Resolving and exploiting the k-CFA paradox: illuminating functional vs. object-oriented program analysis

Low-level program analysis is a fundamental problem, taking the shape of “flow analysis ” in functional languages and “points-to” analysis in imperative and object-oriented languages. Despite the similarities, the vocabulary and results in the two communities remain largely distinct, with limited cross-understanding. One of the few links is Shivers’s k-CFA work, which has advanced the concept of “context-sensitive analysis ” and is widely known in both communities. Recent results indicate that the relationship between the func-tional and object-oriented incarnations of k-CFA is not as well understood as thought. Van Horn and Mairson proved k-CFA for k ≥ 1 to be EXPTIME-complete; hence, no polynomial-time al-gorithm can exist. Yet, there are several polynomial-time formula-tions of context-sensitive points-to analyses in object-oriented lan-guages. Thus, it seems that functional k-CFA may actually be a pro-foundly different analysis from object-oriented k-CFA. We resolve this paradox by showing that the exact same specification of k-CFA is polynomial-time for object-oriented languages yet exponential-time for functional ones: objects and closures are subtly different, in a way that interacts crucially with context-sensitivity and com-plexity. This illumination leads to an immediate payoff: by pro-jecting the object-oriented treatment of objects onto closures, we derive a polynomial-time hierarchy of context-sensitive CFAs for functional programs