Pick Your Contexts Well : Understanding Object-Sensitivity The Making of a Precise and Scalable Pointer Analysis

Object-sensitivity has emerged as an excellent context abs traction for points-to analysis in object-oriented languages. Desp it its practical success, however, object-sensitivity is poorly unde rstood. For instance, for a context depth of 2 or higher, past scalable im plementations deviate significantly from the original definiti on of an object-sensitive analysis. The reason is that the analysis has many degrees of freedom, relating to which context elements are p icked at every method call and object creation. We o ffer a clean model for the analysis design space, and discuss a formal and infor mal understanding of object-sensitivity and of how to create good bjectsensitive analyses. The results are surprising in their ext ent. We find that past implementations have made a sub-optimal choic e of contexts, to the severe detriment of precision and performa nce. We define a “full-object-sensitive” analysis that results in s ignificantly higher precision, and often performance, for the exact same context depth. We also introduce “type-sensitivity” as an expl icit approximation of object-sensitivity that preserves high con text quality at substantially reduced cost. A type-sensitive points -to analysis makes an unconventional use of types as context: the context types are not dynamic types of objects involved in the analysis, bu t instead upper bounds on the dynamic types of their allocator ob jects. Our results expose the influence of context choice on the qual ity of points-to analysis and demonstrate type-sensitivity to be an idea with major impact: It decisively advances the state-of-the -art with a spectrum of analyses that simultaneously enjoy speed (sev eral times faster than an analogous object-sensitive analysis) , scalability (comparable to analyses with much less context-sensiti vity), and precision (comparable to the best object-sensitive analys is with the same context depth).