Merging equivalent contexts for scalable heap-cloning-based context-sensitive points-to analysis

A context-sensitive points-to analysis maintains separate points-to relationships for each possible (abstract) calling context of a method. Previous work has shown that a large number of equivalence classes exists in the representation of calling contexts. Such equivalent contexts provide opportunities for context-sensitive analyses based on binary decision diagrams (BDDs), in which BDDs automatically merge equivalent points-to relationships. However, the use of a BDD ``black box'' introduces additional overhead for analysis running time. Furthermore, with heap cloning (i.e., using context-sensitive object allocation sites), BDDs are not as effective because the number of equivalence classes increases significantly. A further step must be taken to look inside the BDD black box to investigate where the equivalence comes from, and what tradeoffs can be employed to enable practical large-scale heap cloning. This paper presents an analysis for Java that exploits equivalence classes in context representation. For a particular pointer variable or heap object, all abstract contexts within an equivalence class can be merged. This technique naturally results in a new non-BDD context-sensitive points-to analysis. Based on these equivalence classes,the analysis employs a last-k-substring merging approach to define scalability and precision tradeoffs. We show that small values for k can enable scalable heap cloning for large Java programs. The proposed analysis has been implemented and evaluated on a large set of Java programs. The experimental results show improvements over an existing 1-object-sensitive analysis with heap cloning, which is the most precise scalable analysis implemented in the state-of-the-art Paddle analysis framework. For computing a points-to solution for an entire program, our approach is an order of magnitude faster compared to this BDD-based analysis and to a related non-BDD refinement-based analysis.