An Ahead-of-time Yet Context-Sensitive Points-to Analysis for Java

  • Authors:

  • Xin Li;Mizuhito Ogawa

  • Affiliations:

  • School of Information Science, Japan Advanced Institute of Science and Technology, Nomi, Japan;School of Information Science, Japan Advanced Institute of Science and Technology, Nomi, Japan

  • Venue:
  • Electronic Notes in Theoretical Computer Science (ENTCS)
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Points-to analysis is a prerequisite of program verification and static analysis on Java programs. It is known that call graph is typically constructed on-the-fly when points-to analysis proceeds for a better precision. In this work, we propose an ahead-of-time yet context-sensitive points-to analysis for Java as all-in-one weighted pushdown model checking. The analysis is context-sensitive in the sense that, (i) method calls and returns match with each other (a.k.a., valid paths); and (ii) targets of dynamic dispatch are analyzed separately for different calling contexts (a.k.a., context-sensitive call graph). The insight of our approach is that, by encoding dataflow as weights, invalid control flows that violate Java semantics on dynamic dispatch are detected as those carrying conflicted dataflow. Our analysis is presented as field-sensitive and flow-sensitive. Flow-insensitivity is shown to be easily obtained as a hierarchy considering efficiency and concurrent behaviors. Due to the lack of control flow structure and the explicit stack-based design, program analysis on bytecode is not an easy matter. We implemented the analysis in the framework of Soot compiler, and utilized the Weighted PDS Library as the back-end analysis engine. The analysis works on Jimple, a typed three-address intermediate representation of bytecode supported by Soot. The results of the analysis can be encoded into the class file as attributes for the further analysis or verification on bytecode.