2026-09-29T22:40:18Z https://drops.dagstuhl.de/oai

oai:drops-oai.dagstuhl.de:6116 2026-09-22T21:59:22Z ddc:004 open_access

Boomerang: Demand-Driven Flow- and Context-Sensitive Pointer Analysis for Java Späth, Johannes Nguyen Quang Do, Lisa Ali, Karim Bodden, Eric Demand-Driven; Static Analysis; IFDS; Aliasing; Points-to Analysis Many current program analyses require highly precise pointer information about small, tar- geted parts of a given program. This motivates the need for demand-driven pointer analyses that compute information only where required. Pointer analyses generally compute points-to sets of program variables or answer boolean alias queries. However, many client analyses require richer pointer information. For example, taint and typestate analyses often need to know the set of all aliases of a given variable under a certain calling context. With most current pointer analyses, clients must compute such information through repeated points-to or alias queries, increasing complexity and computation time for them. This paper presents Boomerang, a demand-driven, flow-, field-, and context-sensitive pointer analysis for Java programs. Boomerang computes rich results that include both the possible allocation sites of a given pointer (points-to information) and all pointers that can point to those allocation sites (alias information). For increased precision and scalability, clients can query Boomerang with respect to particular calling contexts of interest. Our experiments show that Boomerang is more precise than existing demand-driven pointer analyses. Additionally, using Boomerang, the taint analysis FlowDroid issues up to 29.4x fewer pointer queries compared to using other pointer analyses that return simpler pointer infor- mation. Furthermore, the search space of Boomerang can be significantly reduced by requesting calling contexts from the client analysis. Schloss Dagstuhl – Leibniz-Zentrum für Informatik Johannes Späth and Lisa Nguyen Quang Do and Karim Ali and Eric Bodden 2016 Is Part Of LIPIcs, Volume 56, 30th European Conference on Object-Oriented Programming (ECOOP 2016) InProceedings Text doc-type:ResearchArticle publishedVersion application/pdf doi:10.4230/LIPIcs.ECOOP.2016.22 urn:nbn:de:0030-drops-61164 https://drops.dagstuhl.de/entities/document/10.4230/LIPIcs.ECOOP.2016.22 eng https://creativecommons.org/licenses/by/3.0/legalcode