of the precision (98.8%) of a highly precise conventional context-sensitive pointer analysis (2-object-sensitive with a context-sensitive heap, 2obj for short), with a substantial speedup (on average, 3.4× and up to 9.4×), and that Z IPPER e preserves 94.7% of the precision of 2obj, with an order-of-magnitude speedup (on average, 25.5× and up to 88×). In addition, for 10 programs that cannot be analyzed by 2obj within a three-hour time limit, on average Z IPPER e can guide 2obj to finish analyzing them in less than 11 minutes with high precision compared to context-insensitive and introspective context-sensitive analyses.

show abstract

Section: Related Workmentioning

confidence: 99%

A Principled Approach to Selective Context Sensitivity for Pointer Analysis

Tan

Møller

et al. 2020

ACM Trans. Program. Lang. Syst.

View full text Add to dashboard Cite

show abstract

“…In case multiple possible concrete types are found, one possibility is to optimize the pipeline separately for each of them and then branch at run-time based on the actual type. Since we typically only need the type information for a small number of expressions in the program, a demand-driven analysis [Späth et al 2016;Sridharan and Bodík 2006], which only analyzes the relevant part of the code, is a good fit.…”

Section: Phase 1: Pre-analysismentioning

confidence: 99%

“…(That may happen if the stream is created neither from a collection nor from static methods such as IntStream.of.) Incorporating a full-fledged pointer analysis, such as Boomerang, [Späth et al 2016] can likely help the analysis in these cases. The analysis also experiences imprecision when the pipeline structure depends on branching (for example when an intermediate operation is applied to a stream only under some conditions, as in line 160).…”

Section: Rq2: Evaluation On General Programsmentioning

confidence: 99%

Eliminating abstraction overhead of Java stream pipelines using ahead-of-time program optimization

Møller

2020

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

Java 8 introduced streams that allow developers to work with collections of data using functional-style operations. Streams are often used in pipelines of operations for processing the data elements, which leads to concise and elegant program code. However, the declarative data processing style comes at a cost. Compared to processing the data with traditional imperative language mechanisms, constructing stream pipelines requires extra heap objects and virtual method calls, which often results in significant run-time overheads. In this work we investigate how to mitigate these overheads to enable processing data in the declarative style without sacrificing performance. We argue that ahead-of-time bytecode-to-bytecode transformation is a suitable approach to optimization of stream pipelines, and we present a static analysis that is designed to guide such transformations. Experimental results show a significant performance gain, and that the technique works for realistic stream pipelines. For 10 of 11 micro-benchmarks, the optimizer is able to produce bytecode that is as effective as hand-written imperative-style code. Additionally, 77% of 6879 stream pipelines found in real-world Java programs are optimized successfully.

show abstract

“…Their techniques keep applying transfer functions that infer preconditions backward from given post-conditions until they find any contradictory condition that refutes the queries. Demand-driven analysis [8,10,22,29,30,34] also performs a backward analysis, by which it finds relevant parts of programs to prove given queries and applies context-sensitivity to the functions that require higher precision in the program parts. Their goal of using backward analysis is different from ours in that they use a backward analysis to find contradictory pre-conditions or relevant program parts for proving some queries, while we use it to find major causes of analysis imprecision from some preceding forward analysis results.…”

Section: Cegar Approachmentioning

confidence: 99%

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

2019

View full text Add to dashboard Cite

Researchers have developed various techniques for static analysis of JavaScript to improve analysis precision. To develop such techniques, they first identify causes of the precision losses for unproven properties. While most of the existing work has diagnosed main causes of imprecision in static analysis by manual investigation, manually tracing the imprecision causes is challenging because it requires detailed knowledge of analyzer internals. Recently, several studies proposed to localize the analysis imprecision causes automatically, but these localization techniques work for only specific analysis techniques.In this paper, we present an automatic technique that can trace analysis imprecision causes of JavaScript applications starting from user-selected variables. Given a set of program variables, our technique stops an analysis when any of the variables gets imprecise analysis values. It then traces the imprecise analysis values using intermediate analysis results back to program points where the imprecision first started. Our technique shows the trace information with a new representation called tracing graphs, whose nodes and edges together represent traces from imprecise points to precise points. In order to detect major causes of analysis imprecision automatically, we present four node/edge patterns in tracing graphs for common imprecision causes. We formalized the technique of generating tracing graphs and identifying patterns, and implemented them on SAFE, a state-of-the-art JavaScript static analyzer with various analysis configurations, such as contextsensitivity, loop-sensitivity, and heap cloning. Our evaluation demonstrates that the technique can easily find 96 % of the major causes of the imprecision problems in 17 applications by only automatic detection in tracing graphs using the patterns, and selectively adopting various advanced techniques can eliminate the found causes of imprecision. ACM CCS 2012Software and its engineering → Software verification; Automated static analysis;

show abstract

Boomerang: Demand-Driven Flow- and Context-Sensitive Pointer Analysis for Java

Cited by 27 publications

References 0 publications

A Principled Approach to Selective Context Sensitivity for Pointer Analysis

A Principled Approach to Selective Context Sensitivity for Pointer Analysis

Eliminating abstraction overhead of Java stream pipelines using ahead-of-time program optimization

Automatically Tracing Imprecision Causes in JavaScript Static Analysis

Contact Info

Product

Resources

About