Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis
To resolve aliasing, precise program analyses rely on pointer analyses. Demand-driven pointer analysis seeks to be efficient by computing information only for variables on which a demand is raised, through a points-to or alias query. Yet, research has shown that when applied to large-scale programs even demand-driven analyses can become expensive in terms of memory and runtime. This paper thus investigates to what extent demand-driven pointer analysis can be accelerated further if being executed over a sparse control-flow graph (CFG), specialized to those queries. We investigate two designs: First, type-aware sparsification, in which the resulting CFG only consists of statements containing variables that are type compatible with the query variable. Second, alias-aware sparsification, where the resulting CFG consists of the def-use chains of the query variable and all its intra-procedural aliases. We implement both designs in SPARSEBOOMERANG by extending BOOMERANG, a pointer analysis framework based on push-down systems. We evaluate SPARSEBOOMERANG by comparing it to BOOMERANG in terms of precision and performance. On the POINTERBENCH micro-benchmark suite for alias analysis, SPARSEBOOMERANG maintains the precision of BOOMERANG, in both designs. We evaluate the runtime and memory performance of SPARSEBOOMERANG by using FLOWDROID as a taint analysis client on real-world apps. Compared to the baseline BOOMERANG, on average SPARSEBOOMERANG solves alias queries 2.4x faster when using the type-aware sparsification strategy, and 2.8x faster when using the alias-aware variant with negligible memory overhead.
Wed 19 AprDisplayed time zone: Dublin change
11:00 - 12:30 | Session 13: Testing with Static Analysis MethodsResearch Papers / Previous Editions at Pearse suite Chair(s): Paolo Arcaini National Institute of Informatics | ||
11:00 20mTalk | Address-Aware Query Caching for Symbolic Execution Previous Editions DOI | ||
11:20 20mTalk | Automating Differential Testing with Overapproximate Symbolic Execution Previous Editions DOI | ||
11:40 20mTalk | Two Sparsification Strategies for Accelerating Demand-Driven Pointer Analysis Research Papers Pre-print Media Attached | ||
12:00 20mTalk | Model Generation For Java Frameworks Research Papers Linghui Luo Amazon Web Services, Goran Piskachev Amazon Web Services, Ranjith Krishnamurthy Fraunhofer IEM, Julian Dolby IBM Research, Eric Bodden Heinz Nixdorf Institut, Paderborn University and Fraunhofer IEM, Martin Schäf Amazon Web Services |