Parameterized Object Sensitivity for Points-to Analysis for Java

1. Parameterized Object SensitivityforPoints-to Analysis for Java Presented By: - Anand Bahety Dan Bucatanschi

2. Presentation Roadmap • Introduction • Terms and Definitions • Application of previous techniques to OOP • Imprecision analyzed • Object Sensitive analysis and its advantages • Parameterized Object Sensitivity

3. Introduction • Points-to Analysis: - Method in Java to determine the set of objects pointed to by a reference variable or a reference object field • Goal • Advantages

4. Terms and Definitions • Side-effect analysis • Def-use analysis • Flow sensitive & flow insensitive • Context sensitive & context insensitive • Object sensitivity

5. Sample points-to graph

6. Object Oriented Programing • Encapsulation • Inheritance • Collection (Containers)… Lets try to analyze these features using flow insensitive and context insensitive analysis

7. Semantics • R – set of all reference variables • O – set of all objects created at object allocation sites • F – contains all instance fields in program class • Edge (r,oi) Є R x O • (<oi,f>, oj) Є (O x F) x O • Transfer functions

8. x1 y1 y2 O1 O3 O4 O2 x2 Encapsulation f f f f x this

9. y O2 b O4 O1 z O3 c Inheritance f A.xa f C.xc B.xb this f f

10. Imprecision • Encapsulation • Inheritance • Both of these are strong concepts of OOP • But not captured properly with old techniques • Solution is Object sensitivity

11. Object Sensitivity • Revised semantics • O` - set of all object names • R` - set of replicas of reference variable • Relation α(C,m) • Set of new transfer functions

12. y O2 b O4 c O1 z O3 f A.xa f C.xc B.xb this f f Context sensitivity included • B.thiso3,B.xbo3, A.xao3 C.thiso4,C.xco4, A.xao4 Older representation

13. Advantages • Models OOP features • Distinguishes between different receiver objects • Static methods and variables can be handled with insensitivity • Can be parameterized

14. Parameterized Object Sensitivity • Two dimensions • Degree of precision in naming scheme o21 , o31 • Set R* of reference variables for which multiple points-to sets should be maintained

15. Implementation and Performance • Techniques for implementation and optimization • Side-effect analysis (MOD) • Def-Use analysis • Empirical Results • Conclusions • Future Work

16. Techniques for Implementation • Typical implementation of flow- and context-insensitive analysis (Andersen’s technique): • Statement processing routine: processes different kinds of program statements • Virtual dispatch routine: models the semantics of virtual calls

17. Techniques for Implementation • Implementation of parameterized object-sensitive analysis: • Implement function map(v, c) • Process each statement once for every possible context • Augment the virtual dispatch routine to map the return variable and the formal parameters of the invoked method to the corresponding context.

18. Techniques for Optimization • The points-to set of a replica thiso = {o}. • Suppose statement s contains only nonreplicated variables (i.e. the variables are not in the R* set), then analyze s only once for one “default” context. • Similarly, if l ∈R* but r ∉ R*, and l is assigned only at statements of the form: • l = r • l = r.f

19. Techniques for Optimization • Suppose l ∈R* and p ∉ R*. • Consider the assignments: l.f=p, p=l, p=l.f, and p.f=l. • We can add a nonreplicated variable l’ and a new (context-dependent) statement l’=l. • Then the points-to set of l’ is the union of the the points-to sets of all context copies of l. • So the statements can be analyzed context-independently.

20. Side-effect Analysis (MOD) • Goal: • For each statement s and context c of the method enclosing s, compute set Mod(s, c) of objects that could be modified by executing s when in c. • Also, MMod(m, c) is the set of objects that could be modified by each contextual version of a method m. • The previous optimizations can be applied.

21. Side-effect Analysis (MOD) Instance field assignments Virtual method calls Static method calls Typo: should be c

22. Def-Use Analysis • Goal: compute def-use associations between pairs of statements. • A def-use association for a memory location l is a pair of statements (m, n) such that m assigns a value to l and subsequently n uses that value.

23. Standard Def-Use Analysis • For procedural languages, well known methods for computing intraprocedural associations and interprocedural associations. • We need a pointer analysis to disambiguate indirect definitions and uses. • Reaching definitions (RD) analysis needed to determine the sets of definitions that may reach a program statement (because of use of pointers), in order to identify def-use pairs.

24. Object Sensitivity in Def-Use Analysis • Points-to analysis must be used in order to determine which objects may be accessed by expressions of the form p.f. • ∀ oi ∈Pt(p), memory location oi.f is added to the DEF or USE set for the corresponding statement. • MDEF(m) contains definitions created in method m and in all direct and indirect callees of m.

25. Standard Def-Use Analysis DEF set; Direct and indirect DEF set Reaching Definitions set broken down by type of node (statement) DEF-USE pairs

26. Implementations • Parameterized object-sensitive points-to analysis (context depth = 1): • ObjSens1: keeps context-sensitive information for implicit parameters this and formal parameters of instance methods and constructors. • ObjSens2: the same as ObjSens1, but it also keeps track of return variables.

27. Implementations • Context-sensitive analysis based on the call string approach to context sensitivity, for a call string k = 1 (CallSite). • Distinguishes context per call site. • To allow for comparison, the context replication is performed for this, formal parameters and return variables in instance methods and constructors.

28. Implementations • The 3 context-sensitive analyses were built on top of an existing implementation of Andersen’s context-insensitive points-to analysis (And). • The analyses are using the optimization techniques we discussed. • The Soot framework was used to process Java bytecode and to build a typed intermediate representation.

29. Characteristics of Programs

30. Analysis Cost

31. Discussion • Time and memory cost is comparable to Andersen’s analysis. • Amount of work is similar: And has to consider all possible objects for a statement s. Even though context-sensitive analyses do more work to keep track of different contexts, they eventually end up doing less work per statement s. • For the majority of programs, adding the return values to R* does not increase cost.

32. Discussion • Call string context-sensitive analysis (CallSite) achieves practical cost. • CallSite has poor running time for larger programs, probably because it is less precise than ObjSens2.

33. MOD Analysis Implementation • Measurements of ObjSens2, CallSite, and And. • Percentages are with respect to the number of statements that modify at least one object. • Each column shows the percentage of the total number of statements that modify the respective number of objects. • More precise analyses produce a smaller percentage number.

34. MOD Analysis Precision

35. Conclusions • Presented a framework for parameterized object-sensitive points-to analysis, and side-effect and def-use analyses based on it. • Object-sensitive analysis achieves significantly better precision than context-insensitive analysis, while remaining efficient and practical.

36. Future Work • Investigate other instantiations of the framework: more precise naming of sub-objects of composite objects. • Investigate applications of points-to, side-effect, and def-use analyses in the context of software productivity tools.