Selecting Context-Sensitivity Modularly for Accelerating Object-Sensitive Pointer Analysis
Dongjie He, Jingbo Lu, Yaoqing Gao, Jingling Xue · IEEE Transactions on Software Engineering · 2022
Object-sensitive pointer analysis (denotedkobjunder$k$-limiting) for an object-oriented program can be accelerated if context-sensitivity can be selectively applied to only some precision-critical variables/objects in a program. Existing pre-analyses for making such selections, which are performed as whole-program analyses to a program, are developed based on two broad approaches. One approach preserves the precision of object-sensitive pointer analysis but achieves limited speedups by reasoning about all the possible value flows in the program conservatively, while the other approach achieves greater speedups but sacrifices precision (often unduly) by examining only some but not all the value flows in the program heuristically. In this paper, we introduce a new pre-analysis approach,Turner$^{\mathcal{m}}$(where$\mathcal {m}$stands for modularity), that represents a sweet spot between these two existing ones, as it is designed to enablekobjto run significantly faster than the former approach and achieve significantly better precision than the latter approach.Turner$^{\mathcal{m}}$is simple, lightweight yet effective due to two novel aspects in its design. First, we exploit a key observation that some precision-uncritical objects in the program can be approximated based on the object-containment relationship pre-established (from Andersen's analysis). In practice, this approximation introduces only a small degree of imprecision intokobj. Second, leveraging this initial approximation, we apply a novel object reachability analysis to the program by pre-analyzing its methods according to a reverse topological order of its call graph. When pre-analyzing each method, we make use of a simple DFA (Deterministic Finite Automaton) to reason about object reachability intra-procedurally from its entry to its exit along all the possible value flows established by its statements to identify its precision-critical variables/objects. In practice, this new modular object reachability analysis, which runs linearly in terms of the number of statements in the program, introduces again only a small loss of precision intokobj. We have validatedTurner$^{\mathcal{m}}$with an open-source implementation inSoot(already publicly available) against the state of the art by using a set of 12 widely used Java benchmarks and applications.