Parameterized object sensitivity for points-to analysis for Java

Abstract

The goal of points-to analysis for Java is to determine the set of objects pointed to by a reference variable or a reference object field. We present object sensitivity, a new form of context sensitivity for flow-insensitive points-to analysis for Java. The key idea of our approach is to analyze a method separately for each of the object names that represent run-time objects on which this method may be invoked. To ensure flexibility and practicality, we propose a parameterization framework that allows analysis designers to control the tradeoffs between cost and precision in the object-sensitive analysis.Side-effect analysis determines the memory locations that may be modified by the execution of a program statement. Def-use analysis identifies pairs of statements that set the value of a memory location and subsequently use that value. The information computed by such analyses has a wide variety of uses in compilers and software tools. This work proposes new versions of these analyses that are based on object-sensitive points-to analysis.We have implemented two instantiations of our parameterized object-sensitive points-to analysis. On a set of 23 Java programs, our experiments show that these analyses have comparable cost to a context-insensitive points-to analysis for Java which is based on Andersen's analysis for C. Our results also show that object sensitivity significantly improves the precision of side-effect analysis and call graph construction, compared to (1) context-insensitive analysis, and (2) context-sensitive points-to analysis that models context using the invoking call site. These experiments demonstrate that object-sensitive analyses can achieve substantial precision improvement, while at the same time remaining efficient and practical.A preliminary version of this article appeared in

A Correspondence between Two Approaches to Interprocedural Analysis in the Presence of Join

“…However, other works [MRR05,LH08] have shown that, in practice, using object-sensitivity [MRR02,SBL11] to distinguish calling contexts for object-oriented programs is more precise and scalable than k-CFA. Though call string and object-sensitive contexts are incomparable in theory, an interesting empirical evaluation in future work would be to compare the precision of ∞-CFA with analyses using object-sensitive contexts.…”

Heap Decomposition Inference with Linear Programming

“…The language is similar to Featherweight Java (FJ) [18], where notation • represents a sequence of •'s. The most noticeable difference here is expressions are ANormal, a form commonly used for specifying alias analyses over Java programs (e.g., [25]). In this form, (single) expressions include assignment x = y, field read x = y.fd, field update x.fd = y, method invocation x = y.md(z) and object instantiation x = new τ .…”

“…Cypress implements a (field-sensitive) k-object context-sensitive algorithm [25]. To create a stress test for scalability, we choose an expensive form: k in our algorithm is not fixed to a (usually small) constant.…”

Finding concurrency-related bugs using random isolation

“…For example, let Pts be the points-to relation computed via a flow-insensitive, object-sensitive points-to analysis in the style of [8], and CG be an object-sensitive call graph. 6 Because these two analysis artifacts are object-sensitive, their respective dataflow facts make a distinction between those for ψ and those for ψ.…”

“…6 An object-sensitive call graph CG models the interprocedural control flow of a program: there is a node in CG for each method of the program for each context in which it can be invoked [8]. An object-sensitive points-to analysis associates points-to facts with the nodes of CG, thus computing different points-to facts for different object contexts of the same method.…”