Object-sensitive pointer analysis (denoted k obj under $k$ -limiting) for an object-oriented program can be accelerated if context-sensitivity can be selectively applied to only some precision-critical variables/objects in a program. Existing pre-analyses for making such selections, which are performed as whole-program analyses to a program, are developed based on two broad approaches. One approach preserves the precision of object-sensitive pointer analysis but achieves limited speedups by reasoning about all the possible value flows in the program conservatively, while the other approach achieves greater speedups but sacrifices precision (often unduly) by examining only some but not all the value flows in the program heuristically. In this paper, we introduce a new pre-analysis approach, Turner $^{\mathcal{m}}$ (where $\mathcal {m}$ stands for modularity), that represents a sweet spot between these two existing ones, as it is designed to enable k obj to run significantly faster than the former approach and achieve significantly better precision than the latter approach. Turner $^{\mathcal{m}}$ is simple, lightweight yet effective due to two novel aspects in its design. First, we exploit a key observation that some precision-uncritical objects in the program can be approximated based on the object-containment relationship pre-established (from Andersen's analysis). In practice, this approximation introduces only a small degree of imprecision into k obj . Second, leveraging this initial approximation, we apply a novel object reachability analysis to the program by pre-analyzing its methods according to a reverse topological order of its call graph. When pre-analyzing each method, we make use of a simple DFA (Deterministic Finite Automaton) to reason about object reachability intra-procedurally from its entry to its exit along all the possible value flows established by its statements to identify its precision-critical variables/objects. In practice, this new modular object reachability analysis, which runs linearly in terms of the number of statements in the program, introduces again only a small loss of precision into k obj . We have validated Turner $^{\mathcal{m}}$ with an open-source implementation in Soot (already publicly available) against the state of the art by using a set of 12 widely used Java benchmarks and applications.

中文翻译：

---

以模块化方式选择上下文敏感度以加速对象敏感指针分析

对象敏感指针分析（记为k obj下$k$ 如果可以选择性地将上下文敏感性仅应用于程序中的某些精度关键变量/对象，则可以加速面向对象程序的限制）。现有的用于进行此类选择的预分析（作为对程序的整体程序分析执行）是基于两种广泛的方法开发的。一种方法保留了对象敏感指针分析的精度，但通过保守地推理程序中所有可能的值流实现了有限的加速，而另一种方法实现了更大的加速，但通过仅检查部分而不是所有的值流来牺牲精度（通常是过度的）价值以启发式的方式在程序中流动。在本文中，我们介绍了一种新的预分析方法，Turner $^{\mathcal{m}}$（在哪里$\数学{m}$代表模块化），它代表了这两个现有方法之间的最佳结合点，因为它旨在使k obj 的运行速度明显快于前一种方法，并实现比后一种方法明显更好的精度。车工 $^{\mathcal{m}}$由于其设计中的两个新颖方面，它简单、轻便但有效。首先，我们利用了一个关键观察结果，即可以根据预先建立的对象-包含关系（来自 Andersen 的分析）来近似程序中一些精度不严格的对象。实际上，这种近似只对k obj引入了很小程度的不精确性 . 其次，利用这个初始近似值，我们通过根据其调用图的反向拓扑顺序预分析其方法，对程序应用了一种新颖的对象可达性分析。在对每个方法进行预分析时，我们使用一个简单的 DFA（确定性有限自动机）在程序内推理对象可达性，从它的入口到它的出口沿着它的语句建立的所有可能的价值流来识别它的精度关键变量/对象。实际上，这种新的模块化对象可达性分析根据程序中的语句数线性运行，再次只对k obj引入了很小的精度损失 。我们已经验证了特纳 $^{\mathcal{m}}$通过使用一组 12 个广泛使用的 Java 基准和应用程序，在Soot （已经公开可用）中使用开源实现来对抗最先进的技术。