正在加载图片...
Among all the context abstractions (including k-CFA)proposed,object- sensitivity is regarded as arguably the best for pointer analysis in object-oriented languages [14,17,29].This can be seen from its widespread adoption in a num- ber of pointer analysis frameworks for Java,such as Doop [7,4],CHORD [5] and WALA [36].In addition,object-sensitivity has also been embraced by many other program analysis tasks,including typestate verification [9,38],data race detection [25],information flow analysis [1,10,22],and program slicing [21]. Despite its success,a k-object-sensitive pointer analysis,which uses a se- quence of k allocation sites (as k context elements)to represent a calling context of a method call,may end up using some context elements redundantly in the sense that these redundant context elements fail to induce a finer partition of the space of(concrete)calling contexts for the method call.As a result,many opportunities for making further precision improvements are missed. In this paper,we introduce BEAN,a general approach for improving the precision of a k-object-sensitive pointer analysis,denoted k-obj,for Java.by avoiding redundant context elements in k-obj while still maintaining a k-limiting context abstraction.The novelty lies in identifying redundant context elements by solving a graph problem on an OAG (Object Allocation Graph),which is built based on a pre-analysis (e.g.,a context-insensitive Andersen's analysis) performed initially on a program,and then avoid them in the subsequent k- object-sensitive analysis.By construction,BEAN is generally more precise than k-obj,with a precision that is guaranteed to be as good as k-obj in the worst case. We have implemented BEAN and applied it to refine two state-of-the-art (whole-program)pointer analyses,2obj+h and S-2obj+h [14],provided in Doop [7],resulting in two BEAN-directed pointer analyses,B-2obj+h and B-S-2obj+h, respectively.We have considered may-alias and may-fail-cast,two representative clients used elsewhere [8,29,30]for measuring the precision of a pointer analysis on a set of nine large Java programs from the DaCapo benchmark suite.Our re- sults show that B-2obj+h (B-S-2obj+h)is more precise than 2obj+h(S-2obj+h) for every evaluated benchmark under each client,at some small increases in analysis cost. This paper presents and validates a new idea on improving the precision of object-sensitive pointer analysis by exploiting an object allocation graph.Con- sidering the broad applications of object-sensitivity in analysing Java programs, we expect more clients to benefit from the BEAN approach,in practice.Specifi- cally,this paper makes the following contributions: -We introduce a new approach,BEAN,for improving the precision of any k- object-sensitive pointer analysis.k-obj.for Java.by avoiding its redundant context elements while maintaining still a k-limiting context abstraction. We introduce a new kind of graph,called an OAG(object allocation graph), constructed from a pre-analysis for the program,as a general mechanism to identify redundant context elements used in k-obj. We have implemented BEAN as a soon-to-be released open-source tool,which is expected to work well with various object-sensitive analyses for Java.Among all the context abstractions (including k-CFA) proposed, object￾sensitivity is regarded as arguably the best for pointer analysis in object-oriented languages [14, 17, 29]. This can be seen from its widespread adoption in a num￾ber of pointer analysis frameworks for Java, such as Doop [7, 4], Chord [5] and Wala [36]. In addition, object-sensitivity has also been embraced by many other program analysis tasks, including typestate verification [9, 38], data race detection [25], information flow analysis [1, 10, 22], and program slicing [21]. Despite its success, a k-object-sensitive pointer analysis, which uses a se￾quence of k allocation sites (as k context elements) to represent a calling context of a method call, may end up using some context elements redundantly in the sense that these redundant context elements fail to induce a finer partition of the space of (concrete) calling contexts for the method call. As a result, many opportunities for making further precision improvements are missed. In this paper, we introduce Bean, a general approach for improving the precision of a k-object-sensitive pointer analysis, denoted k-obj, for Java, by avoiding redundant context elements in k-obj while still maintaining a k-limiting context abstraction. The novelty lies in identifying redundant context elements by solving a graph problem on an OAG (Object Allocation Graph), which is built based on a pre-analysis (e.g., a context-insensitive Andersen’s analysis) performed initially on a program, and then avoid them in the subsequent k￾object-sensitive analysis. By construction, Bean is generally more precise than k-obj, with a precision that is guaranteed to be as good as k-obj in the worst case. We have implemented Bean and applied it to refine two state-of-the-art (whole-program) pointer analyses, 2obj+h and S-2obj+h [14], provided in Doop [7], resulting in two Bean-directed pointer analyses, B-2obj+h and B-S-2obj+h, respectively. We have considered may-alias and may-fail-cast, two representative clients used elsewhere [8, 29, 30] for measuring the precision of a pointer analysis on a set of nine large Java programs from the DaCapo benchmark suite. Our re￾sults show that B-2obj+h (B-S-2obj+h) is more precise than 2obj+h (S-2obj+h) for every evaluated benchmark under each client, at some small increases in analysis cost. This paper presents and validates a new idea on improving the precision of object-sensitive pointer analysis by exploiting an object allocation graph. Con￾sidering the broad applications of object-sensitivity in analysing Java programs, we expect more clients to benefit from the Bean approach, in practice. Specifi- cally, this paper makes the following contributions: – We introduce a new approach, Bean, for improving the precision of any k￾object-sensitive pointer analysis, k-obj, for Java, by avoiding its redundant context elements while maintaining still a k-limiting context abstraction. – We introduce a new kind of graph, called an OAG (object allocation graph), constructed from a pre-analysis for the program, as a general mechanism to identify redundant context elements used in k-obj. – We have implemented Bean as a soon-to-be released open-source tool, which is expected to work well with various object-sensitive analyses for Java
<<向上翻页向下翻页>>
©2008-现在 cucdc.com 高等教育资讯网 版权所有