Document Open Access Logo

Beyond k-Limiting: Pointer-Flow-Guided Context Sensitivity for Scalable and Precise Rust Pointer Analysis

Authors Wenyao Chen , Wei Li , Jingling Xue

PDF

File

Thumbnail PDF
PDF
LIPIcs.ECOOP.2026.1.pdf
  • Filesize: 1.42 MB
  • 30 pages

Document Identifiers

Subject Classification

ACM Subject Classification
  • Theory of computation → Program analysis
Keywords
  • Pointer Analysis
  • Context Sensitivity
  • Rust

Metrics

Abstract

Pointer analysis for Rust faces unique challenges arising from its ownership-based memory model and layered abstractions, which complicate how heap-allocated objects flow across functions. Existing k-limited callsite abstractions - designed for earlier languages - are both imprecise and inefficient on large Rust programs. We present Rceus, a Rust-oriented pointer-analysis technique that mitigates points-to set explosion and resource exhaustion caused by cross-function pointer conflation under deep heap encapsulation, a scalability bottleneck that conventional k-limiting cannot address.
Rceus performs a fast, coarse-grained pointer-flow pre-analysis to identify precision-critical functions and the essential callsites within their calling contexts. This selective context construction distinguishes parameter-derived flows while avoiding unnecessary expansion. As a result, Rceus cleanly partitions intertwined pointer flows, eliminating context explosion and improving both scalability and precision.
On 16 real-world Rust applications, Rceus outperforms state-of-the-art techniques - standard k-limiting, selective k-limiting for Java, and stack-filtered k-limiting for Rust - in both precision and efficiency. The evaluation includes Wasmtime, a WebAssembly runtime with 669K lines of code, where the benefits increase with program size. Rceus also composes with existing techniques, providing a practical and extensible foundation for scalable, precise Rust pointer analysis.

Cite As Get BibTex

Wenyao Chen, Wei Li, and Jingling Xue. Beyond k-Limiting: Pointer-Flow-Guided Context Sensitivity for Scalable and Precise Rust Pointer Analysis. In 40th European Conference on Object-Oriented Programming (ECOOP 2026). Leibniz International Proceedings in Informatics (LIPIcs), Volume 372, pp. 1:1-1:30, Schloss Dagstuhl – Leibniz-Zentrum für Informatik (2026) https://doi.org/10.4230/LIPIcs.ECOOP.2026.1

Author Details

Wenyao Chen
  • UNSW Sydney, Australia
Wei Li
  • UNSW Sydney, Australia
Jingling Xue
  • UNSW Sydney, Australia

Funding

Australian Research Council Grants No. DP240103194.

Acknowledgements

We thank the reviewers for their valuable and constructive feedback.

Supplementary Materials

References

  1. David F. Bacon and Peter F. Sweeney. Fast static analysis of c++ virtual function calls. In Proceedings of the 11th ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications, OOPSLA '96, pages 324-341, New York, NY, USA, 1996. Association for Computing Machinery. URL: https://doi.org/10.1145/236337.236371.
  2. Yechan Bae, Youngsuk Kim, Ammar Askar, Jungwon Lim, and Taesoo Kim. Rudra: Finding memory safety bugs in Rust at the ecosystem scale. In Proceedings of the ACM SIGOPS 28th Symposium on Operating Systems Principles, SOSP '21, pages 84-99, New York, NY, USA, 2021. Association for Computing Machinery. URL: https://doi.org/10.1145/3477132.3483570.
  3. Inyoung Bang, Martin Kayondo, HyunGon Moon, and Yunheung Paek. TRust: A compilation framework for in-process isolation to protect safe rust against untrusted code. In 32nd USENIX Security Symposium (USENIX Security 23), pages 6947-6964, Anaheim, CA, August 2023. USENIX Association. URL: https://www.usenix.org/conference/usenixsecurity23/presentation/bang.
  4. Hung-Mao Chen, Z. Morley Mao, Yuan-Hong Wu, and Kuan-Yu Chen. TYPEPULSE: Detecting type confusion bugs in Rust programs. In Proceedings of the USENIX Security Symposium. USENIX Association, 2025. URL: https://www.usenix.org/conference/usenixsecurity25/presentation/chen-hung-mao.
  5. Mohan Cui, Chengjun Chen, Hui Xu, and Yangfan Zhou. SafeDrop: Detecting memory deallocation bugs of Rust programs via static data-flow analysis. ACM Transactions on Software Engineering and Methodology, 32(4):1-21, 2023. URL: https://doi.org/10.1145/3542948.
  6. Lennard Gäher, Michael Sammler, Ralf Jung, Robbert Krebbers, and Derek Dreyer. RefinedRust: A type system for high-assurance verification of Rust programs. Proc. ACM Program. Lang., 8(PLDI), June 2024. URL: https://doi.org/10.1145/3656422.
  7. Ben Hardekopf and Calvin Lin. Flow-sensitive pointer analysis for millions of lines of code. In Proceedings of the 9th Annual IEEE/ACM International Symposium on Code Generation and Optimization, CGO '11, pages 289-298, USA, 2011. IEEE Computer Society. URL: https://doi.org/10.1109/CGO.2011.5764696.
  8. Dongjie He, Yujiang Gui, Wei Li, Yonggang Tao, Changwei Zou, Yulei Sui, and Jingling Xue. A container-usage-pattern-based context debloating approach for object-sensitive pointer analysis. Proc. ACM Program. Lang., 7(OOPSLA2), 2023. URL: https://doi.org/10.1145/3622832.
  9. Dongjie He, Jingbo Lu, and Jingling Xue. Qilin: A New Framework For Supporting Fine-Grained Context-Sensitivity in Java Pointer Analysis. In Karim Ali and Jan Vitek, editors, 36th European Conference on Object-Oriented Programming (ECOOP 2022), volume 222, pages 30:1-30:29, Dagstuhl, Germany, 2022. URL: https://doi.org/10.4230/LIPIcs.ECOOP.2022.30.
  10. Minseok Jeon, Sehun Jeong, and Hakjoo Oh. Precise and scalable points-to analysis via data-driven context tunneling. Proc. ACM Program. Lang., 2(OOPSLA), October 2018. URL: https://doi.org/10.1145/3276510.
  11. Minseok Jeon, Myungho Lee, and Hakjoo Oh. Learning graph-based heuristics for pointer analysis without handcrafting application-specific features. Proc. ACM Program. Lang., 4(OOPSLA), November 2020. URL: https://doi.org/10.1145/3428247.
  12. Minseok Jeon and Hakjoo Oh. Return of cfa: call-site sensitivity can be superior to object sensitivity even for object-oriented programs. Proc. ACM Program. Lang., 6(POPL), January 2022. URL: https://doi.org/10.1145/3498720.
  13. Sehun Jeong, Minseok Jeon, Sungdeok Cha, and Hakjoo Oh. Data-driven context-sensitivity for points-to analysis. Proceedings of the ACM on Programming Languages, 1(OOPSLA):1-28, 2017. URL: https://doi.org/10.1145/3133924.
  14. Ralf Jung, Jacques-Henri Jourdan, Robbert Krebbers, and Derek Dreyer. RustBelt: securing the foundations of the Rust programming language. Proc. ACM Program. Lang., 2(POPL), December 2017. URL: https://doi.org/10.1145/3158154.
  15. Martin Kayondo, Inyoung Bang, Yeongjun Kwak, HyunGon Moon, and Yunheung Paek. MetaSafe: Compiling for protecting smart pointer metadata to ensure safe Rust integrity. In 33rd USENIX Security Symposium (USENIX Security 24), pages 3711-3728, Philadelphia, PA, August 2024. USENIX Association. URL: https://www.usenix.org/conference/usenixsecurity24/presentation/kayondo.
  16. David Kozak, Codrut Stancu, Tomáš Vojnar, and Christian Wimmer. Skipflow: Improving the precision of points-to analysis using primitive values and predicate edges. In Proceedings of the 23rd ACM/IEEE International Symposium on Code Generation and Optimization, CGO '25, pages 347-361, New York, NY, USA, 2025. Association for Computing Machinery. URL: https://doi.org/10.1145/3696443.3708932.
  17. Wei Li, Wenyao Chen, and Jingling Xue. From raw pointers to memory safety: A modular demand-driven typestate analysis for rust. Proc. ACM Program. Lang., 10(OOPSLA1), 2026. URL: https://doi.org/10.1145/3798266.
  18. Wei Li, Dongjie He, Wenguang Chen, and Jingling Xue. Stack Filtering: Elevating precision and efficiency in Rust pointer analysis. In Proceedings of the 23rd ACM/IEEE International Symposium on Code Generation and Optimization, CGO '25, pages 331-346, New York, NY, USA, 2025. Association for Computing Machinery. URL: https://doi.org/10.1145/3696443.3708921.
  19. Wei Li, Dongjie He, Yujiang Gui, Wenguang Chen, and Jingling Xue. A context-sensitive pointer analysis framework for Rust and its application to call graph construction. In Proceedings of the 33rd ACM SIGPLAN International Conference on Compiler Construction, CC 2024, pages 60-72, New York, NY, USA, 2024. Association for Computing Machinery. URL: https://doi.org/10.1145/3640537.3641574.
  20. Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. Precision-guided context sensitivity for pointer analysis. Proc. ACM Program. Lang., 2(OOPSLA), October 2018. URL: https://doi.org/10.1145/3276511.
  21. Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. Scalability-first pointer analysis with self-tuning context-sensitivity. In Proceedings of the 2018 26th ACM joint meeting on european software engineering conference and symposium on the foundations of software engineering, pages 129-140, 2018. URL: https://doi.org/10.1145/3236024.3236041.
  22. Yue Li, Tian Tan, Anders Møller, and Yannis Smaragdakis. A principled approach to selective context sensitivity for pointer analysis. ACM Trans. Program. Lang. Syst., 42(2), May 2020. URL: https://doi.org/10.1145/3381915.
  23. Zhuohua Li, Jincheng Wang, Mingshen Sun, and John C.S. Lui. MirChecker: Detecting bugs in Rust programs via static analysis. In Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, CCS '21, pages 2183-2196, New York, NY, USA, 2021. Association for Computing Machinery. URL: https://doi.org/10.1145/3460120.3484541.
  24. Peiming Liu, Gang Zhao, and Jeff Huang. Securing unsafe Rust programs with XRust. In Proceedings of the ACM/IEEE 42nd International Conference on Software Engineering, ICSE '20, pages 234-245, New York, NY, USA, 2020. Association for Computing Machinery. URL: https://doi.org/10.1145/3377811.3380325.
  25. Jingbo Lu and Jingling Xue. Precision-preserving yet fast object-sensitive pointer analysis with partial context sensitivity. Proc. ACM Program. Lang., 3(OOPSLA), October 2019. URL: https://doi.org/10.1145/3360574.
  26. Wenjie Ma, Shengyuan Yang, Tian Tan, Xiaoxing Ma, Chang Xu, and Yue Li. Context sensitivity without contexts: A cut-shortcut approach to fast and precise pointer analysis. Proceedings of the ACM on Programming Languages, 7(PLDI):539-564, 2023. URL: https://doi.org/10.1145/3591242.
  27. Yusuke Matsushita, Xavier Denis, Jacques-Henri Jourdan, and Derek Dreyer. Rusthornbelt: a semantic foundation for functional verification of Rust programs with unsafe code. In PLDI '22: 43rd ACM SIGPLAN International Conference on Programming Language Design and Implementation, San Diego, CA, USA, June 13 - 17, 2022, PLDI 2022, pages 841-856, New York, NY, USA, 2022. Association for Computing Machinery. URL: https://doi.org/10.1145/3519939.3523704.
  28. Yusuke Matsushita, Takeshi Tsukada, and Naoki Kobayashi. Rusthorn: Chc-based verification for Rust programs. ACM Trans. Program. Lang. Syst., 43(4):1-54, 2021. URL: https://doi.org/10.1145/3462205.
  29. Ana Milanova, Atanas Rountev, and Barbara G Ryder. Parameterized object sensitivity for points-to and side-effect analyses for Java. In Proceedings of the 2002 ACM SIGSOFT international symposium on Software testing and analysis, pages 1-11, 2002. URL: https://doi.org/10.1145/566172.566174.
  30. Jiun Min, Dongyeon Yu, Seongyun Jeong, Dokyung Song, and Yuseok Jeon. ERASan: Efficient Rust address sanitizer. In 2024 IEEE Symposium on Security and Privacy (SP), pages 4053-4068, 2024. URL: https://doi.org/10.1109/SP54263.2024.00258.
  31. M Pnueli and Micha Sharir. Two approaches to interprocedural data flow analysis. Program flow analysis: theory and applications, pages 189-234, 1981. Google Scholar
  32. Boqin Qin, Yilun Chen, Zeming Yu, Linhai Song, and Yiying Zhang. Understanding memory and thread safety practices and issues in real-world rust programs. In Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation, pages 763-779, 2020. URL: https://doi.org/10.1145/3385412.3386036.
  33. Olivier Sallenave and Roland Ducournau. Lightweight generics in embedded systems through static analysis. ACM SIGPLAN Notices, 47(5):11-20, 2012. URL: https://doi.org/10.1145/2248418.2248421.
  34. Qingkai Shi, Xiao Xiao, Rongxin Wu, Jinguo Zhou, Gang Fan, and Charles Zhang. Pinpoint: fast and precise sparse value flow analysis for million lines of code. In Proceedings of the 39th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2018, pages 693-706, New York, NY, USA, 2018. Association for Computing Machinery. URL: https://doi.org/10.1145/3192366.3192418.
  35. Yannis Smaragdakis, Martin Bravenboer, and Ondrej Lhoták. Pick your contexts well: understanding object-sensitivity. In Proceedings of the 38th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL '11, pages 17-30, New York, NY, USA, 2011. Association for Computing Machinery. URL: https://doi.org/10.1145/1926385.1926390.
  36. Yannis Smaragdakis, George Kastrinis, and George Balatsouras. Introspective analysis: context-sensitivity, across the board. In Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI '14, pages 485-495, New York, NY, USA, 2014. Association for Computing Machinery. URL: https://doi.org/10.1145/2594291.2594320.
  37. Yulei Sui and Jingling Xue. SVF: interprocedural static value-flow analysis in LLVM. In Proceedings of the 25th International Conference on Compiler Construction, CC '16, pages 265-266, New York, NY, USA, 2016. Association for Computing Machinery. URL: https://doi.org/10.1145/2892208.2892235.
  38. Yulei Sui, Ding Ye, and Jingling Xue. Static memory leak detection using full-sparse value-flow analysis. In Proceedings of the 2012 International Symposium on Software Testing and Analysis, ISSTA 2012, pages 254-264, New York, NY, USA, 2012. Association for Computing Machinery. URL: https://doi.org/10.1145/2338965.2336784.
  39. Vijay Sundaresan, Laurie Hendren, Chrislain Razafimahefa, Raja Vallée-Rai, Patrick Lam, Etienne Gagnon, and Charles Godin. Practical virtual method call resolution for java. ACM SIGPLAN Notices, 35(10):264-280, 2000. URL: https://doi.org/10.1145/353171.353189.
  40. Tian Tan, Yue Li, Xiaoxing Ma, Chang Xu, and Yannis Smaragdakis. Making pointer analysis more precise by unleashing the power of selective context sensitivity. Proc. ACM Program. Lang., 5(OOPSLA), October 2021. URL: https://doi.org/10.1145/3485524.
  41. Tian Tan, Yue Li, and Jingling Xue. Making k-object-sensitive pointer analysis more precise with still k-limiting. In International Static Analysis Symposium, pages 489-510. Springer, 2016. URL: https://doi.org/10.1007/978-3-662-53413-7_24.
  42. The Rust Project Developers. The Rust programming language, trait objects, 2024. URL: https://doc.rust-lang.org/1.30.0/book/first-edition/trait-objects.html.
  43. The Rust Project Developers. The Rust programming language, 2025. URL: https://www.rust-lang.org/.
  44. The Rust Project Developers. The Rust reference, dispatch, 2025. URL: https://doc.rust-lang.org/beta/reference/glossary.html#dispatch.
  45. Rei Thiessen and Ondřej Lhoták. Context transformations for pointer analysis. SIGPLAN Not., 52(6):263-277, June 2017. URL: https://doi.org/10.1145/3140587.3062359.
  46. Frank Tip and Jens Palsberg. Scalable propagation-based call graph construction algorithms. In Proceedings of the 15th ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, pages 281-293, 2000. URL: https://doi.org/10.1145/353171.353190.
  47. John Whaley and Monica S. Lam. Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. In Proceedings of the ACM SIGPLAN 2004 Conference on Programming Language Design and Implementation, PLDI '04, pages 131-144, New York, NY, USA, 2004. Association for Computing Machinery. URL: https://doi.org/10.1145/996841.996859.
  48. Christian Wimmer, Codrut Stancu, David Kozak, and Thomas Würthinger. Scaling type-based points-to analysis with saturation. Proc. ACM Program. Lang., 8(PLDI):990-1013, June 2024. URL: https://doi.org/10.1145/3656417.
Any Issues?
X

Feedback on the Current Page

CAPTCHA

Thanks for your feedback!

Feedback submitted to Dagstuhl Publishing

Could not send message

Please try again later or send an E-mail
© 2023-2026 Schloss Dagstuhl – LZI GmbH Schloss Dagstuhl – LZI GmbH About DROPS Imprint Privacy Contact