A large number of call graph construction algorithms for object-oriented and functional languages have been proposed, each embodying different tradeoffs between analysis cost and call graph precision. In this article we present a unifying framework for understanding call graph construction algorithms and an empirical comparison of a representative set of algorithms. We first present a general parameterized algorithm that encompasses many well-known and novel call graph construction algorithms. We have implemented this general algorithm in the Vortex compiler infrastructure, a mature, multilanguage, optimizing compiler. The Vortex implementation provides a “level playing field ” for meaningful cross-algorithm performance comparisons. The costs and benefits of a number of call graph construction algorithms are empirically assessed by applying their Vortex implementation to a suite of sizeable (5,000 to 50,000 lines of code) Cecil and Java programs. For many of these applications, interprocedural analysis enabled substantial speed-ups over an already highly optimized baseline. Furthermore, a significant fraction of these speed-ups can be obtained through the use of a scalable, near-linear time call graph construction algorithm.

Research on how to reason about correctness properties of software systems using model checking is advancing rapidly. Work on extracting finite-state models from program source code and on abstracting those models is focused on enabling the tractable checking of program properties such as freedom from deadlock and assertion violations. For the most part, the problem of specifying more general program properties has not been considered. In this paper

Research on how to reason about correctness properties of software systems using model checking is advancing rapidly. Work on extracting finite-state models from program source code and on abstracting those models is focused on enabling the tractable checking of program properties such as freedom from deadlock and assertion violations. For the most part, the problem of specifying more general program properties has not been considered.

We introduce a new family of connectivity-based garbage collectors (Cbgc) that are based on potential objectconnectivity properties. The key feature of these collectors is that the placement of objects into partitions is determined by performing one of several forms of connectivity analyses on the program. This enables partial garbage collections, as in generational collectors, but without the need for any write barrier.

Many optimizations need precise pointer analyses to be effective. Unfortunately, some Java features, such as dynamic class loading, reflection, and native methods, make pointer analyses difficult to develop. Hence, prior pointer analyses for Java either ignore these features or are overly conservative. This paper presents the first non-trivial pointer analysis that deals with all Java language features. This paper identifies all problems in performing Andersen’s pointer analysis for the full Java language, presents solutions to those problems, and uses a full implementation of the solutions in Jikes RVM for validation and performance evaluation. The results from this work should be transferable to other analyses and to other languages.

Pointer analysis benefits many useful clients, such as compiler optimizations and bug finding tools. Unfortunately, common programming language features, such as dynamic loading, reflection, and foreign language interfaces, make pointer analysis difficult. This paper describes how to deal with these features by performing pointer analysis online, during program execution. For example, dynamic loading may load code that is not available for analysis before the program starts. Only an online analysis can analyze such code, and thus support clients that optimize it or find bugs in it. This paper identifies all problems in performing Andersen’s pointer analysis for the full Java language, presents solutions to these problems, and uses a full implementation of the solutions in a Java virtual machine for validation and performance evaluation. Our analysis is fast: on average over our benchmark suite, if the analysis recomputes points-to results upon each program change, most analysis pauses take under 0.1 seconds, and add up to 64.5 seconds.

Many software engineering applications utilize static program analyses to gain information about programs. Some applications perform static analysis over the whole program's call graph, while others are more interested in specific call chains within a program's call graph. A particular static call chain for an object-oriented program may in fact be impossible to execute, or infeasible, such that there is no input for which the chain will be taken. Identifying infeasible static call chains can save time and resources with respect to the targeted software development tool. This paper examines type infeasibility of call chains, which may be caused by inherently polymorphic call sites and are sometimes due to imprecision in call graphs. The problem of determining whether a call chain is type infeasible is defined and exemplified, and a key property characterizing type infeasible call chains is described. An empirical study was performed on a set of Java programs, and results from examining the call graphs of these programs are presented. Finally, an algorithm that automatically determines the type infeasibility of a call chain due to object parameters is presented.

Constraint-based type inference infers types with subtyping constraints. Such types can capture detailed data and control flow information about the analyzed program. In the presence of polymorphism, existing constraint-based type inference algorithms sacrifice much precision for efficiency. This paper presents both theoretical and practical results on developing precise and efficient polymorphic constraint-based type inference for object-oriented languages. We develop a novel theoretical framework for polymorphic constraint-based type inference. A concrete type inference algorithm can be obtained by instantiating the framework with a particular strategy for handling polymorphism. We define well-known algorithms such as Shivers’ nCFA and Agesen’s Cartesian Product Algorithm (CPA) as instantiations of the framework. We prove the soundness of the framework, which entails the soundness of every algorithm defined as an instantiation of the framework. Using the framework, we develop a novel algorithm, Data Polymorphic CPA (DCPA), which extends Agesen’s CPA Algorithm to achieve high precision in the presence of Data Polymorphism. We further study the construction of practical constraint-based type inference systems for realistic programming languages. We have constructed a type inference system for the full Java language. The system includes implementations of the 0CFA, CPA and DCPA algorithms, and it incorporates a number of novel implementation techniques for achieving scalability. The system is used to statically verify the correctness of Java downcasts. Benchmark results on realistic Java applications show that the DCPA algorithm has good precision and efficiency: it is significantly more accurate than existing algorithms and its efficiency is comparable to CPA.

This document contains details about various projects and my contributions to them. For each project, the details of the project are presented followed by a summary of my contribution to the project. 1 Indus This is an umbrella project for program analyses and transformations relevant to customize and adapt Java programs. The following sub-sections provide details about the core components of Indus. As the work done in this project forms the core of my doctoral dissertation and as almost all of the involved work has been my contribution, there shall be no explicit summary of contributions. Java Program Slicer Program Slicing is a technique of identifying parts (slice) of a program that may influence or be influenced by a given set of program points (slice criteria). This technique has been extensively applied to program understanding. In the Bandera project [7], the application of program slicing was considered to reduce the size of the model extracted from concurrent Java programs for the purpose of program verification via model checking. However, the absence of a configurable and