[Paper Review] Structural Analysis: Shape Information via Points-To Computation

Mark Marron|arXiv (Cornell University)|Jan 5, 2012

Logic, programming, and type systems35 references3 citations

TL;DR

This paper introduces Structural Analysis, a hybrid heap analysis that combines shape analysis's expressive power with points-to analysis's efficiency by using a set-based, weak-updating transfer function and a normal form based on empirical heap structures. It achieves high precision and scalability, analyzing large .NET programs (over 30K bytecodes) in under 65 seconds with under 130 MB memory.

ABSTRACT

This paper introduces a new hybrid memory analysis, Structural Analysis, which combines an expressive shape analysis style abstract domain with efficient and simple points-to style transfer functions. Using data from empirical studies on the runtime heap structures and the programmatic idioms used in modern object-oriented languages we construct a heap analysis with the following characteristics: (1) it can express a rich set of structural, shape, and sharing properties which are not provided by a classic points-to analysis and that are useful for optimization and error detection applications (2) it uses efficient, weakly-updating, set-based transfer functions which enable the analysis to be more robust and scalable than a shape analysis and (3) it can be used as the basis for a scalable interprocedural analysis that produces precise results in practice. The analysis has been implemented for .Net bytecode and using this implementation we evaluate both the runtime cost and the precision of the results on a number of well known benchmarks and real world programs. Our experimental evaluations show that the domain defined in this paper is capable of precisely expressing the majority of the connectivity, shape, and sharing properties that occur in practice and, despite the use of weak updates, the static analysis is able to precisely approximate the ideal results. The analysis is capable of analyzing large real-world programs (over 30K bytecodes) in less than 65 seconds and using less than 130MB of memory. In summary this work presents a new type of memory analysis that advances the state of the art with respect to expressive power, precision, and scalability and represents a new area of study on the relationships between and combination of concepts from shape and points-to analyses.

Motivation & Objective

• To address the scalability-precision trade-off in heap analysis by combining expressive shape analysis with efficient points-to style transfer functions.
• To leverage empirical insights into modern object-oriented programs' heap structures—such as mostly-functional behavior and use of standard containers—to guide analysis design.
• To develop a hybrid analysis that maintains precision despite using weak updates, avoiding the complexity of strong updates and materialization.
• To enable scalable, interprocedural analysis of real-world programs with complex data structures, recursion, and dynamic dispatch.
• To demonstrate that weak-updating, set-based transfer functions can achieve precise results for common shape, sharing, and connectivity properties in practice.

Proposed method

• The abstract heap domain is based on a storage shape graph enriched with data structure shape and sharing (injectivity) information.
• A normal form is computed via congruence closure in O((N+E) log N) time, using equivalence relations derived from empirical heap patterns.
• Allocation creates fresh nodes, which are then grouped into structures via connectivity and equivalence relations.
• Transfer functions use set operations and weak updates, simulating program statements efficiently without materialization or case splitting.
• A context-sensitive interprocedural analysis merges local shape graphs via cloning and merging, preserving precision.
• The analysis is flow-insensitive locally but context-sensitive globally, enabling scalability and precision.

Experimental results

Research questions

• RQ1 Can a hybrid heap analysis achieve high precision using only weak-updating, set-based transfer functions instead of complex shape analysis operations?
• RQ2 To what extent do empirical characteristics of modern object-oriented heap structures—like mostly-functional behavior and use of standard containers—enable simpler, scalable analysis?
• RQ3 Does the use of weak updates in a shape-style domain lead to significant precision loss in practice, or can it be mitigated by structural normal forms and disjointness properties?
• RQ4 Can such a hybrid analysis scale to large, real-world programs with complex data structures, recursion, and dynamic dispatch?
• RQ5 Is it possible to achieve precise tracking of shape, connectivity, and sharing without strong updates or materialization?

Key findings

• The analysis precisely captures the majority of connectivity, shape, and sharing properties found in real-world object-oriented programs.
• Despite using weak updates, the analysis achieves precision close to ideal results, with minimal imprecision due to strong disjointness and isolation in the domain.
• The implementation analyzes large .NET programs (over 30,000 bytecodes) in less than 65 seconds using under 130 MB of memory.
• The normal form based on empirical heap patterns enables fast convergence and reduces irrelevant detail without sacrificing key structural information.
• The approach outperforms existing shape analyses in scalability, especially for programs with recursion and complex data structures.
• The method successfully handles dynamic dispatch and recursive traversals, which are challenging for many prior approaches.