180 likes | 264 Views
Points-to Analysis for Java Using Annotated Constraints. Atanas (Nasko) Rountev Ana Milanova Barbara Ryder Rutgers University. x. o 1. f. y. o 2. Points-to Analysis for Java. Which objects may reference variable x point to? Builds a points-to graph. x = new A(); y = new B();
E N D
Points-to Analysis for Java Using Annotated Constraints Atanas (Nasko) Rountev Ana Milanova Barbara Ryder Rutgers University
x o1 f y o2 Points-to Analysis for Java • Which objects may reference variable x point to? • Builds a points-to graph x = new A(); y = new B(); x.f = y;
Uses of Points-to Information • Clients: compilers and SE tools • Object read-write information • Side-effect analysis, dependence analysis • Call graph construction • Devirtualization & inlining • Synchronization removal • Stack-based object allocation
Our Work • Define a points-to analysis for Java • Based on Andersen’s analysis for C • Efficient constraint-based implementation • Annotated constraints • Empirical evaluation of cost and precision
Outline • Points-to analysis for Java • Constraint-based implementation • Empirical results • Summary & future work
Our Points-to Analysis • Based on Andersen’s analysis for C • Handles virtual calls • Simulates the run-time method lookup • Models the fields of objects • Analyzes executable code • Ignores dead code from reusable modules
a thisB.m f b x o1 o2 q Points-to Analysis in Action class A { void m(X p) {..} } class B extends A { X f; void m(X q) { this.f=q; } } B b = new B(); X x = new X(); A a = b; a.m(x);
Efficient Implementation • Because of Andersen’s analysis: cubic worst-case complexity • Constraint-based approach • Extends previous work for C in BANE • Define and solve a system of annotated set-inclusion constraints
Annotated Constraints • Form: LaR • L and R denote sets • Annotation a: additional information • Kinds of set expressions L and R • Set variables: represent points-to sets • ref terms: represent objects • Other kinds of expressions
o1 p o2 o ref(o,VO) VP f ref(o2,VO2) fVO1 Set variables and ref terms • Set variables represent points-to sets • For each reference variable p: VP • For each object o: Vo • Object o is denoted by term ref(o,Vo)
p o1 f q o2 Example: Accessing Fields ref(o1,VO1) VP p = new A(); q = new B(); p.f = q; ref(o2,VO2) Vq VP proj(ref,W) Vq f W W VO1 Vq f VO1 ref(o2,VO2)f VO1
ref(o,VO) VP receiver object o Vx Vz ref(o,VO) Vthis called method m’ Example: Virtual Calls VP m lam(Vx) p.m(x);
Experiments • 23 Java programs: 14 – 677 user classes • Added the necessary library classes • Machine: 360 MHz, 512Mb • Cost: time and memory • Precision • Object read-write information • Call graph construction • Synchronization removal and stack allocation
Summary • Defined a points-to analysis for Java • Implementation with annotated constraints • Practical cost and good precision • Future work • Impact on client applications • Efficient context-sensitive analysis