Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity TIAN TAN,Nanjing University,China YUE LI',Nanjing University,China XIAOXING MA,Nanjing University,China CHANG XU,Nanjing University,China YANNIS SMARAGDAKIS,University of Athens,Greece Traditional context-sensitive pointer analysis is hard to scale for large and complex Java programs.To address this issue,a series of selective context-sensitivity approaches have been proposed and exhibit promising results. In this work,we move one step further towards producing highly-precise pointer analyses for hard-to-analyze Java programs by presenting the Unity-Relay framework,which takes selective context sensitivity to the next 147 level.Briefly,Unity-Relay is a one-two punch:given a set of different selective context-sensitivity approaches, say S=S1,...,Sn,Unity-Relay first provides a mechanism(called Unity)to combine and maximize the precision of all components of S.When Unity fails to scale,Unity-Relay offers a scheme(called Relay)to pass and accumulate the precision from one approach Si in S to the next,Si+1,leading to an analysis that is more precise than all approaches in S. As a proof-of-concept,we instantiate Unity-Relay into a tool called BATON and extensively evaluate it on a set of hard-to-analyze Java programs,using general precision metrics and popular clients.Compared with the state of the art,BATON achieves the best precision for all metrics and clients for all evaluated programs. The difference in precision is often dramatic-up to 71%of alias pairs reported by previously-best algorithms are found to be spurious and eliminated. CCS Concepts:.Theory of computation-Program analysis. Additional Key Words and Phrases:Pointer Analysis,Alias Analysis,Context Sensitivity,Java ACM Reference Format: Tian Tan,Yue Li,Xiaoxing Ma,Chang Xu,and Yannis Smaragdakis.2021.Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity.Proc.ACM Program.Lang.5,OOPSLA, Article 147(October 2021),27 pages.https://doi.org/10.1145/3485524 1 INTRODUCTION Pointer analysis is important for an array of real-world applications such as bug detection [Chandra et al.2009;Naik et al.2006],security analysis [Arzt et al.2014;Livshits and Lam 2005],program verification [Fink et al.2008;Pradel et al.2012]and program understanding [Li et al.2016;Sridharan "Corresponding author Authors'addresses:Tian Tan,State Key Laboratory for Novel Software Technology,Nanjing University,China,tiantan@ nju.edu.cn;Yue Li,State Key Laboratory for Novel Software Technology,Nanjing University,China,yueli@nju.edu.cn; Xiaoxing Ma,State Key Laboratory for Novel Software Technology,Nanjing University,China,xxm@nju.edu.cn;Chang Xu, State Key Laboratory for Novel Software Technology,Nanjing University,China,changxu@nju.edu.cn;Yannis Smaragdakis, Department of Informatics and Telecommunications,University of Athens,Greece,yannis@smaragd.org. ©0 Y This work is licensed under a Creative Commons Attribution 4.0 International License. 2021 Copyright held by the owner/author(s). 2475-1421/2021/10-ART147 https:/doi.org/10.1145/3485524 Proc.ACM Program.Lang.,Vol.5,No.OOPSLA,Article 147.Publication date:October 2021.147 Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity TIAN TAN, Nanjing University, China YUE LI∗ , Nanjing University, China XIAOXING MA, Nanjing University, China CHANG XU, Nanjing University, China YANNIS SMARAGDAKIS, University of Athens, Greece Traditional context-sensitive pointer analysis is hard to scale for large and complex Java programs. To address this issue, a series of selective context-sensitivity approaches have been proposed and exhibit promising results. In this work, we move one step further towards producing highly-precise pointer analyses for hard-to-analyze Java programs by presenting the Unity-Relay framework, which takes selective context sensitivity to the next level. Briefly, Unity-Relay is a one-two punch: given a set of different selective context-sensitivity approaches, say 𝑆 = 𝑆1, . . . , 𝑆𝑛, Unity-Relay first provides a mechanism (called Unity) to combine and maximize the precision of all components of 𝑆. When Unity fails to scale, Unity-Relay offers a scheme (called Relay) to pass and accumulate the precision from one approach 𝑆𝑖 in 𝑆 to the next, 𝑆𝑖+1, leading to an analysis that is more precise than all approaches in 𝑆. As a proof-of-concept, we instantiate Unity-Relay into a tool called Baton and extensively evaluate it on a set of hard-to-analyze Java programs, using general precision metrics and popular clients. Compared with the state of the art, Baton achieves the best precision for all metrics and clients for all evaluated programs. The difference in precision is often dramaticÐup to 71% of alias pairs reported by previously-best algorithms are found to be spurious and eliminated. CCS Concepts: • Theory of computation → Program analysis. Additional Key Words and Phrases: Pointer Analysis, Alias Analysis, Context Sensitivity, Java ACM Reference Format: Tian Tan, Yue Li, Xiaoxing Ma, Chang Xu, and Yannis Smaragdakis. 2021. Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity. Proc. ACM Program. Lang. 5, OOPSLA, Article 147 (October 2021), 27 pages. https://doi.org/10.1145/3485524 1 INTRODUCTION Pointer analysis is important for an array of real-world applications such as bug detection [Chandra et al. 2009; Naik et al. 2006], security analysis [Arzt et al. 2014; Livshits and Lam 2005], program verification [Fink et al. 2008; Pradel et al. 2012] and program understanding [Li et al. 2016; Sridharan ∗Corresponding author Authors’ addresses: Tian Tan, State Key Laboratory for Novel Software Technology, Nanjing University, China, tiantan@ nju.edu.cn; Yue Li, State Key Laboratory for Novel Software Technology, Nanjing University, China, yueli@nju.edu.cn; Xiaoxing Ma, State Key Laboratory for Novel Software Technology, Nanjing University, China, xxm@nju.edu.cn; Chang Xu, State Key Laboratory for Novel Software Technology, Nanjing University, China, changxu@nju.edu.cn; Yannis Smaragdakis, Department of Informatics and Telecommunications, University of Athens, Greece, yannis@smaragd.org. Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). © 2021 Copyright held by the owner/author(s). 2475-1421/2021/10-ART147 https://doi.org/10.1145/3485524 Proc. ACM Program. Lang., Vol. 5, No. OOPSLA, Article 147. Publication date: October 2021. This work is licensed under a Creative Commons Attribution 4.0 International License