Precision-Guided Context Sensitivity for Pointer Analysis 141:13 apply context sensitivity to only the variables and object fields that are involved in the flows in the precision loss patterns(i.e.,the nodes stored in FlowNodes in Algorithm 2)instead of the entire containing methods.In this way,although within the same precision-critical methods,other variables and object fields that are irrelevant to precision loss patterns can be analyzed context- insensitively,which may lead to better efficiency.For simplicity,in this paper we only consider context sensitivity at the granularity of methods,and leave the potential of more refined options for future work. 4 EVALUATION In this section,we investigate the following research questions for evaluation. RQ1.Is ZIPPER-guided pointer analysis precise and efficient? (a)How much of the precision of a conventional analysis can ZIPPER preserve? (b)How fast is ZIPPER-guided pointer analysis compared to a conventional analysis? (c)What is the overhead of running ZIPPER? (By "conventional",we mean a context-sensitive pointer analysis that applies context sensiti- vity to all methods.) RQ2.How does ZIPpER-guided pointer analysis compare to state-of-the-art alternative techniques (specifically,introspective analyses [Smaragdakis et al.2014])that also apply context sensi- tivity for only a subset of the methods,in terms of precision and efficiency? RQ3.What is the effect of each of ZIPPER's precision loss patterns on the analysis results? (a)How many methods does ZIPPER consider precision-critical,and how does each precision loss pattern contribute to this number? (b)How does each of the precision loss patterns affect the precision and efficiency of ZIPPER- guided pointer analysis? Implementation.We have implemented ZIPPER as an open-source stand-alone tool in Java,avail- able at http://www.brics.dk/zipper.Benefiting from simple insights and algorithms,ZIPPER's core implementation contains less than 1500 lines of Java code.In addition,ZIPPER is designed to work with various pointer analysis frameworks,such as Doop [Bravenboer and Smaragdakis 2009], WALA [WALA 2018],CHORD [Naik et al.2006],and Soor [Vallee-Rai et al.1999].To investigate its effectiveness,we have integrated ZIPPER with DooP,a state-of-the-art whole-program pointer analysis framework for Java.Interacting with existing context-sensitive pointer analysis is simple, as ZIPPER's output is just a set of precision-critical methods,as shown in Figure 6.For example, we only need to slightly modify three Datalog rules in Doop to enable Doop to apply context sensitivity to only the precision-critical methods reported by ZIPPER.We expect a similarly simple integration for other pointer analysis tools. Experimental Settings.We run all experiments on a machine with an Intel Xeon(E5)2.6GHz CPU and 48G memory.The time budget is set to 1.5 hours as in previous work [Jeong et al. 2017;Kastrinis and Smaragdakis 2013;Smaragdakis et al.2014].We evaluate ZIPPER using a large OpenJDK(1.6.0_24)library and 10 large Java programs:five are popular real-world applications(the first five entries in Table 1)and five are from the standard DaCapo 2006 benchmarks [Blackburn et al.2006](the last five entries in Table 1).We discuss the reason for this subset of the DaCapo benchmarks after introducing the metrics and analysis settings. In RQ1,we consider a 2-object-sensitive pointer(2obj)analysis (with one context element for heap objects)[Milanova et al.2002,2005]as the conventional context-sensitive pointer analysis we seek to match in terms of precision.2obj is regarded as the most practical high-precision pointer analysis for Java [Lhotak and Hendren 2006;Smaragdakis et al.2011;Tan et al.2016]and is widely Proc.ACM Program.Lang.,Vol.2,No.OOPSLA,Article 141.Publication date:November 2018.Precision-Guided Context Sensitivity for Pointer Analysis 141:13 apply context sensitivity to only the variables and object fields that are involved in the flows in the precision loss patterns (i.e., the nodes stored in FlowNodes in Algorithm 2) instead of the entire containing methods. In this way, although within the same precision-critical methods, other variables and object fields that are irrelevant to precision loss patterns can be analyzed context￾insensitively, which may lead to better efficiency. For simplicity, in this paper we only consider context sensitivity at the granularity of methods, and leave the potential of more refined options for future work. 4 EVALUATION In this section, we investigate the following research questions for evaluation. RQ1. Is Zipper-guided pointer analysis precise and efficient? (a) How much of the precision of a conventional analysis can Zipper preserve? (b) How fast is Zipper-guided pointer analysis compared to a conventional analysis? (c) What is the overhead of running Zipper? (By łconventionalž, we mean a context-sensitive pointer analysis that applies context sensiti￾vity to all methods.) RQ2. How does Zipper-guided pointer analysis compare to state-of-the-art alternative techniques (specifically, introspective analyses [Smaragdakis et al. 2014]) that also apply context sensi￾tivity for only a subset of the methods, in terms of precision and efficiency? RQ3. What is the effect of each of Zipper’s precision loss patterns on the analysis results? (a) How many methods does Zipper consider precision-critical, and how does each precision loss pattern contribute to this number? (b) How does each of the precision loss patterns affect the precision and efficiency of Zipper￾guided pointer analysis? Implementation. We have implemented Zipper as an open-source stand-alone tool in Java, avail￾able at http://www.brics.dk/zipper. Benefiting from simple insights and algorithms, Zipper’s core implementation contains less than 1500 lines of Java code. In addition, Zipper is designed to work with various pointer analysis frameworks, such as Doop [Bravenboer and Smaragdakis 2009], Wala [WALA 2018], Chord [Naik et al. 2006], and Soot [Vallée-Rai et al. 1999]. To investigate its effectiveness, we have integrated Zipper with Doop, a state-of-the-art whole-program pointer analysis framework for Java. Interacting with existing context-sensitive pointer analysis is simple, as Zipper’s output is just a set of precision-critical methods, as shown in Figure 6. For example, we only need to slightly modify three Datalog rules in Doop to enable Doop to apply context sensitivity to only the precision-critical methods reported by Zipper. We expect a similarly simple integration for other pointer analysis tools. Experimental Settings. We run all experiments on a machine with an Intel Xeon (E5) 2.6GHz CPU and 48G memory. The time budget is set to 1.5 hours as in previous work [Jeong et al. 2017; Kastrinis and Smaragdakis 2013; Smaragdakis et al. 2014]. We evaluate Zipper using a large OpenJDK (1.6.0_24) library and 10 large Java programs: five are popular real-world applications (the first five entries in Table 1) and five are from the standard DaCapo 2006 benchmarks [Blackburn et al. 2006] (the last five entries in Table 1). We discuss the reason for this subset of the DaCapo benchmarks after introducing the metrics and analysis settings. In RQ1, we consider a 2-object-sensitive pointer (2obj) analysis (with one context element for heap objects) [Milanova et al. 2002, 2005] as the conventional context-sensitive pointer analysis we seek to match in terms of precision. 2obj is regarded as the most practical high-precision pointer analysis for Java [Lhoták and Hendren 2006; Smaragdakis et al. 2011; Tan et al. 2016] and is widely Proc. ACM Program. Lang., Vol. 2, No. OOPSLA, Article 141. Publication date: November 2018