Parameterized Object Sensitivity for Points-to Analysis for Java. Authors: Ana Milanova, Atanas Rountev, Barbara G. Ryder Presenter: Zheng Song

Size: px

Start display at page:

Download "Parameterized Object Sensitivity for Points-to Analysis for Java. Authors: Ana Milanova, Atanas Rountev, Barbara G. Ryder Presenter: Zheng Song"

Phyllis Harrison
6 years ago
Views:

1 Parameterized Object Sensitivity for Points-to Analysis for Java Authors: Ana Milanova, Atanas Rountev, Barbara G. Ryder Presenter: Zheng Song

2 Outlines Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

3 Outlines Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

4 Introduction One sentence to conclude this paper: analyze a method separately for each of the objects on which this method is invoked For: Points-to Analysis: Method in Java to determine the set of objects pointed to by a reference variable or a reference object field

5 Sample points-to graph

6 Outlines Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

7 Existing Methods Andersen s algorithm: flow insensitive & context insensitive Semantics (why called semantics?) R set of all reference variables O set of all objects created at object allocation sites F contains all instance fields in program class Edge (r,oi) Є R x O (<oi,f>, oj) Є (O x F) x O Transfer functions

8 Example R Edge:R xo O Edge: (O x F) x O All statements are divided into : Go through each statement and conduct the graph following: Set of Instance fields: F Problem: 1. what s the difference between OOPSLA 01?

9 Existing Methods Flow insensitive V.S. Flow sensitive:

10 Existing Methods Context insensitive V.S. Context sensitive:

11 Its limitation in Object Oriented Programing Encapsulation Inheritance Collection (Containers) Lets try to analyze these features using flow insensitive and context insensitive analysis

12 Encapsulation x1 O1 O2 x2 f f f f y1 O3 x this y2 O4

13 Inheritance y O1 O2 z f A.xa f B.xb this f C.xc f b O3 O4 c

14 container c1 C1 o1 C1 o2 C1 c2 C1 data data this C1 data data o3 C1 o3' o4 C1 data_ C1 tmp

15 Imprecision Encapsulation Inheritance Container are all strong concepts of OOP But not captured properly with old techniques Solution is Object sensitivity

16 Outlines Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

17 Object Sensitivity With object sensitivity, each instance method and each constructor is analyzed separately for each object on which this method/constructor may be invoked. How? Revised semantics O` - set of all object names R` - set of replicas of reference variable Relation α(c,m)=> α(o,m): C, or D which is a superclass of C Set of new transfer functions

18 Object Sensitivity Object Names Oij pq:the sequence of allocation sites (si, sj,..., sp, sq). A particular name oij pq represents all run-time objects that were created by sq when the enclosing instance method or constructor was invoked on an object represented by name oij...p which was created at allocation site sp (recursive ) S1: object O1 S2: object O2 S3: object O3 O1=> O21 & O31

19 Object Sensitivity Context Sensitivity With more objects, next step we make more references pointing to these objects: [\epsilon is to deal with static calls] If r is a local variable or a formal parameter of an instance method or a constructor m, the pair (r, o) is mapped to a fresh variable ro for every context o O for which α(o, m) holds. Fig. 4, two copies of A.this corresponding to contexts o3 and o4 Fig. 5 therefore there are context copies of put.this, put.data tmp, and put.e corresponding to contexts o2 and o3 Q: how to formalize each element in R?

20 Breaking News Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

21 Parameterized Object Sensitivity Notes: 1. The parameterized framework only apply to the set of objects (O ), by affecting (O ), it further affects R and the transfer functions; 2. If k=1, it is actually Andersen s algorithm 3. K can be different to different statements Q: why we need k?

22 Transfer Functions Object Sensitivity

23 Context sensitivity included y O1 O2 z B.this o3,b.xb o3, A.xa o3 f A.xa f C.this o4,c.xc o4, B.xb this f C.xc A.xa o4 f b O3 O4 c

24 Example3.1.4 y O1 O2 z f A.xa B.xb this f f C.xc f b O3 O4 c

25 Advantages Models OOP features Distinguishes between different receiver objects Static methods and variables can be handled with insensitivity Can be parameterized

26 Outlines Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

27 Side-effect Analysis (MOD) Instance field assignments Virtual method calls Typo: should be c Static method calls

28 Outlines Introduction Existing Method and its limitation Object Sensitive analysis Parameterized Object Sensitivity Implementation Evaluation Questions

29 Implementations Parameterized object-sensitive points-to analysis (context depth = 1): ObjSens1: keeps context-sensitive information for implicit parameters this and formal parameters of instance methods and constructors. ObjSens2: the same as ObjSens1, but it also keeps track of return variables.

30 Implementations Context-sensitive analysis based on the call string approach to context sensitivity, for a call string k = 1 (CallSite). Distinguishes context per call site. To allow for comparison, the context replication is performed for this, formal parameters and return variables in instance methods and constructors.

31 Characteristics of Programs

32 Analysis Cost

33 MOD Analysis Precision

34 Conclusions Presented a framework for parameterized object-sensitive points-to analysis, and sideeffect and def-use analyses based on it. Object-sensitive analysis achieves significantly better precision than context-insensitive analysis, while remaining efficient and practical.

35 Acknowledgement Besides the original paper and its journal version, some materials are derived from UPENN CIS570 Lecture Notes UMD CMSC737(Fundamentals of Software Testing), Student Presentation by Anand Bahety& Dan Bucatanschi

Parameterized Object Sensitivity for Points-to Analysis for Java

Parameterized Object Sensitivity for Points-to Analysis for Java Ana Milanova Dept. Computer Science Rensselaer Polytechnic Institute milanova@cs.rpi.edu Atanas Rountev Dept. Computer Science and Engineering