Abstract
Object-sensitive pointer analysis (denoted <i>k</i> <small>obj</small> under <inline-formula><tex-math notation="LaTeX">$k$</tex-math></inline-formula> -limiting) for an object-oriented program can be accelerated if context-sensitivity can be selectively applied to only some precision-critical variables/objects in a program. Existing pre-analyses for making such selections, which are performed as whole-program analyses to a program, are developed based on two broad approaches. One approach preserves the precision of object-sensitive pointer analysis but achieves limited speedups by reasoning about all the possible value flows in the program conservatively, while the other approach achieves greater speedups but sacrifices precision (often unduly) by examining only some but not all the value flows in the program heuristically. In this paper, we introduce a new pre-analysis approach, <small>Turner</small> <inline-formula><tex-math notation="LaTeX">$^{\mathcal{m}}$</tex-math></inline-formula> (where <inline-formula><tex-math notation="LaTeX">$\mathcal {m}$</tex-math></inline-formula> stands for modularity), that represents a sweet spot between these two existing ones, as it is designed to enable <i>k</i> <small>obj</small> to run significantly faster than the former approach and achieve significantly better precision than the latter approach. <small>Turner</small> <inline-formula><tex-math notation="LaTeX">$^{\mathcal{m}}$</tex-math></inline-formula> is simple, lightweight yet effective due to two novel aspects in its design. First, we exploit a key observation that some precision-uncritical objects in the program can be approximated based on the object-containment relationship pre-established (from Andersen's analysis). In practice, this approximation introduces only a small degree of imprecision into <i>k</i> <small>obj</small> . Second, leveraging this initial approximation, we apply a novel object reachability analysis to the program by pre-analyzing its methods according to a reverse topological order of its call graph. When pre-analyzing each method, we make use of a simple DFA (Deterministic Finite Automaton) to reason about object reachability intra-procedurally from its entry to its exit along all the possible value flows established by its statements to identify its precision-critical variables/objects. In practice, this new modular object reachability analysis, which runs linearly in terms of the number of statements in the program, introduces again only a small loss of precision into <i>k</i> <small>obj</small> . We have validated <small>Turner</small> <inline-formula><tex-math notation="LaTeX">$^{\mathcal{m}}$</tex-math></inline-formula> with an open-source implementation in <small>Soot</small> (already publicly available) against the state of the art by using a set of 12 widely used Java benchmarks and applications.
Published Version
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a callDisclaimer: All third-party content on this website/platform is and will remain the property of their respective owners and is provided on "as is" basis without any warranties, express or implied. Use of third-party content does not indicate any affiliation, sponsorship with or endorsement by them. Any references to third-party content is to identify the corresponding services and shall be considered fair use under The CopyrightLaw.
