Points-to Analysis for Java Using Annotated Constraints

1
Points-to Analysis for Java Using Annotated
Constraints

• Atanas (Nasko) Rountev
• Ana Milanova
• Barbara Ryder
• Rutgers University

2
Points-to Analysis for Java

• Which objects may reference variable x point to?
• Builds a points-to graph

x new A() y new B() x.f y
3
Uses of Points-to Information

• Clients compilers and SE tools
• Object read-write information
• Side-effect analysis, dependence analysis
• Call graph construction
• Devirtualization inlining
• Synchronization removal
• Stack-based object allocation

4
Our Work

• Define a points-to analysis for Java
• Based on Andersens analysis for C
• Efficient constraint-based implementation
• Annotated constraints
• Empirical evaluation of cost and precision

5
Outline

• Points-to analysis for Java
• Constraint-based implementation
• Empirical results
• Summary future work

6
Our Points-to Analysis

• Based on Andersens analysis for C
• Handles virtual calls
• Simulates the run-time method lookup
• Models the fields of objects
• Analyzes executable code
• Ignores dead code from reusable modules

7
Points-to Analysis in Action
class A void m(X p) .. class B extends A
X f void m(X q) this.fq B
b new B() X x new X() A a b a.m(x)
8
Efficient Implementation

• Because of Andersens analysis cubic worst-case
  complexity
• Constraint-based approach
• Extends previous work for C in BANE
• Define and solve a system of annotated
  set-inclusion constraints

9
Annotated Constraints

• Form L ? a R
• L and R denote sets
• Annotation a additional information
• Kinds of set expressions L and R
• Set variables represent points-to sets
• ref terms represent objects
• Other kinds of expressions

10
Set variables and ref terms

• Set variables represent points-to sets
• For each reference variable p VP
• For each object o Vo
• Object o is denoted by term ref(o,Vo)

11
Example Accessing Fields

ref(o1,VO1) ? VP
p new A() q new B() p.f q
ref(o2,VO2) ? Vq
VP ? proj(ref,W) Vq ? f W
W ? VO1
Vq ? f VO1
ref(o2,VO2) ? f VO1
12
Example Virtual Calls
VP ? m lam(Vx)
p.m(x)
13
Experiments

• 23 Java programs 14 677 user classes
• Added the necessary library classes
• Machine 360 MHz, 512Mb
• Cost time and memory
• Precision
• Object read-write information
• Call graph construction
• Synchronization removal and stack allocation

14
Analysis Time
15
Number of new X() whose objects are accessed by
p.f
16
Resolution of Virtual Call Sites
17
Thread-local new sites
18
Summary

• Defined a points-to analysis for Java
• Implementation with annotated constraints
• Practical cost and good precision
• Future work
• Impact on client applications
• Efficient context-sensitive analysis