Better Together Martin Bravenboer LogicBlox Yannis Smaragdakis - - PowerPoint PPT Presentation

▶
better together
SMART_READER_LITE
LIVE PREVIEW

Better Together Martin Bravenboer LogicBlox Yannis Smaragdakis - - PowerPoint PPT Presentation

Sep 15, 2023 170 likes •1.18k views

Exception Analysis and Points-to Analysis Better Together Martin Bravenboer LogicBlox Yannis Smaragdakis UMass Amherst ISSTA 2009 International Symposium on Software Testing and Analysis overview 1 what do we do? precise analysis of

slide-1
SLIDE 1

Exception Analysis and Points-to Analysis

Better Together

Martin Bravenboer

LogicBlox

Yannis Smaragdakis

UMass Amherst

ISSTA 2009

International Symposium on Software Testing and Analysis

slide-2
SLIDE 2
  • verview

1

what do we do? precise analysis of exception handling improve precision and speed of points-to analyses

slide-3
SLIDE 3
  • verview

1

what do we do? precise analysis of exception handling improve precision and speed of points-to analyses how do we do it? fully declarative specification modular extension

slide-4
SLIDE 4
  • verview

1

what do we do? precise analysis of exception handling improve precision and speed of points-to analyses how do we do it? fully declarative specification modular extension why do you care? fast, sophisticated, simple different

slide-5
SLIDE 5
  • verview

1

what do we do? precise analysis of exception handling improve precision and speed of points-to analyses how do we do it? fully declarative specification modular extension why do you care? fast, sophisticated, simple different why is it relevant? major new experimental findings state-of-the-art points-to analyses

slide-6
SLIDE 6

what is exception analysis? 2

computation of control-flow induced by exceptions

void foo() { if(...) throw new FooException(); } void mid() { foo(); } void bar() { try { foo(); } catch(Exception exc) {...} }

slide-7
SLIDE 7

what is exception analysis? 2

computation of control-flow induced by exceptions

void foo() { if(...) throw new FooException(); } void mid() { foo(); } void bar() { try { foo(); } catch(Exception exc) {...} }

  • exception-flow induces

interprocedural assignments

  • exceptions are normal
  • bjects
  • arbitrary expressions can be

thrown

slide-8
SLIDE 8

what is exception analysis? 2

computation of control-flow induced by exceptions

void foo() { if(...) throw new FooException(); } void mid() { foo(); } void bar() { try { foo(); } catch(Exception exc) {...} }

  • exception-flow induces

interprocedural assignments

  • exceptions are normal
  • bjects
  • arbitrary expressions can be

thrown

catch(SomeException e) {

  • -throw e.getCause();

} throw

  • -createSomeException();
slide-9
SLIDE 9

what is exception analysis? 2

computation of control-flow induced by exceptions

void foo() { if(...) throw new FooException(); } void mid() { foo(); } void bar() { try { foo(); } catch(Exception exc) {...} }

questions answered:

  • what exceptions may foo

throw?

  • where may the

FooException thrown in foo get caught?

  • what exceptions may get

caught by the handler in bar?

slide-10
SLIDE 10

why exception analysis? (1) 3

application: program understanding

  • understand exception-flow in codebases
  • coding assistance tool
  • also for languages with declared checked exceptions
  • unchecked exceptions
  • throws-clause specifies superset
  • e.g. IOException

⇒ exception types do not explain where exceptions originate

slide-11
SLIDE 11

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application

slide-12
SLIDE 12

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application

slide-13
SLIDE 13

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application

slide-14
SLIDE 14

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application testsuite

slide-15
SLIDE 15

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application testsuite

slide-16
SLIDE 16

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application testsuite

slide-17
SLIDE 17

why exception analysis? (2) 4

application: test coverage of exceptional situations [Fu et al.]

library application testsuite

slide-18
SLIDE 18

why exception analysis? (3) 5

points-to analysis (facilitate other applications)

slide-19
SLIDE 19

points-to analysis 6

what objects can a variable point to?

program

void foo() { a = new A1(); b = id(a); } void bar() { a = new A2(); b = id(a); } A id(A a) { return a; }

slide-20
SLIDE 20

points-to analysis 6

what objects can a variable point to?

program

void foo() {

  • a = new A1();

b = id(a); } void bar() {

  • a = new A2();

b = id(a); } A id(A a) { return a; }

points-to

foo:a new A1() bar:a new A2()

  • bjects represented

by allocation sites

slide-21
SLIDE 21

points-to analysis 6

what objects can a variable point to?

program

void foo() { a = new A1();

  • b = id(a);

} void bar() { a = new A2();

  • b = id(a);

}

  • A id(A a) {

return a; }

points-to

foo:a new A1() bar:a new A2() id:a new A1(), new A2()

  • bjects represented

by allocation sites

slide-22
SLIDE 22

points-to analysis 6

what objects can a variable point to?

program

void foo() { a = new A1();

  • b = id(a);

} void bar() { a = new A2();

  • b = id(a);

} A id(A a) {

  • return a;

}

points-to

foo:a new A1() bar:a new A2() id:a new A1(), new A2() foo:b new A1(), new A2() bar:b new A1(), new A2()

  • bjects represented

by allocation sites

slide-23
SLIDE 23

points-to analysis 6

what objects can a variable point to?

program

void foo() { a = new A1(); b = id(a); } void bar() { a = new A2(); b = id(a); } A id(A a) { return a; }

points-to

foo:a new A1() bar:a new A2() id:a new A1(), new A2() foo:b new A1(), new A2() bar:b new A1(), new A2()

  • bjects represented

by allocation sites

context-sensitive points-to

foo:a new A1() bar:a new A2() id:a (foo) new A1() id:a (bar) new A2() foo:b new A1() bar:b new A2()

slide-24
SLIDE 24

why exception analysis? (3) 7

points-to analysis

  • necessity: sound points-to analyses need to handle all

language constructs

  • exception analysis is different, and complicates points-to

algorithms workaround: imprecise exception analysis

throw e;

⇒

THROWN EXCEPTIONS = e; catch(Exception e);

⇒

e = THROWN EXCEPTIONS ;

sneak preview: our finding imprecise exception handling dominates the output of precise context-sensitive points-to analysis

slide-25
SLIDE 25

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

slide-26
SLIDE 26

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

x = y

slide-27
SLIDE 27

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

x = y

slide-28
SLIDE 28

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

x = f()

slide-29
SLIDE 29

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

x = f()

slide-30
SLIDE 30

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

x = y.f()

slide-31
SLIDE 31

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

x = y.f()

slide-32
SLIDE 32

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

throw e

slide-33
SLIDE 33

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

throw e

slide-34
SLIDE 34

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

catch(E e)

slide-35
SLIDE 35

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

catch(E e)

slide-36
SLIDE 36

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

g()

slide-37
SLIDE 37

program analysis: a domain of mutual recursion 8

call graph analysis exception analysis points-to analysis

g()

slide-38
SLIDE 38

approximation to avoid mutual recursion 9

approximation use conservative call graph analysis exception analysis points-to analysis

slide-39
SLIDE 39

approximation to avoid mutual recursion 9

approximation use conservative call graph analysis exception analysis points-to analysis

slide-40
SLIDE 40

approximation to avoid mutual recursion 9

approximation use conservative call graph analysis exception analysis points-to analysis

slide-41
SLIDE 41

approximation to avoid mutual recursion 9

approximation use conservative call graph analysis exception analysis points-to analysis

slide-42
SLIDE 42

approximation to avoid mutual recursion 9

approximation use conservative call graph analysis exception analysis points-to analysis

slide-43
SLIDE 43

approximation to avoid mutual recursion 9

approximation use conservative call graph analysis exception analysis points-to analysis

slide-44
SLIDE 44

joint exception analysis and points-to analysis

  • major improvement in overall precision
  • major performance improvement

where is the magic?

  • our approach: no imperative algorithm, only declarative

specification

  • simple declarative specification of highly complex mutually

recursive dependencies in datalog

slide-45
SLIDE 45

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b;

slide-46
SLIDE 46

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c

slide-47
SLIDE 47

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj).

slide-48
SLIDE 48

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj).

slide-49
SLIDE 49

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj).

slide-50
SLIDE 50

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo

slide-51
SLIDE 51

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo

slide-52
SLIDE 52

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo

slide-53
SLIDE 53

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo

slide-54
SLIDE 54

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo

slide-55
SLIDE 55

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo a new A() b new B() c new C()

slide-56
SLIDE 56

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo a new A() b new B() c new C()

slide-57
SLIDE 57

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo a new A() b new B() c new C() a new B()

slide-58
SLIDE 58

datalog: declarative mutual recursion 10

source a = new A(); b = new B(); c = new C(); a = b; b = a; c = b; AssignObjectAllocation a new A() b new B() c new C() Assign b a a b b c VarPointsTo(?var, ?obj) <- AssignObjectAllocation(?var, ?obj). VarPointsTo(?to, ?obj) <- Assign(?from, ?to), VarPointsTo(?from, ?obj). VarPointsTo a new A() b new B() c new C() a new B() b new A() c new B() c new A()

slide-59
SLIDE 59

datalog: properties 11

limited logic programming

  • sql with recursion

prolog without complex terms (constructors)

  • captures PTIME complexity class

strictly declarative

  • as opposed to prolog
  • conjunction commutative
  • rules commutative
  • increases optimization opportunities
  • enables different execution strategies
  • enables more aggressive optimization

writing datalog is less programming, more specification

slide-60
SLIDE 60

Strictly Declarative Specification of Sophisticated Points-to Analyses

  • performance
  • scalability
  • declarative specification
  • no BDDs

http://doop.program-analysis.org

slide-61
SLIDE 61

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

void f() {

  • -...

}

slide-62
SLIDE 62

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

void f() {

  • -g();

}

slide-63
SLIDE 63

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

  • ThrowPointsTo(?caller, ?obj) <-

void f() {

  • -g();

}

Method declaration ?caller may throw exception object ?obj

slide-64
SLIDE 64

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <-

  • CallGraphEdge(?invocation, ?tomethod),

void f() {

  • -g();

}

Method invocation ?invocation may invoke method ?tomethod

slide-65
SLIDE 65

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod),

  • ThrowPointsTo(?tomethod, ?obj),

void f() {

  • -g();

}

Method declaration ?tomethod may throw exception

  • bject

?obj

slide-66
SLIDE 66

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj),

  • Object:Type[?obj] = ?objtype,

void f() {

  • -g();

}

The type of the object allocated at ?obj is ?objtype

slide-67
SLIDE 67

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype,

  • not exists ExceptionHandler[?objtype, ?invocation],

void f() {

  • -g();

}

Exceptions

  • f

specific type ?objtype, thrown at instruction ?invocation, are handled by exception handler ?handler

slide-68
SLIDE 68

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype, not exists ExceptionHandler[?objtype, ?invocation],

  • Instruction:Method[?invocation] = ?caller.

void f() {

  • -g();

}

Instruction ?invocation is in method ?caller

slide-69
SLIDE 69

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype, not exists ExceptionHandler[?objtype, ?invocation], Instruction:Method[?invocation] = ?caller. void f() {

  • -g();

}

method invocations: caught exceptions

void f() {

  • -try {...}
  • -catch(E e) {...}

}

slide-70
SLIDE 70

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype, not exists ExceptionHandler[?objtype, ?invocation], Instruction:Method[?invocation] = ?caller. void f() {

  • -g();

}

method invocations: caught exceptions

void f() {

  • -try { g(); }
  • -catch(E e) {...}

}

slide-71
SLIDE 71

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype, not exists ExceptionHandler[?objtype, ?invocation], Instruction:Method[?invocation] = ?caller. void f() {

  • -g();

}

method invocations: caught exceptions

  • VarPointsTo(?param, ?obj) <-

void f() {

  • -try { g(); }
  • -catch(E e) {...}

}

slide-72
SLIDE 72

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <-

  • CallGraphEdge(?invocation, ?tomethod),
  • ThrowPointsTo(?tomethod, ?obj),
  • Object:Type[?obj] = ?objtype,

not exists ExceptionHandler[?objtype, ?invocation], Instruction:Method[?invocation] = ?caller. void f() {

  • -g();

}

method invocations: caught exceptions

VarPointsTo(?param, ?obj) <-

  • CallGraphEdge(?invocation, ?tomethod),
  • ThrowPointsTo(?tomethod, ?obj),
  • Type[?obj] = ?objtype,

void f() {

  • -try { g(); }
  • -catch(E e) {...}

}

slide-73
SLIDE 73

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype, not exists ExceptionHandler[?objtype, ?invocation], Instruction:Method[?invocation] = ?caller. void f() {

  • -g();

}

method invocations: caught exceptions

VarPointsTo(?param, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Type[?obj] = ?objtype,

  • ExceptionHandler[?objtype, ?invocation] = ?handler,

void f() {

  • -try { g(); }
  • -catch(E e) {...}

}

slide-74
SLIDE 74

declarative on-the-fly exception analysis 13

method invocations: propagated exceptions

ThrowPointsTo(?caller, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Object:Type[?obj] = ?objtype, not exists ExceptionHandler[?objtype, ?invocation], Instruction:Method[?invocation] = ?caller. void f() {

  • -g();

}

method invocations: caught exceptions

VarPointsTo(?param, ?obj) <- CallGraphEdge(?invocation, ?tomethod), ThrowPointsTo(?tomethod, ?obj), Type[?obj] = ?objtype, ExceptionHandler[?objtype, ?invocation] = ?handler,

  • ExceptionHandler:FormalParam[?handler] = ?param.

void f() {

  • -try { g(); }
  • -catch(E e) {...}

}

slide-75
SLIDE 75

what did you just see here?

  • modular extension of variety of base points-to analyses
  • approximation only comes from points-to abstraction –

exception logic as precise as possible!

  • complex mutually recursive dependencies
  • specified elegantly in a few lines of logic

you might wonder ... does that work?!

slide-76
SLIDE 76

experimental findings

slide-77
SLIDE 77

major experimental findings: precision and speed 14

statistics highlights for object sensitive analysis:

  • precision of points-to results

context-insensitive: imprecise > precise × 1.9 context-sensitive: imprecise > precise × 3

  • size of call graph

context-insensitive: no significant difference context-sensitive: 1.9× to 6.1× more edges

  • performance

imprecise 14×, 12×, 5-10×, 1.8× slower

slide-78
SLIDE 78

major experimental findings: precision and speed 14

statistics highlights for object sensitive analysis:

  • precision of points-to results

context-insensitive: imprecise > precise × 1.9 context-sensitive: imprecise > precise × 3

  • size of call graph

context-insensitive: no significant difference context-sensitive: 1.9× to 6.1× more edges

  • performance

imprecise 14×, 12×, 5-10×, 1.8× slower

  • ur finding

Precise exception handling has a major impact on the precision and performance of context-sensitive points-to analyses. With imprecise exception handling, the size of the problem is largely determined by exceptions.

slide-79
SLIDE 79

why exception analysis? (2) 15

application: test coverage of exceptional situations [Fu et al.]

library application testsuite

slide-80
SLIDE 80

major experimental findings: exception-flow analysis 16

test coverage: possible exception-catch links [Fu et al.] I/Osel time imprecise ftpd insens 104 12s 1 obj 91 23s muffin insens 490 22s 1 obj 420 86s precise ftpd insens 1 obj muffin insens 1 obj

slide-81
SLIDE 81

major experimental findings: exception-flow analysis 16

test coverage: possible exception-catch links [Fu et al.] I/Osel time imprecise ftpd insens 104 12s 1 obj 91 23s muffin insens 490 22s 1 obj 420 86s precise ftpd insens 47 15s 1 obj 15 15s muffin insens 237 31s 1 obj 49 94s

slide-82
SLIDE 82

major experimental findings: exception-flow analysis 16

test coverage: possible exception-catch links [Fu et al.] I/Osel time imprecise ftpd insens 104 12s 1 obj 91 23s muffin insens 490 22s 1 obj 420 86s precise ftpd insens 47 15s 1 obj 15 15s muffin insens 237 31s 1 obj 49 94s custom: ∼ 5min custom: > 1h

slide-83
SLIDE 83

major experimental findings: exception-flow analysis 16

test coverage: possible exception-catch links [Fu et al.] I/Osel time imprecise ftpd insens 104 12s 1 obj 91 23s muffin insens 490 22s 1 obj 420 86s precise ftpd insens 47 15s 1 obj 15 15s muffin insens 237 31s 1 obj 49 94s custom: ∼ 5min custom: > 1h

  • ur finding

Our general joint points-to and exception analysis achieves precision comparable to a custom exception-flow anal- ysis, but runs much faster.

slide-84
SLIDE 84

major experimental findings: approximations 17

selectively remove features from fully precise analysis

  • order of exception handlers not considered (o)

catch(FileNotFoundException e) {...} catch(IOException e) {...}

  • no filtering of caught exceptions (f)

void foo() { try {...} catch(IOException e) {...} }

  • context-insensitive throw points-to (cs)
  • methods throw same exceptions in all contexts
slide-85
SLIDE 85

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K

slide-86
SLIDE 86

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

slide-87
SLIDE 87

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

× ×

×2.6 ×1.2 ×1.9

slide-88
SLIDE 88

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

× ×

×2.6 ×1.2 ×1.9

×

×2.6 ×1.3 ×1.9

slide-89
SLIDE 89

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

× ×

×2.6 ×1.2 ×1.9

×

×2.6 ×1.3 ×1.9

× ×

×1.1 ×1.1 ×1.9

slide-90
SLIDE 90

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

× ×

×2.6 ×1.2 ×1.9

×

×2.6 ×1.3 ×1.9

× ×

×1.1 ×1.1 ×1.9

×

×1.6 ×1.2 ×2.1

×

×2.7 ×1.4 ×3.4 ×2.7 ×1.5 ×3.4

slide-91
SLIDE 91

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

× ×

×2.6 ×1.2 ×1.9

×

×2.6 ×1.3 ×1.9

× ×

×1.1 ×1.1 ×1.9

×

×1.6 ×1.2 ×2.1

×

×2.7 ×1.4 ×3.4 ×2.7 ×1.5 ×3.4

imprecise

×6.1 ×2.0

slide-92
SLIDE 92

major experimental findings: approximations 18

cs o f call graph edges var points-to throw points-to × × × 1.0M 598K 579K × ×

×1.5 ×1.0 ×1.1

× ×

×2.6 ×1.2 ×1.9

×

×2.6 ×1.3 ×1.9

× ×

×1.1 ×1.1 ×1.9

×

×1.6 ×1.2 ×2.1

×

×2.7 ×1.4 ×3.4 ×2.7 ×1.5 ×3.4

imprecise

×6.1 ×2.0

  • ur finding

Every approximation of exception handling significantly increases var points-to, throw points-to, or call graph edges.

slide-93
SLIDE 93

major experimental findings 19

points-to analysis

Precise exception handling has a major impact on the precision and performance of context-sensitive points-to analyses.

exception-flow analysis

Our general joint points-to and exception analysis achieves precision comparable to a custom exception-flow analysis, but runs much faster.

approximations

Every approximation of exception handling significantly increases var points-to, throw points-to, or call graph edges.

slide-94
SLIDE 94

related work 20

type-based exception analyses [Robillard, Jex]

  • do not determine where an exception comes from
  • conservative/unsound for ‘computed’ exceptions
slide-95
SLIDE 95

related work 20

type-based exception analyses [Robillard, Jex]

  • do not determine where an exception comes from
  • conservative/unsound for ‘computed’ exceptions

exception-flow and exception-chain analysis [Fu et al.]

  • precise analysis
  • slow, automatically supported by points-to analysis
slide-96
SLIDE 96

related work 20

type-based exception analyses [Robillard, Jex]

  • do not determine where an exception comes from
  • conservative/unsound for ‘computed’ exceptions

exception-flow and exception-chain analysis [Fu et al.]

  • precise analysis
  • slow, automatically supported by points-to analysis

spark, paddle [Lhotak et al.], bddbddb [Whaley et al]

  • imprecise exception analysis
  • generally not integrated in the analysis
slide-97
SLIDE 97

related work 20

type-based exception analyses [Robillard, Jex]

  • do not determine where an exception comes from
  • conservative/unsound for ‘computed’ exceptions

exception-flow and exception-chain analysis [Fu et al.]

  • precise analysis
  • slow, automatically supported by points-to analysis

spark, paddle [Lhotak et al.], bddbddb [Whaley et al]

  • imprecise exception analysis
  • generally not integrated in the analysis

doop compared to other datalog-based points-to analysis

  • full end-to-end analysis in datalog
  • first precise declarative exception analysis
slide-98
SLIDE 98

conclusion 21

what have we seen?

  • joint points-to and exception analysis
slide-99
SLIDE 99

conclusion 21

what have we seen?

  • joint points-to and exception analysis
  • precision of exception analysis has significant impact on

points-to analysis

slide-100
SLIDE 100

conclusion 21

what have we seen?

  • joint points-to and exception analysis
  • precision of exception analysis has significant impact on

points-to analysis

  • exception analysis as precise, but much faster than custom

exception analyses

slide-101
SLIDE 101

conclusion 21

what have we seen?

  • joint points-to and exception analysis
  • precision of exception analysis has significant impact on

points-to analysis

  • exception analysis as precise, but much faster than custom

exception analyses what more is in the paper?

  • computing exception handlers
  • experiments
  • background on datalog and points-to analysis