Many current program analyses require highly precise pointer#R##N#information about small, tar- geted parts of a given program. This#R##N#motivates the need for demand-driven pointer analyses that compute#R##N#information only where required. Pointer analyses generally compute#R##N#points-to sets of program variables or answer boolean alias#R##N#queries. However, many client analyses require richer pointer#R##N#information. For example, taint and typestate analyses often need to#R##N#know the set of all aliases of a given variable under a certain#R##N#calling context. With most current pointer analyses, clients must#R##N#compute such information through repeated points-to or alias queries, increasing complexity and computation time for them.#R##N##R##N#This paper presents Boomerang, a demand-driven, flow-, field-, and#R##N#context-sensitive pointer analysis for Java programs. Boomerang#R##N#computes rich results that include both the possible allocation sites of a given pointer (points-to information) and all pointers that can point to those allocation sites (alias information). For increased precision and scalability, clients can query Boomerang with respect to particular calling contexts of interest.#R##N##R##N#Our experiments show that Boomerang is more precise than existing#R##N#demand-driven pointer analyses. Additionally, using Boomerang, the#R##N#taint analysis FlowDroid issues up to 29.4x fewer pointer queries#R##N#compared to using other pointer analyses that return simpler pointer#R##N#infor- mation. Furthermore, the search space of Boomerang can be#R##N#significantly reduced by requesting calling contexts from the client#R##N#analysis.
['Johannes Späth', 'Lisa Nguyen Quang Do', 'Karim Ali', 'Eric Bodden']
Boomerang: Demand-Driven Flow- and Context-Sensitive Pointer Analysis for Java