On-demand dynamic summary-based points-to analysis

Abstract

Static analyses can be typically accelerated by reducing redundancies. Modern demand-driven points-to or alias analysis techniques rest on the foundation of Context-Free Language (CFL) reachability. These techniques achieve high precision efficiently for a small number of queries raised in small programs but may still be too slow in answering many queries for large programs in a contextsensitive manner.We present an approach, called DYNSUM, to perform context-sensitive demand-driven points-to analysis fully on-demand by means of computing CFL-reachability summaries without any precision loss. The novelty lies in initially performing a Partial Points-To Analysis (PPTA) within a method, which is field-sensitive but context-independent, to summarize its local points-to relations encountered during a query and reusing this information later in the same or different calling contexts. We have compared DYNSUM with REFINEPTS, a refinement-based analysis, using three clients (safe casting, null dereferencing and factory methods) for a suite of nine Java programs. DYNSUM's average speedups are 1.95¢, 2.28¢ and 1.37¢, respectively. We have also compared DYNSUM with a static approach, which is referred to STASUM here, to show its improved scalability for the same three clients.

An Incremental Points-to Analysis with CFL-Reachability

“…We introduce the state-of-the-art points-to analysis for Java formulated in terms of CFLreachability [26,27,28,36] which uses Spark's PAGs [17] as the program representation. In Section 2.1, we consider the syntax of PAGs and how to represent a Java example as a PAG.…”

“…Demand-driven points-to analysis [11] reduces the cost of analysis by only computing points-to information that is needed by its client analysis or optimisation. The state-of-the-art algorithms for Java [27,26,36] and C [41] are formulated in terms of CFL-reachability initially introduced in [23]. Given a CFL-reachability formulation, demand-driven analyses answer points-to queries as described in Section 2.…”

“…Points-to analysis has been studied extensively in order to improve its scalability, precision or tradeoffs [15,17,33,34], and continues to attract significant attention [10,9,26,25,27,35,30,37,39]. The majority of the previous solutions perform a wholeprogram points-to analysis to exhaustively compute points-to information for all variables in the program, which is often too resource-intensive in practice, especially for large programs.…”

“…The majority of the previous solutions perform a wholeprogram points-to analysis to exhaustively compute points-to information for all variables in the program, which is often too resource-intensive in practice, especially for large programs. Some recent efforts have focused on demand-driven points-to analysis [11,26,27,37], which mostly rely on Context-Free Language (CFL) reachability [22] to perform only the necessary work for a set of variables queried by a client rather than a whole-program analysis to find the points-to information for all its variables.…”

“…Existing solutions address the performance issue from several directions, by using refinement [27,28], (whole-program) pre-analysis [36], ad hoc caching [41], and procedural summarisation [26,25,37]. In this paper, we tackle this issue from a different angle.…”