Скачать или смотреть Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity

Traditional context-sensitive pointer analysis is hard to scale for large and complex Java programs. To address this issue, a series of selective context-sensitivity approaches have been proposed and exhibit promising results. In this work, we move one step further towards producing highly-precise pointer analyses for hard-to-analyze Java programs by presenting the Unity-Relay framework, which takes selective context sensitivity to the next level. Briefly, Unity-Relay is a one-two punch: given a set of different selective context-sensitivity approaches, say $S = {S_1, \ldots, S_n}$, Unity-Relay first provides a mechanism (called Unity) to combine and maximize the precision of all components of $S$. When Unity fails to scale, Unity-Relay offers a scheme (called Relay) to pass and accumulate the precision from one approach $S_i$ in $S$ to the next, $S_{i+1}$, leading to an analysis that is more precise than all approaches in $S$.
As a proof-of-concept, we instantiate Unity-Relay into a tool called Baton and extensively evaluate it on a set of hard-to-analyze Java programs, using general precision metrics and popular clients. Compared with the state of the art, Baton achieves the best precision for \emph{all} metrics and clients for \emph{all} evaluated programs. The difference in precision is often dramatic—up to 71% of alias pairs reported by previously-best algorithms are found to be spurious and eliminated.

Presented at OOPSLA 2021, part of SPLASH 2021.
By Tian Tan, Yue Li, Xiaoxing Ma, Chang Xu, Yannis Smaragdakis