Context-Sensitive Points-to Analysis: Is It Worth It?

  • Ondřej Lhoták
  • Laurie Hendren
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3923)


We present the results of an empirical study evaluating the precision of subset-based points-to analysis with several variations of context sensitivity on Java benchmarks of significant size. We compare the use of call site strings as the context abstraction, object sensitivity, and the BDD-based context-sensitive algorithm proposed by Zhu and Calman, and by Whaley and Lam. Our study includes analyses that context-sensitively specialize only pointer variables, as well as ones that also specialize the heap abstraction. We measure both characteristics of the points-to sets themselves, as well as effects on the precision of client analyses. To guide development of efficient analysis implementations, we measure the number of contexts, the number of distinct contexts, and the number of distinct points-to sets that arise with each context sensitivity variation. To evaluate precision, we measure the size of the call graph in terms of methods and edges, the number of devirtualizable call sites, and the number of casts statically provable to be safe.

The results of our study indicate that object-sensitive analysis implementations are likely to scale better and more predictably than the other approaches; that object-sensitive analyses are more precise than comparable variations of the other approaches; that specializing the heap abstraction improves precision more than extending the length of context strings; and that the profusion of cycles in Java call graphs severely reduces precision of analyses that forsake context sensitivity in cyclic regions.


Context Sensitivity Call Graph Abstract Context Call Site Static Abstraction 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Agesen, O.: The Cartesian Product Algorithm. In: Olthoff, W. (ed.) ECOOP 1995. LNCS, vol. 952, pp. 2–51. Springer, Heidelberg (1995)Google Scholar
  2. 2.
    Aiken, A., Faehndrich, M., Foster, J.S., Su, Z.: A toolkit for constructing type- and constraint-based program analyses. In: Leroy, X., Ohori, A. (eds.) TIC 1998. LNCS, vol. 1473, pp. 78–96. Springer, Heidelberg (1998)CrossRefGoogle Scholar
  3. 3.
    Berndl, M., Lhoták, O., Qian, F., Hendren, L., Umanee, N.: Points-to analysis using BDDs. In: Proceedings of PLDI 2003, pp. 103–114 (2003)Google Scholar
  4. 4.
    Burke, M., Carini, P., Choi, J., Hind, M.: Interprocedural pointer alias analysis. Technical Report RC 21055, IBM T. J. Watson Research Center (December 1997)Google Scholar
  5. 5.
  6. 6.
    Dean, J., Grove, D., Chambers, C.: Optimization of Object-Oriented Programs Using Static Class Hierarchy Analysis. In: Olthoff, W. (ed.) ECOOP 1995. LNCS, vol. 952, pp. 77–101. Springer, Heidelberg (1995)Google Scholar
  7. 7.
    Dufour, B.: Objective quantification of program behaviour using dynamic metrics. Master’s thesis, McGill University (June 2004)Google Scholar
  8. 8.
    Emami, M., Ghiya, R., Hendren, L.J.: Context-sensitive interprocedural points-to analysis in the presence of function pointers. In: Proceedings of PLDI 1994, pp. 242–256 (1994)Google Scholar
  9. 9.
    Heintze, N.: Analysis of large code bases: the compile-link-analyze model (1999),
  10. 10.
    Hind, M.: Pointer analysis: haven’t we solved this problem yet? In: Proceedings of PASTE 2001, pp. 54–61. ACM Press, New York (2001)Google Scholar
  11. 11.
    Hind, M., Burke, M., Carini, P., Choi, J.-D.: Interprocedural pointer alias analysis. ACM Trans. Program. Lang. Syst. 21(4), 848–894 (1999)CrossRefGoogle Scholar
  12. 12.
    Lhoták, O.: Program Analysis using Binary Decision Diagrams. PhD thesis, McGill University (Jan 2006)Google Scholar
  13. 13.
    Lhoták, O., Hendren, L.: Scaling Java Points-to Analysis Using spark. In: Hedin, G. (ed.) CC 2003. LNCS, vol. 2622, pp. 153–169. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  14. 14.
    Lhoták, O., Hendren, L.: Jedd: a BDD-based relational extension of Java. In: Proceedings of PLDI 2004, pp. 158–169. ACM Press, New York (2004)Google Scholar
  15. 15.
    Liang, D., Harrold, M.J.: Efficient points-to analysis for whole-program analysis. In: Nierstrasz, O., Lemoine, M. (eds.) ESEC 1999 and ESEC-FSE 1999. LNCS, vol. 1687, pp. 199–215. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  16. 16.
    Liang, D., Pennings, M., Harrold, M.J.: Evaluating the impact of context-sensitivity on andersen’s algorithm for Java programs. In: PASTE 2005. ACM Press, New York (2005)Google Scholar
  17. 17.
    Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to and side-effect analyses for Java. In: Proceedings of ISSTA 2002, pp. 1–11. ACM Press, New York (2002)Google Scholar
  18. 18.
    Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to analysis for Java. ACM Trans. Softw. Eng. Methodol. 14(1), 1–41 (2005)CrossRefGoogle Scholar
  19. 19.
    Nystrom, E.M., Kim, H.-S., Hwu, W.-m.W.: Importance of heap specialization in pointer analysis. In: Proceedings of PASTE 2004, pp. 43–48. ACM Press, New York (2004)Google Scholar
  20. 20.
    Nystrom, N., Clarkson, M.R., Myers, A.C.: Polyglot: An Extensible Compiler Framework for Java. In: Hedin, G. (ed.) CC 2003. LNCS, vol. 2622, pp. 138–152. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  21. 21.
    Rountev, A., Milanova, A., Ryder, B.G.: Points-to analysis for Java using annotated constraints. In: Proceedings OOPSLA 2001, pp. 43–55. ACM Press, New York (2001)Google Scholar
  22. 22.
    Ruf, E.: Context-insensitive alias analysis reconsidered. In: Proceedings of the Conference on Programming Language Design and Implementation, pp. 13–22. ACM Press, New York (1995)Google Scholar
  23. 23.
    Ryder, B.G.: Dimensions of Precision in Reference Analysis of Object-Oriented Programming Languages. In: Hedin, G. (ed.) CC 2003. LNCS, vol. 2622, pp. 126–137. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  24. 24.
    Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. In: Muchnick, S.S., Jones, N.D. (eds.) Program Flow Analysis: Theory and Applications, ch.7, pp. 189–233. Prentice-Hall, Englewood Cliffs (1981)Google Scholar
  25. 25.
    Shivers, O.: Control flow analysis in scheme. In: Proceedings of PLDI 1988, pp. 164–174 (1988)Google Scholar
  26. 26.
    SPEC JVM 1998 Benchmarks,
  27. 27.
    Vallée-Rai, R.: Ashes suite collection,
  28. 28.
    Wang, T., Smith, S.F.: Precise constraint-based type inference for Java. In: Knudsen, J.L. (ed.) ECOOP 2001. LNCS, vol. 2072, pp. 99–117. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  29. 29.
    Whaley, J., Lam, M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: Proceedings of PLDI 2004, pp. 131–144. ACM Press, New York (2004)Google Scholar
  30. 30.
    Wilson, R.P., Lam, M.S.: Efficient context-sensitive pointer analysis for C programs. In: Proceedings of PLDI 1995, pp. 1–12. ACM Press, New York (1995)Google Scholar
  31. 31.
    Zhu, J., Calman, S.: Symbolic pointer analysis revisited. In: Proceedings of PLDI 2004, pp. 145–157. ACM Press, New York (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2006

Authors and Affiliations

  • Ondřej Lhoták
    • 1
    • 2
  • Laurie Hendren
    • 2
  1. 1.School of Computer ScienceUniversity of WaterlooWaterlooCanada
  2. 2.School of Computer ScienceMcGill UniversityMontrealCanada

Personalised recommendations