Making pointer analysis more precise by unleashing the power of selective context sensitivity

Abstract

Traditional context-sensitive pointer analysis is hard to scale for large and complex Java programs. To address this issue, a series of selective context-sensitivity approaches have been proposed and exhibit promising results. In this work, we move one step further towards producing highly-precise pointer analyses for hard-to-analyze Java programs by presenting the Unity-Relay framework, which takes selective context sensitivity to the next level. Briefly, Unity-Relay is a one-two punch: given a set of different selective context-sensitivity approaches, say S = S1, . . . , Sn, Unity-Relay first provides a mechanism (called Unity)to combine and maximize the precision of all components of S. When Unity fails to scale, Unity-Relay offers a scheme (called Relay) to pass and accumulate the precision from one approach Si in S to the next, Si+1, leading to an analysis that is more precise than all approaches in S. As a proof-of-concept, we instantiate Unity-Relay into a tool called Baton and extensively evaluate it on a set of hard-to-analyze Java programs, using general precision metrics and popular clients. Compared with the state of the art, Baton achieves the best precision for all metrics and clients for all evaluated programs. The difference in precision is often dramatic — up to 71% of alias pairs reported by previously-best algorithms are found to be spurious and eliminated.

Lightweight verification via specialized typecheckers

“…Arbitrary typestate analysis requires a precise alias analysis for soundness; because wholeprogram alias analyses with sufficient precision scale poorly-taking on the order of hours for practical programs [289], despite significant research investment in the problem-typestate analysis is usually considered impractical. To see why aliasing information is necessary, consider a file object of type OpenedFile with two aliases: f and g. If f.close() is called, the type of f changes to ClosedFile.…”

“…In practical imperative programming languages with unrestricted aliasing, inter-procedural may-alias analysis is NP-hard [190], and scaling alias analysis to real programs while maintaining acceptable precision remains an open research problem. State-of-the-art analyses often run for an hour or more on practical programs [289].…”