Selecting Context-Sensitivity Modularly for Accelerating Object-Sensitive Pointer Analysis

Object-sensitive pointer analysis (denoted
k
obj
under
$k$
-limiting) for an object-oriented program can be accelerated if context-sensitivity can be selectively applied to only some precision-critical variables/objects in a program. Existing pre-analyses for making such selections, which are performed as whole-program analyses to a program, are developed based on two broad approaches. One approach preserves the precision of object-sensitive pointer analysis but achieves limited speedups by reasoning about all the possible value flows in the program conservatively, while the other approach achieves greater speedups but sacrifices precision (often unduly) by examining only some but not all the value flows in the program heuristically. In this paper, we introduce a new pre-analysis approach,
Turner
$^{\mathcal{m}}$
(where
$\mathcal {m}$
stands for modularity), that represents a sweet spot between these two existing ones, as it is designed to enable
k
obj
to run significantly faster than the former approach and achieve significantly better precision than the latter approach.
Turner
$^{\mathcal{m}}$
is simple, lightweight yet effective due to two novel aspects in its design. First, we exploit a key observation that some precision-uncritical objects in the program can be approximated based on the object-containment relationship pre-established (from Andersen's analysis). In practice, this approximation introduces only a small degree of imprecision into
k
obj
. Second, leveraging this initial approximation, we apply a novel object reachability analysis to the program by pre-analyzing its methods according to a reverse topological order of its call graph. When pre-analyzing each method, we make use of a simple DFA (Deterministic Finite Automaton) to reason about object reachability intra-procedurally from its entry to its exit along all the possible value flows established by its statements to identify its precision-critical variables/objects. In practice, this new modular object reachability analysis, which runs linearly in terms of the number of statements in the program, introduces again only a small loss of precision into
k
obj
. We have validated
Turner
$^{\mathcal{m}}$
with an open-source implementation in
Soot
(already publicly available) against the state of the art by using a set of 12 widely used Java benchmarks and applications.