A Correspondence between Two Approaches to Interprocedural Analysis in the Presence of Join

  • Ravi Mangal
  • Mayur Naik
  • Hongseok Yang
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8410)


Many interprocedural static analyses perform a lossy join for reasons of termination or efficiency. We study the relationship between two predominant approaches to interprocedural analysis, the summary-based (or functional) approach and the call-strings (or k-CFA) approach, in the presence of a lossy join. Despite the use of radically different ways to distinguish procedure contexts by these two approaches, we prove that post-processing their results using a form of garbage collection renders them equivalent. Our result extends the classic result by Sharir and Pnueli that showed the equivalence between these two approaches in the setting of distributive analysis, wherein the join is lossless.

We also empirically compare these two approaches by applying them to a pointer analysis that performs a lossy join. Our experiments on ten Java programs of size 400K–900K bytecodes show that the summary-based approach outperforms an optimized implementation of the k-CFA approach: the k-CFA implementation does not scale beyond \(k\!\!=\!\!2\), while the summary-based approach proves up to 46% more pointer analysis client queries than 2-CFA. The summary-based approach thus enables, via our equivalence result, to measure the precision of k-CFA with unbounded k, for the class of interprocedural analyses that perform a lossy join.


Abstract State Garbage Collection Program Point Call Graph Call Site 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


  1. [Age95]
    Agesen, O.: The cartesian product algorithm. In: Olthoff, W. (ed.) ECOOP 1995. LNCS, vol. 952, pp. 2–26. Springer, Heidelberg (1995)Google Scholar
  2. [Bes09]
    Besson, F.: CPA beats ∞-CFA. In: FTfJP (2009)Google Scholar
  3. [BLQ+03]
    Berndl, M., Lhoták, O., Qian, F., Hendren, L., Umanee, N.: Points-to analysis using BDDs. In: PLDI (2003)Google Scholar
  4. [BPR01]
    Ball, T., Podelski, A., Rajamani, S.K.: Boolean and cartesian abstraction for model checking C programs. In: Margaria, T., Yi, W. (eds.) TACAS 2001. LNCS, vol. 2031, pp. 268–283. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  5. [BR01]
    Ball, T., Rajamani, S.: Bebop: a path-sensitive interprocedural dataflow engine. In: PASTE (2001)Google Scholar
  6. [BS09]
    Bravenboer, M., Smaragdakis, Y.: Strictly declarative specification of sophisticated points-to analyses. In: OOPSLA (2009)Google Scholar
  7. [CC79]
    Cousot, P., Cousot, R.: Systematic design of program analysis frameworks. In: POPL (1979)Google Scholar
  8. [CC92]
    Cousot, P., Cousot, R.: Abstract interpretation frameworks. Journal of Logic and Computation 2(4) (1992)Google Scholar
  9. [FYD+08]
    Fink, S., Yahav, E., Dor, N., Ramalingam, G., Geay, E.: Effective typestate verification in the presence of aliasing. ACM TOSEM 17(2) (2008)Google Scholar
  10. [GC01]
    Grove, D., Chambers, C.: A framework for call graph construction algorithms. ACM TOPLAS 23(6) (2001)Google Scholar
  11. [KK08]
    Khedker, U.P., Karkare, B.: Efficiency, precision, simplicity, and generality in interprocedural dataflow analysis: Resurrecting the classical call strings method. In: Hendren, L. (ed.) CC 2008. LNCS, vol. 4959, pp. 213–228. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  12. [KMR12]
    Khedker, U.P., Mycroft, A., Rawat, P.S.: Liveness-based pointer analysis. In: Miné, A., Schmidt, D. (eds.) SAS 2012. LNCS, vol. 7460, pp. 265–282. Springer, Heidelberg (2012)CrossRefGoogle Scholar
  13. [LH08]
    Lhoták, O., Hendren, L.: Evaluating the benefits of context-sensitive points-to analysis using a BDD-based implementation. ACM TOSEM 18(1) (2008)Google Scholar
  14. [Min06]
    Miné, A.: The octagon abstract domain. Higher-Order and Symbolic Computation 19(1) (2006)Google Scholar
  15. [MRR02]
    Milanova, A., Rountev, A., Ryder, B.: Parameterized object sensitivity for points-to and side-effect analyses for Java. In: ISSTA (2002)Google Scholar
  16. [MRR05]
    Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to analysis for Java. ACM TOSEM 14(1) (2005)Google Scholar
  17. [MSH10]
    Might, M., Smaragdakis, Y., Horn, D.: Resolving and exploiting the k-CFA paradox: illuminating functional vs. oo program analysis. In: PLDI (2010)Google Scholar
  18. [MSRF04]
    Manevich, R., Sagiv, M., Ramalingam, G., Field, J.: Partially disjunctive heap abstraction. In: Giacobazzi, R. (ed.) SAS 2004. LNCS, vol. 3148, pp. 265–279. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  19. [RHS95]
    Reps, T., Horwitz, S., Sagiv, M.: Precise interprocedural dataflow analysis via graph reachability. In: POPL (1995)Google Scholar
  20. [SBL11]
    Smaragdakis, Y., Bravenboer, M., Lhoták, O.: Pick your contexts well: understanding object-sensitivity. In: POPL (2011)Google Scholar
  21. [Shi88]
    Shivers, O.: Control-flow analysis in scheme. In: PLDI (1988)Google Scholar
  22. [SP81]
    Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. In: Program Flow Analysis: Theory and Applications, ch. 7. Prentice-Hall (1981)Google Scholar
  23. [VS10]
    Vardoulakis, D., Shivers, O.: CFA2: A Context-Free Approach to Control-Flow Analysis. In: Gordon, A.D. (ed.) ESOP 2010. LNCS, vol. 6012, pp. 570–589. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  24. [Wha07]
    Whaley, J.: Context-Sensitive Pointer Analysis using Binary Decision Diagrams. PhD thesis, Stanford University (March 2007)Google Scholar
  25. [WL04]
    Whaley, J., Lam, M.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In: PLDI (2004)Google Scholar
  26. [YLB+08]
    Yang, H., Lee, O., Berdine, J., Calcagno, C., Cook, B., Distefano, D., O’Hearn, P.W.: Scalable shape analysis for systems code. In: Gupta, A., Malik, S. (eds.) CAV 2008. LNCS, vol. 5123, pp. 385–398. Springer, Heidelberg (2008)CrossRefGoogle Scholar
  27. [ZC04]
    Zhu, J., Calman, S.: Symbolic pointer analysis revisited. In: PLDI (2004)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2014

Authors and Affiliations

  • Ravi Mangal
    • 1
  • Mayur Naik
    • 1
  • Hongseok Yang
    • 2
  1. 1.Georgia Institute of TechnologyUSA
  2. 2.University of OxfordUK

Personalised recommendations