.png){kind=icon}
.png){kind=icon}
Return
Selecting Context-Sensitivity Modularly for Accelerating Object-Sensitive Pointer Analysis
.png){kind=icon}
PRE
AI
DOI：10.1109/TSE.2022.3162236.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Object-sensitive pointer analysis (denoted kOBJ under k-limiting) for an object-oriented program can be accelerated if context-sensitivity can be selectively applied to only some precision-critical variables/objects in a program. Existing pre-analyses for making such selections, which are performed as whole-program analyses to a program, are developed based on two broad approaches. One approach preserves the precision of object-sensitive pointer analysis but achieves limited speedups by reasoning about all the possible value flows in the program conservatively, while the other approach achieves greater speedups but sacrifices precision (often unduly) by examining only some but not all the value flows in the program heuristically. In this paper, we introduce a new pre-analysis approach, TURNERm (where m stands for modularity), that represents a sweet spot between these two existing ones, as it is designed to enable kOBJ to run significantly faster than the former approach and achieve significantly better precision than the latter approach. TURNERm is simple, lightweight yet effective due to two novel aspects in its design. First, we exploit a key observation that some precision-uncritical objects in the program can be approximated based on the object-containment relationship pre-established (from Andersen's analysis). In practice, this approximation introduces only a small degree of imprecision into kOBJ. Second, leveraging this initial approximation, we apply a novel object reachability analysis to the program by pre-analyzing its methods according to a reverse topological order of its call graph. When pre-analyzing each method, we make use of a simple DFA (Deterministic Finite Automaton) to reason about object reachability intra-procedurally from its entry to its exit along all the possible value flows established by its statements to identify its precision-critical variables/objects. In practice, this new modular object reachability analysis, which runs linearly in terms of the number of statements in the program, introduces again only a small loss of precision into kOBJ. We have validated TURNERm with an open-source implementation in SOOT (already publicly available) against the state of the art by using a set of 12 widely used Java benchmarks and applications.
Keywords:
Object-sensitive pointer analysis
CFL reachability
object containment
modular static analysis
Journal
IF:
5.6
Papers:
2.8K
Citations:
1.1W