Return of CFA: Call-Site Sensitivity Can Be Superior to Object Sensitivity Even
summary
Paper claims call-site sensitivity with context tunneling can be strictly more precise and more scalable than object sensitivity, and demonstrates a toolchain that transforms object-sensitive analyses into call-site-sensitive ones. Implementation Obj2CFA runs on the Doop pointer-analysis framework for Java, uses a simulation step plus an offline learning step (about two days, excluded from timing), and shows 1-call-site vs 3-object-sensitive precision wins and better scalability (e.g., handles large benchmarks where prior Doop call-site runs failed).
AI-written summary · about
chapters (5)
- 0:00Start
- 8:38Our Technique : Obj2CFA . Obj2CFA consists of simulation and simulation-guided learning
- 11:02Intuition Behind Simulation (IUI)
- 15:54Call-site Sensitivity vs Object Sensitivity . I callH+SL Cours is more precisend scalable than the existing object sensitivities
- 17:44Summary
related talks
15mTowards a Theoretically-Backed and Practical Framework for Selective Object-Sensitive(…)
18mA Cocktail Approach to Practical Call Graph Construction
11mCG-Bench: Can Language Models Assist Call Graph Construction in the Real World?
36mSpecification-Guided Component-Based Synthesis from Effectful Libraries
56mPath Tracing Three Ways: A Study of C++ Style
50mMeasuring Adversary Costs to Exploit Commercial Software...
24mWhen to Stop Going Down the Rabbit Hole: Taming Context-Sensitivity on the Fly
24mMoonShine: Optimizing OS Fuzzer Seed Selection with Trace Distillation