A correspondence between two approaches to interprocedural analysis in the presence of join

摘要

Many interprocedural static analyses perform a lossy join forreasons of termination or efficiency. We study the relationship betweentwo predominant approaches to interprocedural analysis, the summary-based (or functional) approach and the call-strings (or k-CFA) approach,in the presence of a lossy join. Despite the use of radically different waysto distinguish procedure contexts by these two approaches, we provethat post-processing their results using a form of garbage collection ren-ders them equivalent. Our result extends the classic result by Sharir andPnueli that showed the equivalence between these two approaches in thesetting of distributive analysis, wherein the join is lossless.We also empirically compare these two approaches by applying them to a pointer analysis that performs a lossy join. Our experiments on ten Javaprograms of size 400K{900K bytecodes show that the summary-basedapproach outperforms an optimized implementation of the k-CFA approach: thek-CFA implementation does not scale beyond k=2, while the summary-based approach proves up to 46% more pointer analysis client queries than 2-CFA. The summary-based approach thus enables, via our equivalence result, to measure the precision of k-CFA with unbounded k, for the class of interprocedural analyses that perform a lossy join.