Evaluating Design Tradeoffs in Numeric Static Analysis for Java

TL;DR

This paper systematically evaluates 162 configurations of numeric static analysis for Java, revealing that top-down analysis and access paths significantly improve precision and performance in array bounds checking.

Contribution

It introduces a family of abstract interpretation-based analyses for Java and provides a comprehensive evaluation of their design tradeoffs on real-world benchmarks.

Findings

Top-down analysis outperforms bottom-up.

Using access paths improves analysis precision.

Choice of numeric domain has less impact.

Abstract

Numeric static analysis for Java has a broad range of potentially useful applications, including array bounds checking and resource usage estimation. However, designing a scalable numeric static analysis for real-world Java programs presents a multitude of design choices, each of which may interact with others. For example, an analysis could handle method calls via either a top-down or bottom-up interprocedural analysis. Moreover, this choice could interact with how we choose to represent aliasing in the heap and/or whether we use a relational numeric domain, e.g., convex polyhedra. In this paper, we present a family of abstract interpretation-based numeric static analyses for Java and systematically evaluate the impact of 162 analysis configurations on the DaCapo benchmark suite. Our experiment considered the precision and performance of the analyses for discharging array bounds checks. We found that top-down analysis is generally a better choice than bottom-up analysis, and that using access paths to describe heap objects is better than using summary objects corresponding to points-to analysis locations. Moreover, these two choices are the most significant, while choices about the numeric domain, representation of abstract objects, and context-sensitivity make much less difference to the precision/performance tradeoff.