Stacking-based context-sensitive points-to analysis for java

Points-to analysis for Java infers heap objects that a reference variable can point to. Existing practiced context-sensitive points-to analyses are cloning-based, with an inherent limit to handle recursive procedure calls and being hard to scale under deep cloning. This paper presents a stacking-based context-sensitive points-to analysis for Java, by deriving the analysis as weighted pushdown model checking problems. To generate a tractable model for model checking, instead of passing global variables as parameters along procedure calls and returns, we model the heap memory with a global data structure that stores and loads global references with synchronized points-to information on-demand. To accelerate the analysis, we propose a two-staged iterative procedure that combines local exploration for lightening most of iterations and global update for guaranteeing soundness. In particular, summary transition rules that carry cached data flows are carefully introduced to trigger each local exploration, which boosts the convergence with retaining the precision. Empirical studies show that, our analysis scales well to Java benchmarks of significant size, and achieved in average 2.5X speedup in the two-staged analysis framework.Hardware and Software: Verification and Testing, 5th International Haifa Verification Conference, HVC 2009, Haifa, Israel, October 19-22, 2009, Revised Selected Paper