Making k-Object-Sensitive Pointer Analysis More Precise with Still k-Limiting

What is Object-Sensitivity? .Objects (allocation sites)as contexts 。k-CFA→k-obj 1

What is Object-Sensitivity?  Objects (allocation sites) as contexts  k-CFA  k-obj 11

A Code Example class A class B void foo(){ void bar(){ V=… A a1 =new A();/A/1 a1.foo(); A a2 new A();/A/2 a2.foo(); 12

A Code Example class B { void bar() { A a1 = new A(); // A/1 a1.foo(); A a2 = new A(); // A/2 a2.foo(); } } class A { void foo() { v = … } } 12

1-CFA (call-site） class A class B void foo() { void bar(){ V=… A a1 new A();/A/1 a1.foo(); A a2 new A();/A/2 a2.foo(); Context Variable Object [a1.foo()] V 0。。 [a2.foo()] V 13

class B { void bar() { A a1 = new A(); // A/1 a1.foo(); A a2 = new A(); // A/2 a2.foo(); } } class A { void foo() { v = … } } 1-CFA (call-site) Context Variable Object [a1.foo()] v … [a2.foo()] v … 13

1-obj (allocation-site of receiver object) class A{ class B void foo() { void bar(){ V=… A a1 new A();/A/1 a1.foo(); A a2 new A();/A/2 a2.foo(); Context Variable Object [AW1] V 0。。 [AW2] V 14

class B { void bar() { A a1 = new A(); // A/1 a1.foo(); A a2 = new A(); // A/2 a2.foo(); } } class A { void foo() { v = … } } 1-obj (allocation-site of receiver object) 14 Context Variable Object [A/1] v … [A/2] v …

k-obj when k 1? class A class B void foo() { void bar(){ V=.. A a1 new A();/A/1 a1.foo(); A a2 new A();/A/2 a2.foo(); 15

class B { void bar() { A a1 = new A(); // A/1 a1.foo(); A a2 = new A(); // A/2 a2.foo(); } } class A { void foo() { v = … } } k-obj when k > 1? 15