Merging equivalent contexts for scalable heap-cloning-based context-sensitive points-to analysis

  • Authors:

  • Guoqing Xu;Atanas Rountev

  • Affiliations:

  • Ohio State University, Columbus, OH, USA;Ohio State University, Columbus, OH, USA

  • Venue:
  • ISSTA '08 Proceedings of the 2008 international symposium on Software testing and analysis
  • Year:
  • 2008

Quantified Score

Hi-index 0.01

Visualization

Abstract

A context-sensitive points-to analysis maintains separate points-to relationships for each possible (abstract) calling context of a method. Previous work has shown that a large number of equivalence classes exists in the representation of calling contexts. Such equivalent contexts provide opportunities for context-sensitive analyses based on binary decision diagrams (BDDs), in which BDDs automatically merge equivalent points-to relationships. However, the use of a BDD ``black box'' introduces additional overhead for analysis running time. Furthermore, with heap cloning (i.e., using context-sensitive object allocation sites), BDDs are not as effective because the number of equivalence classes increases significantly. A further step must be taken to look inside the BDD black box to investigate where the equivalence comes from, and what tradeoffs can be employed to enable practical large-scale heap cloning. This paper presents an analysis for Java that exploits equivalence classes in context representation. For a particular pointer variable or heap object, all abstract contexts within an equivalence class can be merged. This technique naturally results in a new non-BDD context-sensitive points-to analysis. Based on these equivalence classes,the analysis employs a last-k-substring merging approach to define scalability and precision tradeoffs. We show that small values for k can enable scalable heap cloning for large Java programs. The proposed analysis has been implemented and evaluated on a large set of Java programs. The experimental results show improvements over an existing 1-object-sensitive analysis with heap cloning, which is the most precise scalable analysis implemented in the state-of-the-art Paddle analysis framework. For computing a points-to solution for an entire program, our approach is an order of magnitude faster compared to this BDD-based analysis and to a related non-BDD refinement-based analysis.