Wed 7 Nov 2018 19:09 - 19:11 at Georgian - Poster & SRC
Object sensitivity analysis is a well-known form of context-sensitive points-to analysis. This analysis is parameterized by a bound on the names of symbolic objects associated with each allocated site. In this paper, we propose a novel approach based on object sensitivity analysis that takes as input a set of user queries, and tries to answer them using an initial round of inexpensive object sensitivity analysis that uses a low object-name length bound at all allocation sites. For the queries that are answered unsatisfactorily, the approach then pin points ``bad'' points-to facts, which are the ones that are responsible for the imprecision. It then employs a form of program slicing to identify allocation sites that are potentially causing these bad points-to facts to be generated. The approach then runs object sensitivity analysis once again, this time using longer names for just these allocation sites, with the objective of resolving the imprecision in this round. We describe our approach formally, prove its completeness, and describe a Datalog-based implementation of it on top of the Petablox framework. Our evaluation of our approach on a set of large Java benchmarks reveals that our approach is more precise than the baseline object sensitivity approach, and more precise on most large benchmarks than a recently proposed approach that uses SAT solvers to identify allocation sites to refine.