Context-sensitive points-to analysis: Is it worth it?

Abstract

We present the results of an empirical study evaluating the precision of subset-based points-to analysis with several variations of context sensitivity on Java benchmarks of significant size. We compare the use of call site strings as the context abstraction, object sensitivity, and the BDD-based context-sensitive algorithm proposed by Zhu and Calman, and by Whaley and Lum. Our study includes analyses that context-sensitively specialize only pointer variables, as well as ones that also specialize the heap abstraction. We measure bold characteristics of the points-to sets themselves, as well as effects on the precision of client analyses. To guide development of efficient analysis implementations, we measure the number of contexts, the number of distinct contexts, and the number of distinct points-to sets that arise with each context sensitively variation, To evaluate precision we measure the size of the call graph in terms of methods and edges, the number of devirtualizable call sites, and the number of caste statically provable to he safe. The results of of study indicate that object-sensitive analysis implementations are likely to scale better and more predictably than the other approaches that object-sansitive analyses are more precise than comparable variations of the other approaches; that specializing the heap abstraction improves precision more than extending the length of context strings; and that the profusion of cycles in Java call graphs severely reduces precision of analysis that forsake context sensitivity in cyclic regions. © Springer-Verlage Berlin Heidelberg 2006.