## Complexity of Points-to Analysis of Java in the Presence of Exceptions (2001)

Venue: | IEEE Transactions on Software Engineering |

Citations: | 7 - 0 self |

### BibTeX

@ARTICLE{Chatterjee01complexityof,

author = {Ramkrishna Chatterjee and Barbara G. Ryder and William A. Landi},

title = {Complexity of Points-to Analysis of Java in the Presence of Exceptions},

journal = {IEEE Transactions on Software Engineering},

year = {2001},

volume = {27}

}

### Years of Citing Articles

### OpenURL

### Abstract

At each program point, points-to analysis for statically typed object-oriented programming languages (e.g., Java, C ++ ) determines those objects to which a reference may refer (or a pointer may point) during execution. Points-to analysis is necessary for any semantics-based software tools for object-oriented systems. Our new complexity results for points-to analysis distinguish the di#culty of intraprocedural and interprocedural points-to analyses for languages with combinations of single-level types (i.e., types with data members only of primitive type), exceptions with or without subtyping, and dynamic dispatch. Our results include: . The first polynomial-time algorithm for points-to analysis in the presence of exceptions that handles a robust subset of Java without threads and can be applied to C ++ ; . Proofs that the above algorithm is safe in general and provably precise on programs with single-level types and exceptions without subtyping, but not dynamic dispatch; thus this case is in P; . Proof that interprocedural points-to analysis problem with single-level types and exceptions with subtyping, but without dynamic dispatch, is PSPACE-hard, while the intraprocedural problem is PSPACE-complete. Other complexity characterizations of points-to analysis in programs without exceptions are presented, including an algorithm with worst-case bound of O(n 5 ), which improves over the O(n 7 ) worst-case bound achievable from previous approaches of Reps, Horwitz and Sagiv [RHS95] and Landi and Ryder [LR91]. Keywords: Points-to Analysis, Java, Exceptions, Complexity. # The research reported here was supported, in part, by NSF grants GER-9023628, CCR97-04703 and the Hewlett-Packard Corporation. An abridged version of this paper appeared as [CRL98]. 1

### Citations

4144 |
Introduction to Automata Theory, Languages, and Computation
- Hopcroft, Ullman
- 1979
(Show Context)
Citation Context ... the above construction shows that intraprocedural J-PTA is PSPACE-hard. 5.3 PSPACE-completeness Now we will show that intraprocedural J-PTA is in PSPACE, and hence PSPACE-complete. Savitch's theorem =-=[HU79]-=- implies that PSPACE= NPSPACE 11 . Hence, it is enough to show that intraprocedural J-PTA is in NPSPACE. Our proof is similar to Landi's proof [Lan92a] that C-PTA is in NPSPACE. We present a non-deter... |

2429 | Computational complexity
- Papadimitriou
- 1994
(Show Context)
Citation Context ...h computes a safe solution in all cases and the precise solution in some restricted cases, thus characterizing these polynomial-time solvable cases. Figure 5 shows the hierarchy of complexity classes =-=[Pap94]-=-. NC is the class of e#ciently parallelizable problems and P-Space consists of problems that can be solved using polynomial amount of space. It is known that NC is a proper subset of P-Space; apart fr... |

1713 |
The Java Language Specification
- Gosling, Joy, et al.
- 2000
(Show Context)
Citation Context ...at each program point, the solution computed by the algorithm is a superset of the precise solution. 2.6 Single-level type A single-level type is one of the following: (1) a primitive type defined in =-=[GJS96]-=- (e.g., int, float etc.), (2) a class that has all non-static data-members of primitive types (e.g., class A { int i,j; }) or (3) an array of a primitive type. Remark. Since any class in Java has to e... |

1371 | Program Slicing - Weiser - 1984 |

732 | Inter procedural slicing using dependence graphs - Horwitz, Reps, et al. - 1988 |

564 | Program Analysis and Specialization for the C Programming Language - Andersen - 1994 |

553 | Points-to analysis in almost linear time - Steensgaard - 1996 |

411 | Efficient Context-Sensitive Pointer Analysis for C Programs
- Wilson, Lain
- 1995
(Show Context)
Citation Context ...o which param can point to at the entry of proc1 using a special nonvisible location. Arbitrary casting (and union types) can be easily handled using a low-level memory representation as discussed in =-=[WL95]-=-. Consider the example in Figure 17 which illustrates the interaction between exceptions and implicit calls to destructors. Suppose, class A has a used-defined destructor method. Statement 2 throws an... |

402 | Context-sensitive interprocedural points-to analysis in the presence of function pointers
- Emami, Ghiya, et al.
- 1994
(Show Context)
Citation Context ... and comes back from the exit-node of the target method to the return-node of the call-node. Due to dynamic dispatch, interprocedural edges are constructed iteratively during data-flow analysis as in =-=[EGH94]-=-. Details of this construction are shown in Figure 19 of Appendix A. We will denote the entry-node of main by start-node. 2.2 Representation of dynamically created objects Any static analysis techniqu... |

385 | Interprocedural dataflow analysis via graph reachability
- Reps, Sagiv, et al.
- 1994
(Show Context)
Citation Context ...hout exceptions are presented, including an algorithm with worst-case bound of O(n 5 ), which improves over the O(n 7 ) worst-case bound achievable from previous approaches of Reps, Horwitz and Sagiv =-=[RHS95]-=- and Landi and Ryder [LR91]. Keywords: Points-to Analysis, Java, Exceptions, Complexity. # The research reported here was supported, in part, by NSF grants GER-9023628, CCR97-04703 and the Hewlett-Pac... |

336 | A safe approximate algorithm for interprocedural pointer aliasing
- Landi, Ryder
- 1992
(Show Context)
Citation Context ...nformation than is useful. 3 PTA in the absence of exceptions Our basic algorithm for PTA is an iterative worklist algorithm [KU76]. It operates on an ICFG and is similar to the Landi-Ryder algorithm =-=[LR92]-=- for alias analysis, but instead of aliases, it computes points-to's. In Section 6, we will extend this algorithm to handle exceptions. 3.1 Lattice for data-flow analysis In order to restrict data-flo... |

315 | Two approaches to interprocedural data flow analysis - Sharir, Pnueli - 1981 |

301 | The program dependence graph in software development environments - Ottenstein, Ottenstein - 1984 |

285 | Using Program Slicing in Software Maintenance - Gallagher - 1990 |

257 | Fast static analysis of C++ virtual function calls
- Bacon, Sweeney
- 1996
(Show Context)
Citation Context ...traint-based approaches, [Suz81, DGC98] are flowand context-insensitive, while [PS91, PC94, Age95, GDDC97] are flow-insensitive, but context-sensitive. None of the above approaches handle exceptions. =-=[BS96]-=- is an extension of hierarchy analysis for C++ and thus is flow- and context-insensitive. Complexity. [GI98] characterizes the complexity of concrete type inference in the presence of dynamic dispatch... |

226 | Object-oriented type inference - Palsberg, Schwartzbach - 1991 |

225 | Efficient flow-sensitive interprocedural computation of pointer-induced aliases and side effects - Choi, Burke, et al. - 1993 |

176 | Precise concrete type inference for object oriented languages - Plevyak, Chien - 1994 |

160 | Fast and accurate flowinsensitive points-to analysis - Shapiro, Horwitz - 1997 |

148 | Undecidability of static analysis
- Landi
- 1992
(Show Context)
Citation Context ...s important because this technique for handling exceptions may be combined with other flow-sensitive algorithms. Complexity of Computing the Precise Solution in the General Case. Using Landi's result =-=[Lan92b]-=- about undecidability of may alias analysis, it can be shown that PTA in the general case is undecidable. Optimizations. The estimate in lemma 7 is a worstcase bound; in practice we expect the perform... |

134 | A schema for interprocedural modification side-effect analysis with pointer aliasing - Ryder, Landi, et al. - 2001 |

130 | Context-insensitive alias analysis reconsidered - Ruf - 1995 |

128 | Global data flow analysis and iterative algorithms
- Kam, Ullman
- 1976
(Show Context)
Citation Context ...sidered, we will get a safe solution; however, this may generate far more information than is useful. 3 PTA in the absence of exceptions Our basic algorithm for PTA is an iterative worklist algorithm =-=[KU76]-=-. It operates on an ICFG and is similar to the Landi-Ryder algorithm [LR92] for alias analysis, but instead of aliases, it computes points-to's. In Section 6, we will extend this algorithm to handle e... |

112 | Relevant context inference - Chatterjee, Ryder, et al. - 1999 |

109 | Pointer-induced aliasing: A problem classification
- Landi, Ryder
- 1991
(Show Context)
Citation Context ...d, including an algorithm with worst-case bound of O(n 5 ), which improves over the O(n 7 ) worst-case bound achievable from previous approaches of Reps, Horwitz and Sagiv [RHS95] and Landi and Ryder =-=[LR91]-=-. Keywords: Points-to Analysis, Java, Exceptions, Complexity. # The research reported here was supported, in part, by NSF grants GER-9023628, CCR97-04703 and the Hewlett-Packard Corporation. An abridg... |

108 | Slicing object-oriented software - Larsen, Harrold - 1996 |

106 | The cartesian product algorithm: Simple and precise type inference of parametric polymorphism - Agesen - 1995 |

103 | The semantic approach to program slicing - Venkatesh - 1991 |

93 | Putting Pointer Analysis to Work - Ghiya, Hendren - 1998 |

77 | The effects of the precision of pointer analysis - Shapiro, Horwitz - 1997 |

73 |
A practical interprocedural data flow analysis algorithm
- Barth
- 1978
(Show Context)
Citation Context ...e., at the top of n). Unfortunately, all realizable paths in a program are not necessarily executable and determining whether a particular branch of an if statement is executable is undecidable. Barth=-=[Bar78]-=- defined precise up to symbolic execution to be the precise solution under the assumption that all realizable program paths are executable (i.e., the result of a test is independent of previous tests ... |

71 | The design of whole-program analysis tools - Atkinson, Griswold - 1996 |

69 | Interprocedural def-use associations for C systems with single level pointers - Pande, Landi, et al. - 1994 |

68 | Flow-insensitive interprocedural alias analysis in the presence of pointers - Burke, Carini, et al. - 1995 |

67 | Fast interprocedural class analysis - DeFouw, Grove, et al. - 1998 |

64 | Efficient computation of interprocedural definition-use chains - Harrold, Soffa - 1994 |

64 | Lifetime analysis of dynamically allocated objects - Ruggieri, Murtagh |

59 | Precise interprocedural chopping - REPS, ROSAY - 1995 |

56 | Interprocedural Aliasing in the Presence of Pointers
- Landi
- 1992
(Show Context)
Citation Context .... due to an exception, then this new reason overrides any previous reason for entering the finally. Also, nested finally statements cause reasons for entering them to stack up. 5.2 PSPACE-hardness In =-=[Lan92a]-=-, Landi showed that intraprocedural mayalias analysis for a subset of C in the presence of pointers with at most 4 levels of indirection 9 and without 9 e.g., int # # # # p, # # #q; dynamic allocation... |

55 | Program decomposition for pointer aliasing: A step towards practical analyses - Zhang, Ryder, et al. - 1996 |

48 | Inferring types in Small- talk - Suzuki |

47 | Effective whole-program analysis in the presence of pointers - Atkinson, Griswold - 1998 |

47 | Slicing Class Hierarchies in C - Tip, Choi, et al. |

45 | System-dependence-graph-based slicing of programs with arbitrary interprocedural control flow - Sinha, Harrold, et al. - 1999 |

39 | Accessing the effects of flow-sensitivity on pointer alias analyses - Hind, Pioli - 1998 |

37 | Flow Insensitive C++ Pointers and Polymorphism Analysis and Its Application to Slicing - Tonella, Antoniol, et al. - 1997 |

35 | More experience with dataflow testing - Weyuker - 1993 |

32 | Data-flow-based virtual function resolution
- Pande, Ryder
- 1996
(Show Context)
Citation Context ...e exceptions. 3.1 Lattice for data-flow analysis In order to restrict data-flow only to realizable paths, points-to's are computed conditioned on assumed-pointsto 's (akin to reaching alias in [LR92] =-=[PR96]-=-), which represent points-to's reaching the entry of a method, and approximate the calling context in which the method has been called. A points-to along with its assumedpoints -to is called a conditi... |

32 | Analyzing exception flow in Java programs
- ROBILLARD, MURPHY
- 1999
(Show Context)
Citation Context ...a programmer to understand how to write appropriate exception handlers, it is necessary to have some understanding of the use of exceptions within that package. Recent research by Robillard and Murphy=-=[RM99]-=- is aimed at providing information for a program understanding tool which allows browsing of potential exception flow through a Java program. Software engineers working with object-oriented applicatio... |

30 | Reuse-Driven Interprocedural Slicing - Harrold, Ci - 1998 |