一句话:提出 Cut-Shortcut,无需上下文即可在指针流图中裁剪不精确边并添加跨方法捷径边,实现快速且精确的 Java 指针分析。
上下文敏感可提升 Java 全程序指针分析精度,但需按多个上下文重复分析方法,开销巨大,选择性方法亦受限。本文提出 Cut-Shortcut:其洞察是上下文敏感主要收益是过滤被调用者内合并的虚假对象流;从指针流图看,裁剪(Cut)不精确流边并跨方法添加连接源与目标指针的捷径(Shortcut)边,即可免去显式上下文。作者提炼出三类可安全裁剪与加捷径的程序模式,以推理规则形式化并证明可靠性,并证明其最坏复杂度与上下文不敏感分析相同。面向 Stream 与 Lambda 的扩展 Cut-Shortcut^S 区分不同流管道。实现于 Tai-e,在 10 个大型 Java 程序与 3 组流密集基准上评估:精度接近选择性上下文敏感分析,且在 9/10 个程序上快于上下文不敏感分析。
Over the past decades, context sensitivity has been considered key to improving the precision of whole-program pointer analysis for object-oriented languages such as Java. By analyzing a method under distinct contexts, it separates the static representations of different dynamic instantiations of variables and heap objects, thereby reducing spurious object flows. However, despite its precision benefits, context sensitivity incurs substantial efficiency costs because each method is analyzed multiple times under different contexts. To mitigate this issue, numerous selective context-sensitive approaches have been proposed that apply context sensitivity only to selected methods. However, these approaches do not fully eliminate the efficiency bottleneck because they still rely on the fundamental idea of context sensitivity—analyzing a method multiple times based on calling contexts—which limits scalability on large programs. In this work, we propose Cut-Shortcut , a fundamentally different approach for fast yet precise Java pointer analysis. The core insight is that the primary benefit of context sensitivity is to filter spurious object flows merged within callee methods; from the perspective of a pointer flow graph, this effect can be obtained without explicit contexts by suppressing the addition of imprecise flow edges ( Cut ) and adding Shortcut edges that directly connect source pointers to target pointers across method boundaries. This insight is distilled into a general principle and instantiated via three well-characterized program patterns under which suppressing imprecise flows and adding precise shortcut flows are provably safe. We formalize Cut-Shortcut via inference rules and prove soundness. A context-free-language (CFL) reachability formulation is further provided to relate Cut-Shortcut to well-understood formal models of pointer analysis and to show that Cut-Shortcut has the same worst-case asymptotic complexity as context-insensitive analysis. To address new sources of imprecision introduced in modern Java, we further propose Cut-Shortcut \({}^{\mathcal{S}}\) , extending one of the patterns to handle Streams and their interaction with Lambda Expressions by distinguishing flows across different stream pipelines. Implemented in the state-of-the-art pointer analysis framework Tai-e , Cut-Shortcut is evaluated on 10 large, complex Java programs from recent literature, and Cut-Shortcut \({}^{\mathcal{S}}\) is evaluated on three new stream-heavy benchmark suites that we created (with 20 programs in total). Results show that Cut-Shortcut achieves precision close to (selective) context-sensitive analysis (where applicable), while being faster than context-insensitive analysis on 9 of the 10 programs and matching it on the remaining one. Moreover, Cut-Shortcut \({}^{\mathcal{S}}\) yields substantial precision improvement while preserving scalability and efficiency for programs with heavy stream usage. To the best of our knowledge, this work is the first to achieve such a good efficiency-precision tradeoff for hard-to-analyze Java programs, including large-scale and feature-rich applications.
@article{paperbot3948,
title = {Cut-Shortcut Whole-Program Pointer Analysis: Re-Imagining Context-Sensitivity without Contexts},
author = {Shengyuan Yang and Wenjie Ma and Thomas Reps and Tian Tan and Yue Li},
journal = {ACM Transactions on Programming Languages and Systems},
volume = {48},
number = {3},
year = {2026},
doi = {10.1145/3818615}
}