1. Points-to Analysis for Java Using Annotated Constraints
Atanas (Nasko) Rountev
Ana Milanova
Barbara Ryder
Rutgers University

2. Points-to Analysis for Java
Which objects may reference variable x point to?
Builds a points-to graph x o1 o2 y f
x = new A();
y = new B();
x.f = y;

3. Uses of Points-to Information
Clients: compilers and SE tools
Object read-write information
Side-effect analysis, dependence analysis
Call graph construction
Devirtualization & inlining
Synchronization removal
Stack-based object allocation

4. Our Work Define a points-to analysis for Java
Based on Andersen’s analysis for C
Efficient constraint-based implementation
Annotated constraints
Empirical evaluation of cost and precision

5. Outline Points-to analysis for Java Constraint-based implementation
Empirical results
Summary & future work

6. Our Points-to Analysis
Based on Andersen’s analysis for C
Handles virtual calls
Simulates the run-time method lookup
Models the fields of objects
Analyzes executable code
Ignores dead code from reusable modules

7. Points-to Analysis in Action
class A { void m(X p) {..} }
class B extends A {
X f;
void m(X q) { this.f=q; } }
B b = new B();
X x = new X();
A a = b;
a.m(x); b o1
thisB.m f x o2 q

8. Efficient Implementation
Because of Andersen’s analysis: cubic worst-case complexity
Constraint-based approach
Extends previous work for C in BANE
Define and solve a system of annotated set-inclusion constraints

9. Annotated Constraints
Form: L  a R
L and R denote sets
Annotation a: additional information
Kinds of set expressions L and R
Set variables: represent points-to sets
ref terms: represent objects
Other kinds of expressions

10. Set variables and ref terms
Set variables represent points-to sets
For each reference variable p: VP
For each object o: Vo
Object o is denoted by term ref(o,Vo)
ref(o,VO)  VP p o
ref(o2,VO2)  f VO1 o1 o2 f

11. Example: Accessing Fields
ref(o1,VO1)  VP
p = new A();
q = new B();
p.f = q;
ref(o2,VO2)  Vq
VP  proj(ref,W)
Vq  f W
W  VO1 p o1 o2 q f
Vq  f VO1
ref(o2,VO2)  f VO1

12. Example: Virtual Calls
VP  m lam(Vx)
p.m(x);
ref(o,VO)  VP
receiver object o
Vx  Vz
ref(o,VO)  Vthis
called method m’

13. Experiments 23 Java programs: 14 – 677 user classes
Added the necessary library classes
Machine: 360 MHz, 512Mb
Cost: time and memory
Precision
Object read-write information
Call graph construction
Synchronization removal and stack allocation

14. Analysis Time

15. Number of new X() whose objects are accessed by p.f

16. Resolution of Virtual Call Sites

17. Thread-local new sites

18. Summary Defined a points-to analysis for Java
Implementation with annotated constraints
Practical cost and good precision
Future work
Impact on client applications
Efficient context-sensitive analysis