Precision-Guided Context Sensitivity for Pointer Analysis Yue Li, - - PowerPoint PPT Presentation

▶
precision guided context sensitivity for pointer analysis
SMART_READER_LITE
LIVE PREVIEW

Precision-Guided Context Sensitivity for Pointer Analysis Yue Li, - - PowerPoint PPT Presentation

Apr 05, 2023 200 likes •846 views

Precision-Guided Context Sensitivity for Pointer Analysis Yue Li, Tian Tan, Anders Mller, Yannis Smaragdakis OOPSLA 2018 1 A New Pointer Analysis T echnique for Object-Oriented Programs 2 Pointer Analysis Determines which

slide-1
SLIDE 1

Precision-Guided Context Sensitivity for Pointer Analysis

Yue Li, Tian Tan, Anders Møller, Yannis Smaragdakis

OOPSLA 2018

1

slide-2
SLIDE 2

A New Pointer Analysis T echnique for Object-Oriented Programs

2

slide-3
SLIDE 3

Pointer Analysis

Determines

“which objects a variable can point to?”

3

slide-4
SLIDE 4

Uses of Pointer Analysis

Clients Tools

 Security analysis  Bug detection  Compiler optimization  Program verification  Program understanding  …

Chord

4

…

slide-5
SLIDE 5

Uses of Pointer Analysis

Clients Tools

 Security analysis  Bug detection  Compiler optimization  Program verification  Program understanding  …

Chord

5

… A precise pointer analysis benefits all above clients & tools

slide-6
SLIDE 6

Context Sensitivity

One of the most successful pointer analysis techniques for producing high precision for OO programs

6

slide-7
SLIDE 7

Context Sensitivity

Distinguishes points-to information of methods by different calling contexts

7

slide-8
SLIDE 8

Context Sensitivity: Example

8

static void main() { A a1 = new A(); // A/1 b1 = a1.foo("s1"); A a2 = new A(); // A/2 b2 = a2.foo("s2"); } class A { String foo(String s) { return s; } } Variable Object s "s1", "s2" b1 "s1", "s2" b2 "s1", "s2"

Context-Insensitivity

slide-9
SLIDE 9

Context Sensitivity: Example

9

static void main() { A a1 = new A(); // A/1 b1 = a1.foo("s1"); A a2 = new A(); // A/2 b2 = a2.foo("s2"); } class A { String foo(String s) { return s; } } Variable Object s "s1", "s2" b1 "s1", "s2" b2 "s1", "s2"

Context-Insensitivity

slide-10
SLIDE 10

Context Sensitivity: Example

10

static void main() { A a1 = new A(); // A/1 b1 = a1.foo("s1"); A a2 = new A(); // A/2 b2 = a2.foo("s2"); } class A { String foo(String s) { return s; } }

1-Object-Sensitivity

Context Variable Object [A/1] s "s1" [A/2] s "s2" [ ] b1 "s1" [ ] b2 "s2" Variable Object s "s1", "s2" b1 "s1", "s2" b2 "s1", "s2"

Context-Insensitivity

slide-11
SLIDE 11

Context Sensitivity

Widely adopted by static analysis frameworks for OO programs

11

Chord FlowDroid

slide-12
SLIDE 12

Problem of Context Sensitivity (C.S.)

12

Comes with heavy efficiency costs

Conventional: apply C.S. to all methods

slide-13
SLIDE 13

Problem of Context Sensitivity (C.S.)

Comes with heavy efficiency costs

13

Do not benefit from C.S. Analyzed for multiple contexts redundantly

Conventional: apply C.S. to all methods

slide-14
SLIDE 14

Problem of Context Sensitivity (C.S.)

Comes with heavy efficiency costs

14

Benefit from C.S. (gain precision) Do not benefit from C.S. Analyzed for multiple contexts redundantly Precision-critical methods

Conventional: apply C.S. to all methods

slide-15
SLIDE 15

15

Precision-critical methods C.S. C.I. Do not benefit from C.S. Analyzed for multiple contexts redundantly Benefit from C.S. (gain precision)

Problem of Context Sensitivity (C.S.)

Comes with heavy efficiency costs

slide-16
SLIDE 16

16

Precision-critical methods C.S. C.I. Do not benefit from C.S. Analyzed for multiple contexts redundantly Benefit from C.S. (gain precision)

Problem of Context Sensitivity (C.S.)

Comes with heavy efficiency costs

Preserve precision Improve efficiency

  • f C.S.
slide-17
SLIDE 17

Our Goal

Identify precision-critical methods

17

Precision-critical methods C.S. C.I. Do not benefit from C.S. Analyzed for multiple contexts redundantly Benefit from C.S. (gain precision)

Preserve precision Improve efficiency

  • f C.S.
slide-18
SLIDE 18

Challenge

18

context-sensitive analysis precision benefits

yield

  • mitting

context sensitivity precision losses

introduce

When? When?

Still unclear where and how imprecision is introduced in a context-insensitive pointer analysis

slide-19
SLIDE 19

Our Key Contribution

19

Classify source of imprecision into three general precision-loss patterns

  • Direct flow
  • Wrapped flow
  • Unwrapped flow
slide-20
SLIDE 20

Our Key Contribution

20

Classify source of imprecision into three general precision-loss patterns

  • Direct flow
  • Wrapped flow
  • Unwrapped flow

account for ~99%

  • f precision
slide-21
SLIDE 21

Our Key Contribution

21

Identify Precision-Critical Methods Recognize Three Flow Patterns

Classify source of imprecision into three general precision-loss patterns

  • Direct flow
  • Wrapped flow
  • Unwrapped flow

account for ~99%

  • f precision
slide-22
SLIDE 22

IN and OUT Methods

Given a class

  • IN methods

 One or more parameters

  • OUT methods

 non-void return types

22

slide-23
SLIDE 23

IN and OUT Methods

23

Given a class

  • IN methods

 One or more parameters

  • OUT methods

 non-void return types

class Foo { C f; void setF(C p) { this.f = p; } C getF() { C r = this.f; return r; } void bar() { this.f = null; } }

slide-24
SLIDE 24

class Foo { C f; void setF(C p) { this.f = p; } C getF() { C r = this.f; return r; } void bar() { this.f = null; } }

IN and OUT Methods

24

Given a class

  • IN methods

 One or more parameters

  • OUT methods

 non-void return types IN OUT

slide-25
SLIDE 25

The Three General Flow Patterns

 Direct flow  Wrapped flow  Unwrapped flow

25

Identified by leveraging a context-insensitive pointer analysis (as pre-analysis)

slide-26
SLIDE 26

 Direct flow  Wrapped flow  Unwrapped flow

26

The Three General Flow Patterns

slide-27
SLIDE 27

27

class C { void M1(Object p) { ... } ... Object M2() { ... return r; } }

IN

O O

Direct Flow

OUT

slide-28
SLIDE 28

28

class C { void M1(Object p) { ... } ... Object M2() { ... return r; } }

IN

O O

Direct Flow

  • variable assignments
  • field load/store
  • method calls/returns

OUT

slide-29
SLIDE 29

void set(Object p) { this.f = p; }

29

class C { void M1(Object p) { ... } ... Object M2() { ... return r; } }

IN OUT

O O

Direct Flow

Example: common setter & getter

  • variable assignments
  • field load/store
  • method calls/returns

Object get() { Object r = this.f; return r; }

slide-30
SLIDE 30

Key Insight: Causes of Imprecision

30

A B A B B A IN OUT

C.I.

  • Direct flow

Flows: objects merge and propagate

slide-31
SLIDE 31

31

A B IN OUT

C.I.

  • Direct flow
  • Wrapped flow
  • Unwrapped flow
  • Combinations

Flows: objects merge and propagate

Key Insight: Causes of Imprecision

A B B A

slide-32
SLIDE 32

 Direct flow  Wrapped flow  Unwrapped flow

32

The Three General Flow Patterns

slide-33
SLIDE 33

class C { void M1(Object p) { ... } ... void Mi() {

  • .f = q;

} ... Object M2() { ... return r; } }

33

Wrapped Flow

O W

  • bject wrapping

OUT IN

  • variable assignments
  • field load/store
  • method calls/returns

W

slide-34
SLIDE 34

class C { void M1(Object p) { ... } ... void Mi() {

  • .f = q;

} ... Object M2() { ... return r; } }

34

Wrapped Flow

O W

Example: collection & iterator

  • bject wrapping

OUT IN

  • variable assignments
  • field load/store
  • method calls/returns

W

slide-35
SLIDE 35

35

class C { void M1(Object p) { ... } ... void Mi() {

  • .f = q;

} ... Object M2() { ... return r; } }

Wrapped Flow

O W’

multiple object wrapping

W

OUT IN

  • variable assignments
  • field load/store
  • method calls/returns
slide-36
SLIDE 36

 Direct flow  Wrapped flow  Unwrapped flow

36

The Three General Flow Patterns

slide-37
SLIDE 37

37

class C { void M1(Object p) { ... } ... void Mi() { q = o.f; } ... Object M2() { ... return r; } }

U

Unwrapped Flow

IN OUT

  • bject unwrapping

O

  • variable assignments
  • field load/store
  • method calls/returns

U

slide-38
SLIDE 38

38

class C { void M1(Object p) { ... } ... void Mi() { q = o.f; } ... Object M2() { ... return r; } }

  • bject unwrapping

O U

Unwrapped Flow

Example: JDK synchronized container IN OUT

  • variable assignments
  • field load/store
  • method calls/returns

U

slide-39
SLIDE 39

39

class C { void M1(Object p) { ... } ... void Mi() { q = o.f; } ... Object M2() { ... return r; } }

IN multiple object unwrapping

O U’

Unwrapped Flow

OUT

U

  • variable assignments
  • field load/store
  • method calls/returns
slide-40
SLIDE 40

Combinations of Three General Flows

The direct, wrapped and unwrapped flows can be combined, e.g.,

40

IN OUT

unwrapped flow wrapped flow

+

O U W

slide-41
SLIDE 41

41

A B A B B A IN OUT

Precision-critical methods: the methods involved in the flows

C.I.

  • Direct flow
  • Wrapped flow
  • Unwrapped flow
  • Combinations
slide-42
SLIDE 42

42

A B A B B A IN OUT

Identify precision-critical methods Precision-critical methods: the methods involved in the flows

C.I.

  • Direct flow
  • Wrapped flow
  • Unwrapped flow
  • Combinations
slide-43
SLIDE 43

43

A B A B B A IN OUT A A IN OUT B B

Identify precision-critical methods Apply C.S. only to Precision-critical methods: the methods involved in the flows

C.I. C.S.

  • Direct flow
  • Wrapped flow
  • Unwrapped flow
  • Combinations
slide-44
SLIDE 44

44

A B A B B A IN OUT A A IN OUT B B

Identify precision-critical methods Apply C.S. only to

C.I. C.S.

Precision-critical methods: the methods involved in the flows

slide-45
SLIDE 45

45

How to Analyze Flow Patterns?

We propose precision flow graph (PFG)

expresses direct, wrapped, unwrapped flows, and their combinations, in an uniform way

slide-46
SLIDE 46

How to Analyze Flow Patterns?

46

Paths in PFG Flows in Program

We propose precision flow graph (PFG)

expresses direct, wrapped, unwrapped flows, and their combinations, in an uniform way

slide-47
SLIDE 47

Precision Flow Graph (PFG)

 Statically over-approximates all the general

flows and their combinations

 Based on the results of context-insensitive

pointer analysis (pre-analysis)

47

Paths in PFG Flows in Program

slide-48
SLIDE 48

How to Analyze Flow Patterns?

48

Paths in PFG Flows in Program Simple Graph Reachability

  • n PFG

Methods Involved in the Flows i.e., precision-critical methods from IN to OUT methods

We propose precision flow graph (PFG)

expresses direct, wrapped, unwrapped flows, and their combinations, in an uniform way

slide-49
SLIDE 49

Overview

Context-Insensitive Pointer Analysis PFG Construction Graph Reachability

  • n PFG

points-to information which methods need contexts

PFG

49

Context-Sensitive Pointer Analysis OFG Construction

OFG

Pre-analysis Main analysis

slide-50
SLIDE 50

Implementation

 Written in Java (core: ~1500 LOC)  Integrated with  Can also be easily integrated with other

pointer analysis frameworks

 Open source: http://www.brics.dk/zipper/

50

slide-51
SLIDE 51

Evaluation

 Compared to conventional context-sensitive

analysis, can ZIPPER-guided analysis

  • preserve precision?
  • improve efficiency?

51

slide-52
SLIDE 52

Evaluation

 Compared to conventional context-sensitive

analysis, can ZIPPER-guided analysis

  • preserve precision?
  • improve efficiency?

 Context sensitivity: 2-object-sensitivity (2obj)

  • Most practical high-precision pointer analysis
  • Widely adopted (research papers and analysis frameworks)

52

slide-53
SLIDE 53

Evaluation

 Compared to conventional context-sensitive

analysis, can ZIPPER-guided analysis

  • preserve precision?
  • improve efficiency?

 Context sensitivity: 2-object-sensitivity (2obj)

  • Most practical high-precision pointer analysis
  • Widely adopted (research papers and analysis frameworks)

53

Conventional: applies 2obj to all methods ZIPPER-guided: applies 2obj to only precision- critical methods selected by ZIPPER

slide-54
SLIDE 54

Evaluation - Analyzed Programs

10 large Java programs

  • 5 popular real-world applications
  • 5 DaCapo benchmarks

54

JPC

slide-55
SLIDE 55

Evaluation - Clients

 May-fail casting  De-virtualization  Method reachability  Call graph construction

55

Widely-used clients to evaluate pointer analysis’s precision

e.g., PLDI'17, OOPSLA'17, PLDI’14, PLDI’13, POPL’11, OOPSLA'09 …

slide-56
SLIDE 56

56

100% 38%

ZIPPER Conventional

Methods Analyzed Context-Sensitively (2obj)

Precision-critical methods

Results: ZIPPER vs. Conventional

slide-57
SLIDE 57

57

100% 38%

ZIPPER Conventional

100% 98.8%

ZIPPER Conventional

Methods Analyzed Context-Sensitively (2obj) Precision

Precision-critical methods

Results: ZIPPER vs. Conventional

slide-58
SLIDE 58

58

100% 38%

ZIPPER Conventional

100% 98.8%

ZIPPER Conventional

Methods Analyzed Context-Sensitively (2obj) Precision

Precision-critical methods

Results: ZIPPER vs. Conventional

C.I. 64.5%

slide-59
SLIDE 59

59

100% 38%

ZIPPER Conventional

100% 98.8%

ZIPPER Conventional

Methods Analyzed Context-Sensitively (2obj) Precision

Precision-critical methods

Results: ZIPPER vs. Conventional

C.I. 64.5%

slide-60
SLIDE 60

60

100% 38%

ZIPPER Conventional

100% 98.8%

ZIPPER Conventional ZIPPER Conventional

ZIPPER: 3.4X of speedup (up to 9.2X)

Methods Analyzed Context-Sensitively (2obj) Precision Analysis Time

Precision-critical methods

Results: ZIPPER vs. Conventional

C.I. 64.5%

slide-61
SLIDE 61

61

100% 38%

ZIPPER Conventional

100% 98.8%

ZIPPER Conventional ZIPPER Conventional

ZIPPER: 3.4X of speedup (up to 9.2X)

Methods Analyzed Context-Sensitively (2obj) Precision Analysis Time

Precision-critical methods

Results: ZIPPER vs. Conventional

C.I. 64.5%

slide-62
SLIDE 62

Conclusion

 Direct, wrapped, and unwrapped flows

  • explain where and how most imprecision is

introduced in context insensitivity

 Precision flow graph

  • concisely models the above flows

 Implementation (http://www.brics.dk/zipper/)

  • effectively identifies precision-critical methods

 Evaluation

  • preserves essentially all of the precision
  • improves efficiency significantly

62

slide-63
SLIDE 63

The Parameter-Out Flow Case

63

void m(A input, B output) {

  • utput.field = input;

} m(a, b); // rare b.setField(a); // common

slide-64
SLIDE 64

Potential of ZIPPER

ZIPPER*: tracks flows from an IN method

  • nly if its flowing-in objects have too many

(>50) different types

64

Identify highly precision-critical methods

bloat

Time(s) #fail-cast #poly-call #reach-mtd #call-edge

Conventional 3128 1193 1427 8470 53143 Zipper 2704 1224 1449 8486 53289 Zipper* 52 1310 1511 8538 54049

More heuristics and precision-efficiency trade-offs can be developed on top of ZIPPER