Making k- Object-Sensitive Pointer Analysis More Precise with Still k - PowerPoint PPT Presentation

Making k- Object-Sensitive Pointer Analysis More Precise with Still k -Limiting Tian Tan , Yue Li and Jingling Xue SAS 2016 September, 2016 1

A New Pointer Analysis for Object-Oriented Programs 2

Pointer Analysis  Determine “which objects can a variable point to?”  Foundation of many clients: ◦ Bug detection ◦ Security analysis ◦ Compiler optimization ◦ Program understanding ◦ … 3

Object-Oriented Programs  Java, C#, Object- C, JavaScript, … ◦ Embedded software: ◦ Mobile application: ◦ Web server: ◦ Desktop application: 4

A Practically Useful Pointer Analysis for Object-Oriented Programs 5

A Practically Useful Pointer Analysis for Object-Oriented Programs Good Context Abstraction (Context Sensitivity) 6

A Practically Useful Pointer Analysis for Object-Oriented Programs Good Context Abstraction (Context Sensitivity) k -CFA (call-site-sensitivity), type- sensitivity, … 7

Object-Sensitivity Arguably the best context abstraction for pointer analysis for object-oriented programs 8

Object-Sensitivity  Widely used in diverse real-world clients ◦ Property Verification (e.g., API protocol) ISSTA’06, TOSEM’08, PLDI’14, FSE’15, … ◦ Bug Detection (e.g., data race, deadlock) PLDI’06, ICSE’09, ISSTA’13, OOPSLA’15, … ◦ Security Analysis (e.g., taint analysis) PLDI’09, IEEE S&P’11, FSE ’14 , NDSS’15, FSE ’ 15, … ◦ Other Fundamental Analyses (e.g., slicing) PLDI ’07, PLDI’14, ICSE’14, ECOOP’16 , … 9

Object-Sensitivity  Widely implemented in analysis platforms Chord A PPOSCOPY 10

What is Object-Sensitivity?  Objects (allocation sites) as contexts  k -CFA  k -obj 11

A Code Example class A { class B { void foo() { void bar() { v = … A a1 = new A(); // A/1 } a1.foo(); } A a2 = new A(); // A/2 a2.foo(); } } 12

1-CFA (call-site) class A { class B { void foo() { void bar() { v = … A a1 = new A(); // A/1 } a1.foo() ; } A a2 = new A(); // A/2 a2.foo() ; } } Context Variable Object … [a1.foo()] v … [a2.foo()] v 13

1-obj (allocation-site of receiver object) class A { class B { void foo() { void bar() { v = … A a1 = new A(); // A/1 } a1.foo(); } A a2 = new A(); // A/2 a2.foo(); } } Context Variable Object … [A/1] v … [A/2] v 14

k -obj when k > 1? class A { class B { void foo() { void bar() { v = … A a1 = new A(); // A/1 } a1.foo(); } A a2 = new A(); // A/2 a2.foo(); } } 15

2-obj (allocation- sites of 2 “consecutive” receiver objects) class A { class B { class C { void foo() { void bar() { void m() { v = … A a1 = new A(); // A/1 B b = new B(); // B/1 } a1.foo(); b.bar(); } } A a2 = new A(); // A/2 } a2.foo(); } } Context Variable Object … [B/1,A/1] v … [B/1,A/2] v 16

2-obj (allocation- sites of 2 “consecutive” receiver objects) class A { class B { class C { void foo() { void bar() { void m() { v = … A a1 = new A(); // A/1 B b = new B(); // B/1 } a1.foo(); b.bar(); } } A a2 = new A(); // A/2 } a2.foo(); } } B/1 Context Variable Object … [B/1,A/1] v … [B/1,A/2] v A/1 A/2 17

2-obj (allocation- sites of 2 “consecutive” receiver objects) class A { class B { class C { void foo() { void bar() { void m() { v = … A a1 = new A(); // A/1 B b = new B(); // B/1 } a1.foo(); b.bar(); } } A a2 = new A(); // A/2 } a2.foo(); } } k = 2 B/1 Context Variable Object … [B/1,A/1] v … k = 1 [B/1,A/2] v A/1 A/2 18

2-obj (allocation- sites of 2 “consecutive” receiver objects) class A { class B { class C { void foo() { void bar() { void m() { v = … A a1 = new A(); // A/1 B b = new B(); // B/1 } a1.foo(); b.bar(); } } A a2 = new A(); // A/2 } a2.foo(); } } k = 2 B/1 Context Variable Object … [B/1,A/1] v … k = 1 [B/1,A/2] v A/1 A/2 Object Allocation Graph (OAG) 19

An Observation  Redundant Context Element 20

An Observation  Redundant Context Element HashSet/1 HashSet/2 HashMap/1 Entry/1 An example from JDK, java.util.* 21

3-obj  Contexts fully separated  Precise Two contexts: k = 3 HashSet/1 HashSet/2 [HashSet/1,HashMap/1,Entry/1] [HashSet/2,HashMap/1,Entry/1] HashMap/1 k = 2 k = 1 Entry/1 An example from JDK, java.util.* 22

3-obj  Contexts fully separated  Precise Two contexts: k = 3 HashSet/1 HashSet/2 [HashSet/1,HashMap/1,Entry/1] [HashSet/2,HashMap/1,Entry/1] HashMap/1 k = 2 3-obj is unscalable k = 1 Entry/1 An example from JDK, java.util.* 23

2-obj  Contexts not separated One context: HashSet/1 HashSet/2 [HashMap/1,Entry/1] HashMap/1 k = 2 k = 1 Entry/1 An example from JDK, java.util.* 24

2-obj  Contexts not separated  Imprecise One context: HashSet/1 HashSet/2 [HashMap/1,Entry/1] HashMap/1 k = 2 k = 1 Entry/1 An example from JDK, java.util.* 25

2-obj  Contexts not separated  Imprecise  Redundant context elements used One context: HashSet/1 HashSet/2 [ HashMap/1 ,Entry/1] HashMap/1 k = 2 HashMap/1 as context element k = 1 Entry/1 is redundant An example from JDK, java.util.* 26

This Paper: Avoid Redundant Context Element 27

2-obj HashSet/1 HashSet/2 k = 2 HashMap/1 k = 1 Entry/1 One context: [HashMap/1,Entry/1] 28

2-obj Our approach k = 2 HashSet/1 HashSet/2 HashSet/1 HashSet/2 k = 2 HashMap/1 HashMap/1 k = 1 k = 1 Entry/1 Entry/1 Redundant One context: Two contexts: one removed [HashMap/1,Entry/1] [HashSet/1,Entry/1] [HashSet/2,Entry/1] 29

2-obj Our approach k = 2 HashSet/1 HashSet/2 HashSet/1 HashSet/2 k = 2 HashMap/1 HashMap/1 k = 1 k = 1 Entry/1 Entry/1 Redundant One context: Two contexts: one removed [HashMap/1,Entry/1] [HashSet/1,Entry/1] [HashSet/2,Entry/1] Benefit: improve precision with still k -limiting 30

Methodology (BEAN) Context Graph Selection Problem Problem 31

Context Graph Selection Problem Problem Object Allocation HashSet/1 HashSet/2 Context Relation Graph (OAG) HashMap/1 Entry/1 32

Context Graph Selection Problem Problem Object Allocation HashSet/1 HashSet/2 Context Relation Graph (OAG) HashMap/1 Contexts in k -obj Paths in OAG Entry/1 33

Context Graph Selection Problem Problem Object Allocation HashSet/1 HashSet/2 Context Relation Graph (OAG) HashMap/1 Contexts in k -obj Paths in OAG Entry/1 Avoid Redundant Select Representative Nodes Context Elements to Distinguish Paths 34

An OAG 35

5 contexts in k -obj 5 paths in OAG An OAG 36

Select 5 contexts in k -obj 5 paths in OAG Distinguish An OAG 37

Select 5 contexts in k -obj k = 8 5 paths in OAG Distinguish k = 7 k = 6 k = 5 k -obj: k = 8 (all nodes selected) k = 4 k = 3 k = 2 k = 1 An OAG 38

Select 5 contexts in k -obj 5 paths in OAG Distinguish k = 3 1 2 k -obj: k = 8 (all nodes selected) BEAN: k = 3 (representative nodes selected) k = 2 4 5 3 k = 1 6 An OAG 39

Select 5 contexts in k -obj 5 paths in OAG Distinguish k = 3 1 2 k -obj: k = 8 (all nodes selected) BEAN: k = 3 (representative nodes selected) k = 2 4 5 3 k = 1 6 5 contexts selected by BEAN: [1,3,6], [2,3,6], An OAG [1,4,6], [2,4,6], [5,6] 40

Select 5 contexts in k -obj 5 paths in OAG Distinguish k = 3 1 2 k -obj: k = 8 (all nodes selected) precision = BEAN: k = 3 (representative nodes selected) k = 2 4 5 3 k = 1 6 5 contexts selected by BEAN: [1,3,6], [2,3,6], An OAG [1,4,6], [2,4,6], [5,6] 41

How to Select Representative Nodes to Distinguish Paths? 42

How to Select Representative Nodes to Distinguish Paths?  Our intuition: Multiple paths 43

How to Select Representative Nodes to Distinguish Paths?  Our intuition: Multiple paths = Divergence 44

How to Select Representative Nodes to Distinguish Paths?  Our intuition: Multiple paths = Divergence … … + 45

How to Select Representative Nodes to Distinguish Paths?  Our intuition: Multiple paths = Divergence … … + Confluence 46

How to Select Representative Nodes to Distinguish Paths?  Our intuition: Multiple paths = Divergence … … + Confluence 47

How to Select Representative Nodes to Distinguish Paths?  Our intuition: Multiple paths = Divergence … … + Confluence Representative nodes 48

49

Representative nodes 50

Theorem 1  Under full -object-sensitivity (when k = ∞) Precision Precision of = of BEAN k -obj 51

Theorem 2  Under the same k -limiting Precision Precision of ≥ of BEAN k -obj 52

B EAN : Framework Points-To Information OAG Construction Pointer OAG Chord Analysis Selected Contexts Contexts Selection 53

Open-Source Implementation www.cse.unsw.edu.au/~corg/bean 54

Evaluation - Clients  May-Alias  May-Fail-Cast Typical clients to evaluate pointer analysis’s effectiveness e.g., APLAS’15, PLDI’14, PLDI’13, POPL’11, OOPSLA’09, … 55

Evaluation - Analyzed Targets  Standard DaCapo Java benchmarks  Large Java library: JDK 1.6 Widely used programs and library in pointer analysis e.g., PLDI ’14, ECOOP’14, PLDI’13, OOPSLA’13, POPL’11, … 56