An Incremental Points-to Analysis with CFL-Reachability

  • Yi Lu
  • Lei Shang
  • Xinwei Xie
  • Jingling Xue
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 7791)


Developing scalable and precise points-to analyses is increasingly important for analysing and optimising object-oriented programs where pointers are used pervasively. An incremental analysis for a program updates the existing analysis information after program changes to avoid reanalysing it from scratch. This can be efficiently deployed in software development environments where code changes are often small and frequent. This paper presents an incremental approach for demand-driven context-sensitive points-to analyses based on Context-Free Language (CFL) reachability. By tracing the CFL-reachable paths traversed in computing points-to sets, we can precisely identify and recompute on demand only the points-to sets affected by the program changes made. Combined with a flexible policy for controlling the granularity of traces, our analysis achieves significant speedups with little space overhead over reanalysis from scratch when evaluated with a null dereferencing client using 14 Java benchmarks.


Incremental Analysis Code Change Incremental Phase Program Unit Change Impact Analysis 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. 1.
    Acharya, M., Robinson, B.: Practical change impact analysis based on static program slicing for industrial software systems. In: ICSE 2011 (2011)Google Scholar
  2. 2.
    Bodden, E., Sewe, A., Sinschek, J., Oueslati, H., Mezini, M.: Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders. In: ICSE 2011 (2011)Google Scholar
  3. 3.
    Burke, M.G.: An interval-based approach to exhaustive and incremental interprocedural data-flow analysis. ACM Trans. Program. Lang. Syst. 12(3) (1990)Google Scholar
  4. 4.
    Burke, M.G., Ryder, B.G.: A critical analysis of incremental iterative data flow analysis algorithms. IEEE Trans. Software Eng. 16(7) (1990)Google Scholar
  5. 5.
    Carroll, M.D., Ryder, B.G.: Incremental data flow analysis via dominator and attribute updates. In: POPL 1988 (1988)Google Scholar
  6. 6.
    Ceccarelli, M., Cerulo, L., Canfora, G., Di Penta, M.: An eclectic approach for change impact analysis. In: ICSE 2010 (2010)Google Scholar
  7. 7.
    Chaudhuri, S.: Subcubic algorithms for recursive state machines. In: POPL 2008 (2008)Google Scholar
  8. 8.
    Goeritzer, R.: Using impact analysis in industry. In: ICSE 2011 (2011)Google Scholar
  9. 9.
    Hardekopf, B., Lin, C.: Flow-sensitive pointer analysis for millions of lines of code. In: CGO 2011 (2011)Google Scholar
  10. 10.
    Hardekopf, B., Lin, C.: Semi-sparse flow-sensitive pointer analysis. In: POPL 2009 (2009)Google Scholar
  11. 11.
    Heintze, N., Tardieu, O.: Demand-driven pointer analysis. In: PLDI 2011 (2001)Google Scholar
  12. 12.
    Kahlon, V.: Bootstrapping: a technique for scalable flow and context-sensitive pointer alias analysis. In: PLDI 2008 (2008)Google Scholar
  13. 13.
    Kodumal, J., Aiken, A.: Banshee: A Scalable Constraint-Based Analysis Toolkit. In: Hankin, C., Siveroni, I. (eds.) SAS 2005. LNCS, vol. 3672, pp. 218–234. Springer, Heidelberg (2005)CrossRefGoogle Scholar
  14. 14.
    Kodumal, J., Aiken, A.: The set constraint/CFL reachability connection in practice. In: PLDI 2004 (2004)Google Scholar
  15. 15.
    Landi, W., Ryder, B.G.: A safe approximate algorithm for interprocedural aliasing. In: PLDI 1992 (1992)Google Scholar
  16. 16.
    Lehnert, S.: A taxonomy for software change impact analysis. In: IWPSE-EVOL 2011 (2011)Google Scholar
  17. 17.
    Lhoták, O., Hendren, L.: Scaling Java Points-to Analysis Using SPARK. In: Hedin, G. (ed.) CC 2003. LNCS, vol. 2622, pp. 153–169. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  18. 18.
    Marlowe, T.J., Ryder, B.G.: An efficient hybrid algorithm for incremental data flow analysis. In: POPL 1990 (1990)Google Scholar
  19. 19.
    Nguyen, P.H., Xue, J.: Interprocedural side-effect analysis and optimisation in the presence of dynamic class loading. In: ACSC 2005 (2005)Google Scholar
  20. 20.
    Pollock, L.L., Soffa, M.L.: An incremental version of iterative data flow analysis. IEEE Trans. Software Eng. 15(12) (1989)Google Scholar
  21. 21.
    Ren, X., Shah, F., Tip, F., Ryder, B.G., Chesley, O.: Chianti: a tool for change impact analysis of Java programs. In: OOPSLA 2004 (2004)Google Scholar
  22. 22.
    Reps, T.: Program analysis via graph reachability. In: ILPS 1997 (1997)Google Scholar
  23. 23.
    Reps, T., Horwitz, S., Sagiv, M.: Precise interprocedural dataflow analysis via graph reachability. In: POPL 1995 (1995)Google Scholar
  24. 24.
    Saha, D., Ramakrishnan, C.: Incremental and demand-driven points-to analysis using logic programming. In: PPDP 2005 (2005)Google Scholar
  25. 25.
    Shang, L., Lu, Y., Xue, J.: Fast and precise points-to analysis with incremental CFL-reachability summarisation: preliminary experience. In: ASE 2012 (2012)Google Scholar
  26. 26.
    Shang, L., Xie, X., Xue, J.: On-demand dynamic summary-based points-to analysis. In: CGO 2012 (2012)Google Scholar
  27. 27.
    Sridharan, M., Bodík, R.: Refinement-based context-sensitive points-to analysis for Java. In: PLDI 2006 (2006)Google Scholar
  28. 28.
    Sridharan, M., Gopan, D., Shan, L., Bodík, R.: Demand-driven points-to analysis for Java. In: OOPSLA 2005 (2005)Google Scholar
  29. 29.
    Sui, Y., Li, Y., Xue, J.: Query-directed adaptive heap cloning for optimizing compilers. In: CGO 2013 (2013)Google Scholar
  30. 30.
    Sui, Y., Ye, D., Xue, J.: Static memory leak detection using full-sparse value-flow analysis. In: ISSTA 2012 (2012)Google Scholar
  31. 31.
    Sui, Y., Ye, S., Xue, J., Yew, P.-C.: SPAS: Scalable Path-Sensitive Pointer Analysis on Full-Sparse SSA. In: Yang, H. (ed.) APLAS 2011. LNCS, vol. 7078, pp. 155–171. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  32. 32.
    Vallée-Rai, R., Co, P., Gagnon, E., Hendren, L., Lam, P., Sundaresan, V.: Soot: a java bytecode optimization framework. In: CASCON 2010 (2010)Google Scholar
  33. 33.
    Whaley, J., Lam, M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: PLDI 2004 (2004)Google Scholar
  34. 34.
    Wilson, R.P., Lam, M.S.: Efficient context-sensitive pointer analysis for C programs. In: PLDI 1995 (1995)Google Scholar
  35. 35.
    Xiao, X., Zhang, C.: Geometric encoding: forging the high performance context sensitive points-to analysis for Java. In: ISSTA 2011 (2011)Google Scholar
  36. 36.
    Xu, G., Rountev, A., Sridharan, M.: Scaling CFL-Reachability-Based Points-To Analysis Using Context-Sensitive Must-Not-Alias Analysis. In: Drossopoulou, S. (ed.) ECOOP 2009. LNCS, vol. 5653, pp. 98–122. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  37. 37.
    Yan, D., Xu, G., Rountev, A.: Demand-driven context-sensitive alias analysis for Java. In: ISSTA 2011 (2011)Google Scholar
  38. 38.
    Yannakakis, M.: Graph-theoretic methods in database theory. In: PODS 1990 (1990)Google Scholar
  39. 39.
    Yu, H., Xue, J., Huo, W., Feng, X., Zhang, Z.: Level by level: making flow- and context-sensitive pointer analysis scalable for millions of lines of code. In: CGO 2010 (2010)Google Scholar
  40. 40.
    Yur, J.-S., Ryder, B.G., Landi, W.: An incremental flow- and context-sensitive pointer aliasing analysis. In: ICSE 1999(1999)Google Scholar
  41. 41.
    Zheng, X., Rugina, R.: Demand-driven alias analysis for C. In: POPL 2008 (2008)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Yi Lu
    • 1
  • Lei Shang
    • 1
  • Xinwei Xie
    • 1
    • 2
  • Jingling Xue
    • 1
  1. 1.Programming Languages and Compilers Group, School of Computer Science and EngineeringUniversity of New South WalesSydneyAustralia
  2. 2.School of Computer ScienceNational University of Defence TechnologyChangshaChina

Personalised recommendations