paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Cut-Shortcut Whole-Program Pointer Analysis: Re-Imagining Context-Sensitivity without Contexts

Cut-Shortcut 全程序指针分析:重新构想无需上下文的上下文敏感分析
TOPLAS 48(3)2026匹配度 4/10 · 该论文是 Java 指针分析与上下文敏感性的静态分析工作,不涉及用户当前重点关注的 PL×AI/LLM、浮点程序分析或贝叶斯程序分析。其形式化推理、CFL 可达性与工程实现风格虽符合部分偏好,但与核心研究方向只有间接关联。引用 0 inbox
Shengyuan Yang, Wenjie Ma, Thomas Reps, Tian Tan, Yue Li
crossref: 2026-09-10

AI 速览

一句话:提出 Cut-Shortcut,无需上下文即可在指针流图中裁剪不精确边并添加跨方法捷径边,实现快速且精确的 Java 指针分析。

上下文敏感可提升 Java 全程序指针分析精度,但需按多个上下文重复分析方法,开销巨大,选择性方法亦受限。本文提出 Cut-Shortcut:其洞察是上下文敏感主要收益是过滤被调用者内合并的虚假对象流;从指针流图看,裁剪(Cut)不精确流边并跨方法添加连接源与目标指针的捷径(Shortcut)边,即可免去显式上下文。作者提炼出三类可安全裁剪与加捷径的程序模式,以推理规则形式化并证明可靠性,并证明其最坏复杂度与上下文不敏感分析相同。面向 Stream 与 Lambda 的扩展 Cut-Shortcut^S 区分不同流管道。实现于 Tai-e,在 10 个大型 Java 程序与 3 组流密集基准上评估:精度接近选择性上下文敏感分析,且在 9/10 个程序上快于上下文不敏感分析。

问题
上下文敏感分析虽能提升 Java 全程序指针分析精度,但需对方法按上下文重复分析,开销大;现有选择性上下文敏感方法仍依赖上下文这一基本思想,在大型程序上可扩展性受限。
方法
提出 Cut-Shortcut:通过裁剪(Cut)不精确的流边并跨方法添加源指针到目标指针的捷径(Shortcut)边来替代显式上下文;归纳三类可安全裁剪与加捷径的程序模式,以推理规则形式化并证明可靠性,并给出 CFL 可达性刻画;扩展 Cut-Shortcut^S 以区分不同 Stream 管道并处理其与 Lambda 的交互。
评估
在 Tai-e 框架中实现;在 10 个大型复杂 Java 程序及 3 组新构建的流密集基准(共 20 个程序)上评估,精度接近(选择性)上下文敏感分析,并在 9/10 个程序上快于上下文不敏感分析,其余持平;Cut-Shortcut^S 在流密集程序上显著提升精度且保持可扩展性与效率。
原文摘要(Abstract)

Over the past decades, context sensitivity has been considered key to improving the precision of whole-program pointer analysis for object-oriented languages such as Java. By analyzing a method under distinct contexts, it separates the static representations of different dynamic instantiations of variables and heap objects, thereby reducing spurious object flows. However, despite its precision benefits, context sensitivity incurs substantial efficiency costs because each method is analyzed multiple times under different contexts. To mitigate this issue, numerous selective context-sensitive approaches have been proposed that apply context sensitivity only to selected methods. However, these approaches do not fully eliminate the efficiency bottleneck because they still rely on the fundamental idea of context sensitivity—analyzing a method multiple times based on calling contexts—which limits scalability on large programs. In this work, we propose Cut-Shortcut , a fundamentally different approach for fast yet precise Java pointer analysis. The core insight is that the primary benefit of context sensitivity is to filter spurious object flows merged within callee methods; from the perspective of a pointer flow graph, this effect can be obtained without explicit contexts by suppressing the addition of imprecise flow edges ( Cut ) and adding Shortcut edges that directly connect source pointers to target pointers across method boundaries. This insight is distilled into a general principle and instantiated via three well-characterized program patterns under which suppressing imprecise flows and adding precise shortcut flows are provably safe. We formalize Cut-Shortcut via inference rules and prove soundness. A context-free-language (CFL) reachability formulation is further provided to relate Cut-Shortcut to well-understood formal models of pointer analysis and to show that Cut-Shortcut has the same worst-case asymptotic complexity as context-insensitive analysis. To address new sources of imprecision introduced in modern Java, we further propose Cut-Shortcut \({}^{\mathcal{S}}\) , extending one of the patterns to handle Streams and their interaction with Lambda Expressions by distinguishing flows across different stream pipelines. Implemented in the state-of-the-art pointer analysis framework Tai-e , Cut-Shortcut is evaluated on 10 large, complex Java programs from recent literature, and Cut-Shortcut \({}^{\mathcal{S}}\) is evaluated on three new stream-heavy benchmark suites that we created (with 20 programs in total). Results show that Cut-Shortcut achieves precision close to (selective) context-sensitive analysis (where applicable), while being faster than context-insensitive analysis on 9 of the 10 programs and matching it on the remaining one. Moreover, Cut-Shortcut \({}^{\mathcal{S}}\) yields substantial precision improvement while preserving scalability and efficiency for programs with heavy stream usage. To the best of our knowledge, this work is the first to achieve such a good efficiency-precision tradeoff for hard-to-analyze Java programs, including large-scale and feature-rich applications.

链接与引用

DOI 原文 · PDF(开放获取) ·

BibTeX
@article{paperbot3948,
  title = {Cut-Shortcut Whole-Program Pointer Analysis: Re-Imagining Context-Sensitivity without Contexts},
  author = {Shengyuan Yang and Wenjie Ma and Thomas Reps and Tian Tan and Yue Li},
  journal = {ACM Transactions on Programming Languages and Systems},
  volume = {48},
  number = {3},
  year = {2026},
  doi = {10.1145/3818615}
}