paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Heap Abstraction via Early-Confluent Object Merging for Pointer Analysis

面向指针分析的基于早期汇流对象合并的堆抽象
OOPSLA 10(OOPSLA2)2026匹配度 3/10 · 该论文属于经典静态程序分析与指针分析中的堆抽象技术,未涉及用户画像核心关注的 LLM/Agent 与静态分析交叉、浮点程序分析或贝叶斯程序分析;仅可作为 PL 静态分析背景知识参考。引用 0 inbox
Jinpeng Wang, Yufei Liang, Zhongsheng Zhan, Tian Tan, Yue Li
crossref: 2026-10-02

AI 速览

一句话:提出 Valve 堆抽象,通过合并早期汇流堆对象,在不依赖特定客户端的前提下兼顾指针分析效率与高精度。

堆抽象直接影响 Java 指针分析的效率与精度:合并不同程序点分配的堆对象可显著提速,但往往损失精度。现有最优方法 Mahjong 只在类型相关客户端上保证精度,通用性受限。本文提出洞察——许多堆对象具有“早期汇流”性质:它们在不同程序点分配,却很快流向同一指针(变量或字段),此后共同传播;合并这类对象对整体精度影响可忽略,而合并未汇流或汇流过晚的对象则会造成明显精度损失。基于此,作者设计 Valve:将早期汇流检测所需的流信息编码为非确定性有限自动机(NFA),并通过 NFA 等价性检验近似判断可合并性,从而高效合并对象并保持高精度。评估在近期文献最大基准及现代大规模 Java 应用上进行,集成多种先进指针分析技术并与 Mahjong 对比。结果显示,Valve 对非类型相关客户端精度显著更高,对类型相关客户端精度相当,效率相当或更优,平均精度达 99.61%。

问题
如何在合并堆对象以提升 Java 指针分析效率的同时,以不依赖特定客户端的方式保持分析精度。
方法
利用堆对象的“早期汇流”现象,将检测所需的流信息编码为 NFA,并以 NFA 等价性检验近似判定对象可合并性,从而实现高效且高精度的堆抽象 Valve。
评估
在近期文献使用的最大基准集与现代大规模 Java 应用上,将 Valve 集成到多种先进指针分析技术中,并与 Mahjong 在精度和效率上直接对比。
原文摘要(Abstract)

Heap abstraction critically affects both the efficiency and precision of pointer analysis for Java programs. By merging heap objects allocated at different program points, heap abstractions can significantly improve analysis efficiency, but often at the cost of precision. Mahjong, a state-of-the-art heap abstraction based on object merging, demonstrates that object merging can substantially improve the efficiency of pointer analysis while preserving precision for type-dependent clients; however, this client-specific guarantee limits its general applicability. In this work, we investigate how to improve the efficiency of pointer analysis through object merging, while preserving precision in a manner independent of any particular client. Our key insight is that, from the perspective of pointer analysis, many heap objects exhibit early flow confluence : they are allocated at different program points and then quickly propagate to the same pointers (variables or fields), after which they continue to flow together through the program. Merging such early-confluent objects has negligible impact on overall analysis precision. In contrast, merging objects that do not flow to the same pointers, or that converge only much later, can introduce substantial precision loss. Guided by this insight, we propose Valve, a new heap abstraction approach that efficiently identifies and merges early-confluent objects. Valve encodes the flow information needed for early-confluence detection as nondeterministic finite automata (NFAs) and approximates mergeability checking via an NFA-equivalence test, enabling efficient object merging while retaining high precision. We evaluate Valve on the largest benchmarks used in recent literature as well as modern large-scale Java applications, by integrating it with multiple state-of-the-art pointer-analysis techniques and directly comparing it with Mahjong. The results show that Valve achieves substantially higher precision than Mahjong for non-type-dependent clients, while maintaining comparable precision for type-dependent clients. At the same time, Valve delivers comparable or often better analysis efficiency across all evaluated cases. Overall, Valve, as a heap abstraction approach, significantly improves the efficiency of pointer analysis across several state-of-the-art techniques while maintaining high precision (99.61% on average).

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@article{paperbot12112,
  title = {Heap Abstraction via Early-Confluent Object Merging for Pointer Analysis},
  author = {Jinpeng Wang and Yufei Liang and Zhongsheng Zhan and Tian Tan and Yue Li},
  journal = {Proceedings of the ACM on Programming Languages},
  volume = {10},
  number = {OOPSLA2},
  year = {2026},
  doi = {10.1145/3839485}
}