Practical Objectsensitive Pointsto Analysis for Java Ana Milanova

Practical Object-sensitive Points-to Analysis for Java Ana Milanova Atanas Rountev Barbara Ryder Rutgers University 1

Points-to Analysis for Java n n Which objects may reference variable x point to? Builds a points-to graph x = new A(); x y = new B(); x. f = y; o 1 f y o 2 2

Uses of Points-to Information n n Clients: SE tools and compilers Side-effect analysis n n Call graph construction n n Data-flow based testing Interprocedural analyses Program Slicing Coverage analysis Compiler optimizations 3

Existing Practical Points-to Analyses for Java n n Flow- and context-insensitive Extend existing analyses for C Context insensitivity inherently compromises precision for object-oriented languages Goal: Introduce context sensitivity and remain practical 4

Our Work n Object sensitivity n n Object-sensitive Andersen’s analysis n n Object sensitivity applicable to other analyses Parameterization framework n n Form of context sensitivity for flow-insensitive points-to analysis of OO languages Cost vs. precision tradeoff Empirical evaluation n Vs. context-insensitive Andersen’s analysis 5

Outline n Imprecision of context-insensitive analysis n Object-sensitive analysis n Parameterization n Empirical results n Related work n Summary and future work 6

The Imprecision of Context-insensitive Analysis n Does not distinguish contexts for instance methods and constructors n n States of distinct objects are merged Common OO features and idioms n n n Encapsulation Inheritance Containers, maps and iterators 7

Example: Imprecision class Y extends X { … } class A { X f; void m(X q) { this. f=q ; } } A a = new A() ; a. m(new X()) ; A aa = new A() ; aa. m(new Y()) ; a o 1 f o 2 f this. A. m q f aa o 3 f o 4 8

Object-sensitive Analysis n n n Instance methods and constructors analyzed for different contexts Receiver objects used as contexts Multiple copies of reference variables this. f=q o 1 this. A. m. f=q o 1 9

Example: Object-sensitive o 1 Analysis class A { X f; void m(X q) { oo 13 o 3 1 ; ; } this. f=q this. A. m this. f=q A. m } A a = new A() ; a. m(new X()) ; A aa = new A() ; aa. m(new Y()) ; a o 1 f o 2 o 1 this. A. m q. A. m o 3 q. A. m this. A. m aa o 3 f o 4 10

Parameterization n n Goal: tunable analysis Multiple copies for a subset of variables n n For the other variables a single copy Result: reduces points-to graph size and analysis cost n At the expense of precision loss 11

Implementation n Implemented one instance n n this, formals and return variables replicated Constraint-based, on top of Andersen’s analysis Optimizations Comparison with Andersen’s analysis 12

Empirical Results n 23 Java programs: 14 – 677 user classes n n n Added the necessary library classes Machine: 360 MHz, 512 Mb Object Sensitive vs. Andersen n n Comparable cost Better precision n n Modification side-effect analysis Virtual call resolution 13

Analysis Time 14

Side-effect Analysis: Modified Objects Per Statement ANDERSEN OBJECT SENSITIVE jb jess sablecc raytrace Average 15

Improvement in Resolved Calls 16

Related Work n Context-sensitive points-to analysis for OO languages n n Context-insensitive points-to analysis for OO languages n n Grove et al. OOPSLA’ 97, Chatterjee et al. POPL’ 99, Ruf PLDI’ 00, Grove-Chambers TOPLAS’ 01 Liang et al. PASTE’ 01, Rountev et al. OOPSLA’ 01 Context-sensitive class analysis n Oxhoj et al. ECOOP’ 92, Agesen SAS’ 94, Plevyak-Chien OOPSLA’ 94, Agesen ECOOP’ 95, Grove et al. OOPSLA’ 97, Grove-Chambers TOPLAS’ 01 17

Summary n n Object sensitivity – context sensitivity for flow-insensitive analysis of OO languages Parameterization allows flexibility Practical cost, comparable to Andersen’s analysis Better precision than Andersen’s analysis 18

Future Work n n n Implement other instances Object naming schemes Theoretical and empirical comparison n Call string context sensitivity Other instances of functional approach Impact on client applications 19

20

Modification Side-Effect (MOD) Analysis n Which objects may be modified by statement s? n n Points-to analysis is prerequisite Object-sensitive MOD analysis n n Based on object-sensitive points-to analysis Set of modified objects for each context 21