Abstract:Over the past decades, context sensitivity has been considered as one of the most effective ideas for improving the precision of pointer analysis for Java. However, despite great precision benefits, as each method is equivalently cloned and analyzed under each context, context sensitivity brings heavy efficiency costs. In this work, we present a fundamentally different approach called Cut-Shortcut for fast and precise pointer analysis for Java. Its insight is simple: the main effect of cloning methods under different contexts is to filter spurious object flows that have been merged inside a callee method; from the view of a typical pointer flow graph (PFG), such effect can be simulated by cutting off (Cut) the edges that introduce precision loss to certain pointers and adding Shortcut edges directly from source pointers to the target ones circumventing the method on PFG. As a result, we can achieve the effect of context sensitivity without contexts. We identify three general program patterns and develop algorithms based on them to safely cut off and add shortcut edges on PFG, formalize them and formally prove the soundness. To comprehensively validate Cut-Shortcut's effectiveness, we implement two versions of Cut-Shortcut for two state-of-the-art pointer analysis frameworks for Java, one in Datalog for the declarative Doop and the other in Java for the imperative Tai-e, and we consider all the large and complex programs used in recent literatures that meet the experimental requirements. The evaluation results are extremely promising: Cut-Shortcut is even able to run faster than context insensitivity for most evaluated programs while obtaining high precision that is comparable to context sensitivity (if scalable) in both frameworks. This is for the first time that we have been able to achieve such a good efficiency and precision trade-off for those hard-to-analyze programs.

Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity

Making k-Object-Sensitive Pointer Analysis More Precise with Still k-Limiting.

A Principled Approach to Selective Context Sensitivity for Pointer Analysis

Precision-guided Context Sensitivity for Pointer Analysis

Precise and Efficient Points-to Analysis via New Context-Sensitivity and Heap Abstraction.

Making Pointer Analysis More Precise by Unleashing the Power of Selective Context Sensitivity.

Context Sensitivity without Contexts: A Cut-Shortcut Approach to Fast and Precise Pointer Analysis

SHARP: fast incremental context-sensitive pointer analysis for Java

Scalability-first Pointer Analysis with Self-Tuning Context-Sensitivity.

Kcpa: Towards Sensitive Pointer Full Life Cycle Authentication for OS Kernels

Kakute: A Precise, Unified Information Flow Analysis System for Big-data Security.

Points to analysis for partial call graph construction

Detecting DBMS Bugs with Context-Sensitive Instantiation and Multi-Plan Execution

Necessity and Capability of Flow, Context, Field and Quasi Path Sensitive Points-to Analysis

Fast and precise points-to analysis with incremental CFL-reachability summarisation: preliminary experience

Optimize Context-Sensitive Andersen-style Points-to Analysis by Method Summarization and Cycle-Elimination

Generic Sensitivity: Generics-Guided Context Sensitivity for Pointer Analysis

The ART of Sharing Points-to Analysis (Extended Abstract)

Unification-based Pointer Analysis without Oversharing

Optimization of Points-to Analysis for Java

Thread-Sensitive Pointer Analysis for Inter-Thread Dataflow Detection.