一句话：挑战对象敏感优于调用点敏感的传统观点，在上下文隧道机制下证明调用点敏感可模拟对象敏感且更精确可扩展。
本文重新审视面向对象程序静态分析中上下文敏感性的经典结论：对象敏感通常被认为比调用点敏感更精确。作者指出该结论只在传统 k-limited 设置下成立；在最近提出的 context tunneling 设置下，分析可从上下文字符串中任意选取长度 k 的子序列，此时调用点敏感能几乎完全模拟对象敏感，反之则不行。为此提出 Obj2CFA，将任意 context-tunneled 对象敏感分析转换为更精确的 context-tunneled 调用点敏感分析。作者在 Doop 中实现该方法，并基于最先进的对象敏感指针分析导出新的调用点敏感分析。真实 Java 程序实验表明，新分析在精度和可扩展性上均优于对象敏感，甚至 1-call-site 也比传统 3-object-sensitive 更精确。
In this paper, we challenge the commonly-accepted wisdom in static analysis that object sensitivity is superior to call-site sensitivity for object-oriented programs. In static analysis of object-oriented programs, object sensitivity has been established as the dominant flavor of context sensitivity thanks to its outstanding precision. On the other hand, call-site sensitivity has been regarded as unsuitable and its use in practice has been constantly discouraged for object-oriented programs. In this paper, however, we claim that call-site sensitivity is generally a superior context abstraction because it is practically possible to transform object sensitivity into more precise call-site sensitivity. Our key insight is that the previously known superiority of object sensitivity holds only in the traditional k -limited setting, where the analysis is enforced to keep the most recent k context elements. However, it no longer holds in a recently-proposed, more general setting with context tunneling. With context tunneling, where the analysis is free to choose an arbitrary k -length subsequence of context strings, we show that call-site sensitivity can simulate object sensitivity almost completely, but not vice versa. To support the claim, we present a technique, called Obj2CFA, for transforming arbitrary context-tunneled object sensitivity into more precise, context-tunneled call-site-sensitivity. We implemented Obj2CFA in Doop and used it to derive a new call-site-sensitive analysis from a state-of-the-art object-sensitive pointer analysis. Experimental results confirm that the resulting call-site sensitivity outperforms object sensitivity in precision and scalability for real-world Java programs. Remarkably, our results show that even 1-call-site sensitivity can be more precise than the conventional 3-object-sensitive analysis.
@article{paperbot1578,
title = {Return of CFA: call-site sensitivity can be superior to object sensitivity even for object-oriented programs},
author = {Minseok Jeon and Hakjoo Oh},
journal = {Proceedings of the ACM on Programming Languages},
volume = {6},
number = {POPL},
year = {2022},
doi = {10.1145/3498720}
}