Precision-Guided Context Sensitivity for Pointer Analysis Yue Li, - PowerPoint PPT Presentation

Precision-Guided Context Sensitivity for Pointer Analysis Yue Li, Tian Tan, Anders Møller, Yannis Smaragdakis OOPSLA 2018 1

A New Pointer Analysis T echnique for Object-Oriented Programs 2

Pointer Analysis Determines “which objects a variable can point to?” 3

Uses of Pointer Analysis Clients Tools  Security analysis  Bug detection  Compiler optimization Chord  Program verification  Program understanding …  … 4

Uses of Pointer Analysis Clients Tools  Security analysis  Bug detection  Compiler optimization Chord  Program verification  Program understanding …  … A precise pointer analysis benefits all above clients & tools 5

Context Sensitivity One of the most successful pointer analysis techniques for producing high precision for OO programs 6

Context Sensitivity Distinguishes points-to information of methods by different calling contexts 7

Context Sensitivity: Example class A { static void main() { String foo(String s) { A a1 = new A(); // A/1 return s; b1 = a1.foo("s1"); } } A a2 = new A(); // A/2 b2 = a2.foo("s2"); } Variable Object "s1" , "s2" s "s1" , "s2" b1 "s1" , "s2" b2 Context-Insensitivity 8

Context Sensitivity: Example class A { static void main() { String foo(String s) { A a1 = new A(); // A/1 return s; b1 = a1.foo("s1"); } } A a2 = new A(); // A/2 b2 = a2.foo("s2"); } Variable Object "s1" , "s2" s "s1" , "s2" b1 "s1" , "s2" b2 Context-Insensitivity 9

Context Sensitivity: Example class A { static void main() { String foo(String s) { A a1 = new A(); // A/1 return s; b1 = a1.foo("s1"); } } A a2 = new A(); // A/2 b2 = a2.foo("s2"); } Context Variable Object [ A/1 ] Variable Object s "s1" "s1" , "s2" [ A/2 ] s "s2" s [ ] "s1" , "s2" b1 b1 "s1" "s1" , "s2" [ ] b2 b2 "s2" 1-Object-Sensitivity Context-Insensitivity 10

Context Sensitivity Widely adopted by static analysis frameworks for OO programs Chord FlowDroid 11

Problem of Context Sensitivity (C.S.) Comes with heavy efficiency costs Conventional: apply C.S. to all methods 12

Problem of Context Sensitivity (C.S.) Comes with heavy efficiency costs Conventional: apply C.S. to all methods Do not benefit from C.S. Analyzed for multiple contexts redundantly 13

Problem of Context Sensitivity (C.S.) Comes with heavy efficiency costs Conventional: apply C.S. to all methods Benefit from C.S. Do not benefit (gain precision) from C.S. Precision-critical Analyzed for multiple methods contexts redundantly 14

Problem of Context Sensitivity (C.S.) Comes with heavy efficiency costs Benefit from C.S. Do not benefit (gain precision) from C.S. C.S. C.I. Precision-critical Analyzed for multiple methods contexts redundantly 15

Problem of Context Sensitivity (C.S.) Comes with heavy efficiency costs Preserve precision of C.S. Improve efficiency Benefit from C.S. Do not benefit (gain precision) from C.S. C.S. C.I. Precision-critical Analyzed for multiple methods contexts redundantly 16

Our Goal Identify precision-critical methods Preserve precision of C.S. Improve efficiency Benefit from C.S. Do not benefit (gain precision) from C.S. C.S. C.I. Precision-critical Analyzed for multiple methods contexts redundantly 17

Challenge Still unclear where and how imprecision is introduced in a context-insensitive pointer analysis context-sensitive precision yield When? analysis benefits omitting introduce precision When? context sensitivity losses 18

Our Key Contribution Classify source of imprecision into three general precision-loss patterns ◦ Direct flow ◦ Wrapped flow ◦ Unwrapped flow 19

Our Key Contribution Classify source of imprecision into three general precision-loss patterns ◦ Direct flow account for ~99% ◦ Wrapped flow of precision ◦ Unwrapped flow 20

Our Key Contribution Classify source of imprecision into three general precision-loss patterns ◦ Direct flow account for ~99% ◦ Wrapped flow of precision ◦ Unwrapped flow Recognize Identify Three Flow Precision-Critical Patterns Methods 21

IN and OUT Methods Given a class ◦ IN methods  One or more parameters ◦ OUT methods  non- void return types 22

IN and OUT Methods Given a class class Foo { C f; ◦ IN methods void setF(C p) {  One or more parameters this.f = p; } ◦ OUT methods C getF() { C r = this.f;  non- void return types return r; } void bar() { this.f = null; } } 23

IN and OUT Methods Given a class class Foo { C f; ◦ IN methods IN void setF(C p) {  One or more parameters this.f = p; } ◦ OUT methods C getF() { C r = this.f;  non- void return types OUT return r; } void bar() { this.f = null; } } 24

The Three General Flow Patterns  Direct flow  Wrapped flow  Unwrapped flow Identified by leveraging a context-insensitive pointer analysis (as pre-analysis) 25

The Three General Flow Patterns  Direct flow  Wrapped flow  Unwrapped flow 26

Direct Flow O class C { void M1(Object p) { IN ... } ... Object M2() { ... OUT return r; } } O 27

Direct Flow O class C { void M1(Object p) { IN ... } • variable assignments • field load/store ... • method calls/returns Object M2() { ... OUT return r; } } O 28

Direct Flow O class C { void set(Object p) { void M1(Object p) { IN this.f = p; ... } } • variable assignments • field load/store ... • method calls/returns Object get() { Object M2() { Object r = this.f; ... return r; OUT return r; } Example: common } setter & getter } O 29

Key Insight: Causes of Imprecision C.I. B A IN • Direct flow Flows: objects merge and propagate OUT B A B A 30

Key Insight: Causes of Imprecision C.I. B A IN • Direct flow Flows: objects • Wrapped flow merge and • Unwrapped flow propagate • Combinations OUT B A B A 31

The Three General Flow Patterns  Direct flow  Wrapped flow  Unwrapped flow 32

Wrapped Flow O class C { void M1(Object p) { IN ... } ... object wrapping void Mi() { o.f = q; } ... W Object M2() { ... OUT return r; } } • variable assignments • field load/store W • method calls/returns 33

Wrapped Flow O class C { void M1(Object p) { IN ... } ... object wrapping void Mi() { o.f = q; } ... W Object M2() { ... Example: OUT return r; collection & } iterator } • variable assignments • field load/store W • method calls/returns 34

Wrapped Flow O class C { void M1(Object p) { IN ... } ... multiple object wrapping void Mi() { o.f = q; } ... W Object M2() { ... OUT return r; } } • variable assignments • field load/store W ’ • method calls/returns 35

The Three General Flow Patterns  Direct flow  Wrapped flow  Unwrapped flow 36

Unwrapped Flow O class C { void M1(Object p) { IN ... } ... object unwrapping void Mi() { q = o.f; } U ... Object M2() { ... OUT return r; } } • variable assignments U • field load/store • method calls/returns 37

Unwrapped Flow O class C { void M1(Object p) { IN ... } ... object unwrapping void Mi() { q = o.f; } U ... Object M2() { ... Example: JDK OUT return r; synchronized } container } • variable assignments U • field load/store • method calls/returns 38

Unwrapped Flow O class C { void M1(Object p) { IN ... } ... multiple object unwrapping void Mi() { q = o.f; } U ... Object M2() { ... OUT return r; } } • variable assignments U ’ • field load/store • method calls/returns 39

Combinations of Three General Flows The direct, wrapped and unwrapped flows can be combined, e.g., unwrapped wrapped + IN OUT flow flow O W U 40

C.I. B A IN • Direct flow • Wrapped flow • Unwrapped flow • Combinations OUT A B B A Precision-critical methods: the methods involved in the flows 41

Identify precision-critical methods C.I. B A IN • Direct flow • Wrapped flow • Unwrapped flow • Combinations OUT A B B A Precision-critical methods: the methods involved in the flows 42

Identify precision-critical methods Apply C.S. only to C.I. C.S. B A B A IN IN • Direct flow • Wrapped flow • Unwrapped flow • Combinations OUT OUT A B A B B A Precision-critical methods: the methods involved in the flows 43

Identify precision-critical methods Apply C.S. only to C.I. C.S. B A B A IN IN OUT OUT A B A B B A Precision-critical methods: the methods involved in the flows 44

How to Analyze Flow Patterns? We propose precision flow graph (PFG) expresses direct, wrapped, unwrapped flows, and their combinations, in an uniform way 45

How to Analyze Flow Patterns? We propose precision flow graph (PFG) expresses direct, wrapped, unwrapped flows, and their combinations, in an uniform way Flows in Program Paths in PFG 46