Modularly Combining Numeric Abstract Domains with Points-to Analysis, and a Scalable Static Numeric Analyzer for Java

Abstract

This paper contributes to a new abstract domain that combines static numeric analysis and points-to analysis. One particularity of this abstract domain lies in its high degree of modularity, in the sense that the domain is constructed by reusing its combined components as black-boxes. This modularity dramatically eases the proof of its soundness and renders its algorithm intuitive. We have prototyped the abstract domain for analyzing real-world Java programs. Our experimental results show a tangible precision enhancement compared to what is possible by traditional static numeric analysis, and this at a cost that is comparable to the cost of running the numeric and pointer analyses separately.The research leading to these results has received financial help from AX -L'Association des AnciensÉlèves et Diplômés de l'École polytechnique. 5, rue Descartes 75005 PARIS.

Evaluating Design Tradeoffs in Numeric Static Analysis for Java

“…The first heap abstraction we study is based on Fu [25]: use a summary object (SO) to abstract information about multiple heap locations as a single abstract state "variable" [27]. As an example, suppose that Pt(x) = {o} and we encounter the assignment x.f := 5.…”

“…Indeed, the first paper on abstract interpretation [18] used numeric intervals as one example abstract domain, and many subsequent researchers have explored abstract interpretation-based numeric static analysis [13,[22][23][24][25]31].…”

“…For example, several works have considered the impact of the choice of numeric domain (e.g., intervals vs. convex polyhedra) in trading off precision for performance but not considered other tradeoffs [24,38]. Other works have considered how to integrate a numeric domain with analysis of the heap, but unsoundly model method calls [25] and/or focus on very precise properties that do not scale beyond small programs [23,24]. Some scalability can be recovered by using programmer-specified pre-and postconditions [22].…”

“…) Modeling the flow of data through the heap requires handling pointers and aliasing. We consider three different choices of heap abstraction: using summary objects [25,27], which are weakly updated, to summarize multiple heap locations; access paths [21,52], which are strongly updated ; and a combination of the two.…”

“…We found that using access paths is always a good idea, both for precision and performance, and top-down analysis works better than bottom-up. While summary objects, originally proposed by Fu [25], do help precision for some programs, the benefits are often marginal when considered as a percentage of all checks, so they tend not to outweigh their large performance disadvantage. Lastly, we found that the precision gains for more precise object representations and polyhedra are modest, and performance costs can be magnified by other analysis features.…”