Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity 147:7 of view of S1,some methods that should have been analyzed under 2obj,are now assigned to 3obj(color turns from green to red)as 3obj is more precise than 2obj;for the rest of overlapped methods,they remain green(i.e.,still be analyzed by 2obj)as 2obj is more precise than 1type (reported by S3).After applying similar treatment to other overlapped methods(with the disjoint ones unchanged),we get the output of Unity as in Figure 2.Note that the methods reported by all three input approaches(the middle part of the Unity figure)remain green as 2obj(reported by S1) is more precise than 2type(by S2)and 1type(by S3).Section 4 will detail the rules on how Unity deals with more input approaches with different context-sensitivity variants. From the point of view of each selective approach,Unity modifies it by(1)adding many more methods(identified by other approaches)to be analyzed context-sensitively,and(2)upgrading the context-sensitivity variant to the most precise one for the methods which are also selected by other approaches.We have explained the insight for(1)at the beginning of Section 3.2,and the insight for(2)is similar:if a method m is reported to be analyzed under a certain context-sensitivity variant,cs,by an input approach s,this implies that according to the insight of s,m is considered as not a scalability-threat,regardless of how costly cs is.Then,if the input approaches are reliable, we still have a chance to produce a scalable analysis,even if selecting the most precise cs.Later, experimental results further demonstrate the validity of the Unity insight:even if many more methods are analyzed context-sensitively and are under the most precise configuration (w.r.t.the input approaches).Unity is still able to scale for 12 out of 13 hard-to-analyze programs(with default settings). However,there is no guarantee regarding the scalability of Unity.What can we do if Unity fails to scale?As a second try,a straightforward approach is to not make the analysis too costly. For example,if some overlapped methods M are reported to be analyzed under 3obj and 1type by different input approaches,what about considering the less precise(also less costly)one,i.e.,1type? Nevertheless,this may introduce significant precision loss,and if M is critical form improving precision,such treatment may make the analysis even less precise than the original one(s)guided by certain input approach(es)individually.To reap as much precision as possible while achieving good scalability,we employ the Relay technique. The core insight of Relay is to divide the scalability burden of Unity into different passes(each pass is a run of selective context-sensitive pointer analysis)and the precision achieved by the former pass can be transmitted to and accumulated in the next pass.Based on this insight,we design two options of Relay,called Relay-o1 and Relay-02 that the former is more precise but less scalable than the latter.Figure 3 depicts the above idea with the same input selective approaches as in Figure 2.We introduce Relay-o1 first. 3.3 Relay The first pass of Relay-o1 in Figure 3 differs from Unity in that it only analyzes the methods(say M1)selected by S1(enclosed in the circle with solid line)context-sensitively,with the remaining ones being analyzed under CI.Similarly,only the methods,say M2(M3)selected by S2(S3)are analyzed context-sensitively in pass 2(pass 3).Thus,for each context-sensitive method of M1(M2 or M3),as shown in the figure,Relay selects the same context-sensitivity variant for it as in Unity, namely,still the most precise configuration suggested by any of the combined approaches.For example, for M1 in pass 1,its context-sensitivity variants distribution is the same as the one of Unity in Figure 2(i.e.,the same subset of methods are assigned to 3obj while the remaining methods are assigned to 2obj).For each pass of Relay,only a subset of methods of Unity are analyzed context-sensitively.Although this does not ensure better scalability than Unity,no more methods than the base approach are analyzed context-sensitively-only the same methods may be analyzed Proc.ACM Program.Lang.,Vol.5,No.OOPSLA,Article 147.Publication date:October 2021.Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity 147:7 of view of S1, some methods that should have been analyzed under 2obj, are now assigned to 3obj (color turns from green to red) as 3obj is more precise than 2obj; for the rest of overlapped methods, they remain green (i.e., still be analyzed by 2obj) as 2obj is more precise than 1type (reported by S3). After applying similar treatment to other overlapped methods (with the disjoint ones unchanged), we get the output of Unity as in Figure 2. Note that the methods reported by all three input approaches (the middle part of the Unity figure) remain green as 2obj (reported by S1) is more precise than 2type (by S2) and 1type (by S3). Section 4 will detail the rules on how Unity deals with more input approaches with different context-sensitivity variants. From the point of view of each selective approach, Unity modifies it by (1) adding many more methods (identified by other approaches) to be analyzed context-sensitively, and (2) upgrading the context-sensitivity variant to the most precise one for the methods which are also selected by other approaches. We have explained the insight for (1) at the beginning of Section 3.2, and the insight for (2) is similar: if a method m is reported to be analyzed under a certain context-sensitivity variant, cs, by an input approach 𝑠, this implies that according to the insight of 𝑠, m is considered as not a scalability-threat, regardless of how costly cs is. Then, if the input approaches are reliable, we still have a chance to produce a scalable analysis, even if selecting the most precise cs. Later, experimental results further demonstrate the validity of the Unity insight: even if many more methods are analyzed context-sensitively and are under the most precise configuration (w.r.t. the input approaches), Unity is still able to scale for 12 out of 13 hard-to-analyze programs (with default settings). However, there is no guarantee regarding the scalability of Unity. What can we do if Unity fails to scale? As a second try, a straightforward approach is to not make the analysis too costly. For example, if some overlapped methods M are reported to be analyzed under 3obj and 1type by different input approaches, what about considering the less precise (also less costly) one, i.e., 1type? Nevertheless, this may introduce significant precision loss, and if M is critical form improving precision, such treatment may make the analysis even less precise than the original one(s) guided by certain input approach(es) individually. To reap as much precision as possible while achieving good scalability, we employ the Relay technique. The core insight of Relay is to divide the scalability burden of Unity into different passes (each pass is a run of selective context-sensitive pointer analysis) and the precision achieved by the former pass can be transmitted to and accumulated in the next pass. Based on this insight, we design two options of Relay, called Relay-o1 and Relay-o2 that the former is more precise but less scalable than the latter. Figure 3 depicts the above idea with the same input selective approaches as in Figure 2. We introduce Relay-o1 first. 3.3 Relay The first pass of Relay-o1 in Figure 3 differs from Unity in that it only analyzes the methods (say M1) selected by S1 (enclosed in the circle with solid line) context-sensitively, with the remaining ones being analyzed under CI. Similarly, only the methods, say M2 (M3) selected by S2 (S3) are analyzed context-sensitively in pass 2 (pass 3). Thus, for each context-sensitive method of M1 (M2 or M3), as shown in the figure, Relay selects the same context-sensitivity variant for it as in Unity, namely, still the most precise configuration suggested by any of the combined approaches. For example, for M1 in pass 1, its context-sensitivity variants distribution is the same as the one of Unity in Figure 2 (i.e., the same subset of methods are assigned to 3obj while the remaining methods are assigned to 2obj). For each pass of Relay, only a subset of methods of Unity are analyzed context-sensitively. Although this does not ensure better scalability than Unity, no more methods than the base approach are analyzed context-sensitivelyÐonly the same methods may be analyzed Proc. ACM Program. Lang., Vol. 5, No. OOPSLA, Article 147. Publication date: October 2021