ICST 2023
Sun 16 - Thu 20 April 2023 Dublin, Ireland

To resolve aliasing, precise program analyses rely on pointer analyses. Demand-driven pointer analysis seeks to be efficient by computing information only for variables on which a demand is raised, through a points-to or alias query. Yet, research has shown that when applied to large-scale programs even demand-driven analyses can become expensive in terms of memory and runtime. This paper thus investigates to what extent demand-driven pointer analysis can be accelerated further if being executed over a sparse control-flow graph (CFG), specialized to those queries. We investigate two designs: First, type-aware sparsification, in which the resulting CFG only consists of statements containing variables that are type compatible with the query variable. Second, alias-aware sparsification, where the resulting CFG consists of the def-use chains of the query variable and all its intra-procedural aliases. We implement both designs in SPARSEBOOMERANG by extending BOOMERANG, a pointer analysis framework based on push-down systems. We evaluate SPARSEBOOMERANG by comparing it to BOOMERANG in terms of precision and performance. On the POINTERBENCH micro-benchmark suite for alias analysis, SPARSEBOOMERANG maintains the precision of BOOMERANG, in both designs. We evaluate the runtime and memory performance of SPARSEBOOMERANG by using FLOWDROID as a taint analysis client on real-world apps. Compared to the baseline BOOMERANG, on average SPARSEBOOMERANG solves alias queries 2.4x faster when using the type-aware sparsification strategy, and 2.8x faster when using the alias-aware variant with negligible memory overhead.

Wed 19 Apr

Displayed time zone: Dublin change

11:00 - 12:30
Session 13: Testing with Static Analysis MethodsResearch Papers / Previous Editions at Pearse suite
Chair(s): Paolo Arcaini National Institute of Informatics
11:00
20m
Talk
Address-Aware Query Caching for Symbolic Execution
Previous Editions
David Trabish Tel Aviv University, Shachar Itzhaky Technion, Noam Rinetzky Tel Aviv University
DOI
11:20
20m
Talk
Automating Differential Testing with Overapproximate Symbolic Execution
Previous Editions
Richard Rutledge Georgia Institute of Technology, Alessandro Orso Georgia Tech
DOI
11:40
20m
Talk
Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis
Research Papers
Kadiray Karakaya Heinz Nixdorf Institut, Paderborn University, Eric Bodden
Pre-print Media Attached
12:00
20m
Talk
Model Generation For Java Frameworks
Research Papers
Linghui Luo Amazon Web Services, Goran Piskachev Amazon Web Services, Ranjith Krishnamurthy Fraunhofer IEM, Julian Dolby IBM Research, Eric Bodden Heinz Nixdorf Institut, Paderborn University and Fraunhofer IEM, Martin Schäf Amazon Web Services