Tobias Gutzmann

Fast and precise points-to analysis

Many software engineering applications require points-to analysis. These client applications range from optimizing compilers to integrated program development environments (IDEs) and from testing environments to reverse-engineering tools. Moreover, software engineering applications used in an edit-compile cycle need points-to analysis to be fast and precise. In this article, we present a new context- and flow-sensitive approach to points-to analysis where calling contexts are distinguished by the points-to sets analyzed for their call target expressions. Compared to other well-known context-sensitive techniques it is faster in practice, on average, twice as fast as the call string approach and by an order of magnitude faster than the object-sensitive technique. In fact, it shows to be only marginally slower than a context-insensitive baseline analysis. At the same time, it provides higher precision than the call string technique and is similar in precision to the object-sensitive technique. We confirm these statements with experiments using a number of abstract precision metrics and a concrete client application: escape analysis.

Software Quality Prediction Models Compared

Numerous empirical studies confirm that many software metrics aggregated in software quality prediction models are valid predictors for qualities of general interest like maintainability and correctness. Even these general quality models differ quite a bit, which raises the question: Do the differences matter? The goal of our study is to answer this question for a selection of quality models that have previously been published in empirical studies. We compare these quality models statistically by applying them to the same set of software systems, i.e., to altogether 328 versions of 11 open-source software systems. Finally, we draw conclusions from quality assessment using the different quality models, i.e., we calculate a quality trend and compare these conclusions statistically. We identify significant differences among the quality models. Hence, the selection of the quality model has influence on the quality assessment of software based on software metrics.

Towards Path-Sensitive Points-to Analysis

Points-to analysis is a static program analysis aiming at analyzing the reference structure of dynamically allocated objects at compile-time. It constitutes the basis for many analyses and optimizations in software engineering and compiler construction. Sparse program representations, such as Whole Program Points-to Graph (WPP2G) and Points-to SSA (P2SSA), represent only dataflow that is directly relevant for points-to analysis. They have proved to be practical in terms of analysis precision and efficiency. However, intra-procedural control flow information is removed from these representations, which sacrifices analysis precision to improve analysis performance. We show an approach for keeping control flow related information even in sparse program representations by representing control flow effects as operations on the data transferred, i.e., as dataflow information. These operations affect distinct paths of the program differently, thus yielding a certain degree of path-sensitivity. Our approach works with both WPP2G and P2SSA representations. We apply the approach to P2SSA-based and flow-sensitive points-to analysis and evaluate a context-insensitive and a context-sensitive variant. We assess our approach using abstract precision metrics. Moreover, we investigate the precision improvements and performance penalties when used as an input to three source-code-level analyses: dead code, cast safety, and null pointer analysis.

Towards Comparing and Combining Points-to Analyses

Points-to information is the basis for many analyses and transformations, e.g., for program understanding and optimization. To justify new analysis techniques, they need to be compared to the state of the art regarding their accuracy and efficiency. Usually, benchmark suites are used to experimentally compare the different techniques. In this paper, we show that the accuracy of two analyses can only be compared in restricted cases, as there is no benchmark suite with exact Points-to information, no Gold Standard, and it is hard to construct one for realistic programs. We discuss the challenges and possible traps that may arise when comparing different Points-to analyses directly with each other, and with over- and under-approximations of a Gold Standard. Moreover, we discuss how different Points-to analyses can be combined to a more precise one. We complement the paper with experiments comparing and combining different static and dynamic Points-to analyses.

Feedback-driven points-to analysis

In this paper, we present feedback-driven points-to analysis where any classical points-to analysis has its points-to results at certain program points guarded by a-priori upper bounds. Such upper bounds can come from other points-to analyses -- this is of interest when different approaches are not strictly ordered in terms of accuracy -- and from human insight, i.e., manual proofs that certain points-to relations are infeasible for every program run.

Fast and Precise Points-to Analysis

Many software engineering applications require points-to analysis. Client applications range from optimizing compilers to program development and testing environments to reverse-engineering tools. In this paper, we present a new context-sensitive approach to points-to analysis where calling contexts are distinguished by the points-to sets analyzed for their target expressions. Compared to other well-known context-sensitive techniques, it is faster - twice as fast as the call string approach and by an order of magnitude faster than the object-sensitive technique - and requires less memory. At the same time, it provides higher precision than the call string technique and is similar in precision to the object-sensitive technique. These statements are confirmed by experiments.

Backporting Java 5 Code

Java 5 has introduced a number of new syntactical language features that make development faster, easier, and safer. However, at the same time, it has also introduced downward incompatibilities: code written for Java 5 cannot be used on pre-Java 5 platforms. This tool demonstration presents a number of source-to-source transformations that backport source code written for the Java 5 platform to legacy platforms. Developers who are, for different reasons, still bound to legacy platforms can benefit with help of this tool from the new language features, and they can use thirdparty components written for more recent platforms. Compared to existing tools, ours is the first that can backport all new syntactical Java 5 language features while the user maintains full control of the source code.