Practical Objectsensitive Pointsto Analysis for Java

1
Practical Object-sensitive Points-to Analysis for
Java

• Ana Milanova
• Atanas Rountev
• Barbara Ryder
• Rutgers University

2
Points-to Analysis for Java

• Which objects may reference variable x point to?
• Builds a points-to graph

x new A() y new B() x.f y
3
Uses of Points-to Information

• Clients SE tools and compilers
• Side-effect analysis
• Data-flow based testing
• Call graph construction
• Interprocedural analyses
• Program Slicing
• Coverage analysis
• Compiler optimizations

4
Existing Practical Points-to Analyses for Java

• Flow- and context-insensitive
• Extend existing analyses for C
• Context insensitivity inherently compromises
  precision for object-oriented languages
• Goal Introduce context sensitivity and remain
  practical

5
Our Work

• Object sensitivity
• Form of context sensitivity for flow-insensitive
  points-to analysis of OO languages
• Object-sensitive Andersens analysis
• Object sensitivity applicable to other analyses
• Parameterization framework
• Cost vs. precision tradeoff
• Empirical evaluation
• Vs. context-insensitive Andersens analysis

6
Outline

• Imprecision of context-insensitive analysis
• Object-sensitive analysis
• Parameterization
• Empirical results
• Related work
• Summary and future work

7
The Imprecision of Context-insensitive Analysis

• Does not distinguish contexts for instance
  methods and constructors
• States of distinct objects are merged
• Common OO features and idioms
• Encapsulation
• Inheritance
• Containers, maps and iterators

8
Example Imprecision

• class Y extends X
• class A
• X f
• void m(X q)
• this.fq
• A a new A()
• a.m(new X())
• A aa new A()
• aa.m(new Y())

9
Object-sensitive Analysis

• Instance methods and constructors analyzed for
  different contexts
• Receiver objects used as contexts
• Multiple copies of reference variables

10
Example Object-sensitive Analysis
o1

• class A
• X f
• void m(X q)
• this.fq
• A a new A()
• a.m(new X())
• A aa new A()
• aa.m(new Y())

11
Parameterization

• Goal tunable analysis
• Multiple copies for a subset of variables
• For the other variables a single copy
• Result reduces points-to graph size and analysis
  cost
• At the expense of precision loss

12
Implementation

• Implemented one instance
• this, formals and return variables replicated
• Constraint-based, on top of Andersens analysis
• Optimizations
• Comparison with Andersens analysis

13
Empirical Results

• 23 Java programs 14 677 user classes
• Added the necessary library classes
• Machine 360 MHz, 512Mb
• Object Sensitive vs. Andersen
• Comparable cost
• Better precision
• Modification side-effect analysis
• Virtual call resolution

14
Analysis Time
15
Side-effect AnalysisModified Objects Per
Statement
OBJECT SENSITIVE
ANDERSEN
jb
jess
sablecc
raytrace
Average
16
Improvement in Resolved Calls
17
Related Work

• Context-sensitive points-to analysis for OO
  languages
• Grove et al. OOPSLA97, Chatterjee et al.
  POPL99,Ruf PLDI00, Grove-Chambers TOPLAS01
• Context-insensitive points-to analysis for OO
  languages
• Liang et al. PASTE01, Rountev et al. OOPSLA01
• Context-sensitive class analysis
• Oxhoj et al. ECOOP92, Agesen SAS94,
  Plevyak-Chien OOPSLA94, Agesen ECOOP95,
  Grove et al. OOPSLA97, Grove-Chambers TOPLAS01

18
Summary

• Object sensitivity context sensitivity for
  flow-insensitive analysis of OO languages
• Parameterization allows flexibility
• Practical cost, comparable to Andersens analysis
• Better precision than Andersens analysis

19
Future Work

• Implement other instances
• Object naming schemes
• Theoretical and empirical comparison
• Call string context sensitivity
• Other instances of functional approach
• Impact on client applications

20
(No Transcript)
21
Modification Side-Effect (MOD) Analysis

• Which objects may be modified by statement s?
• Points-to analysis is prerequisite
• Object-sensitive MOD analysis
• Based on object-sensitive points-to analysis
• Set of modified objects for each context