Practical Virtual Method Call Resolution for JavaVijay Sundaresan, Laurie Hendren, Chrislain Razafimahefa, Raja Vall ee-Rai, Patrick Lam, Etienne Gagnon and Charles GodinSable Research Group School of Computer Science McGill University Montreal

The ProblemPolymorphism:What happens atpos = mouse.getXY()?

Motivation

Class Hierarchy AnalysisFor every class or instance d, we haveIf d2 extends d1 or if d2 implements d1For every class or interface dDefined by the following recursion:

Class Hierarchy AnalysisMouse, PS2Mouse, USBMouse, BluetoothMouse, LogitechTrackball, MightyMousehierarchy-typeshierarchy-typesUSBMouse, LogitechTrackball, MightyMouse

Class Hierarchy Analysislook-up(LogitechTrackball.getXY) = USBMouse.getXYlook-up(LogitechTrackball.equals) = object.equals

look-up(PS2Mouse.getXY) = PS2Mouse.getXY

Call GraphC.m1o.m2()D.m2For a receiver o of type d,D.m2 = look-up(d.m2)for all din hierarchy-types(d)where(pessimistic)

Call Graphpublic class C extends A{public static void main(String[] p){A b = new B();A c = new C();b.m();c.m();System.err.println(c.toString());}}C.mainb.m()c.m()c.toString()err.println()

Call GraphA.mB.mC.mObject .toStringPrintStream.println

Rapid Type AnalysisImprovement over Class HierarchyFor a program P Get a more accurate result by only consideringBuild call graph (and P) iteratively

Variable-Type Analysisa receiver o may be of type d at run-time,(where d is a subclass of the declared type of o)Ifthere must be a chain of assignments of the formo = varn = varn1 = = var1 = new d()then

Representative Nodespublic class C extends A{public String m(Object p){f = new C();Object v = p;return v.toString();}private A f;}C.m.pC.fC.m. thisC.m. retC.m.vparameterreceiverreturn valuelocalfield

Anatomy of Assignmentslhs = rhs

}}public class C extends A{public String m(Object p){A u, v, w;Representative Edgesv = p;C.m.vC.m.pthis.f = v;C.fC.m.vw = v.m(u);A.m.pC.m.uA.m .thisC.m.vA.m .retC.m.w

Representative Graphpublic class C extends A{public String m(Object p){f = new C();Object v = p;return v.toString();}private A f;}C.m.pC.fC.m. thisC.m. retC.m.t0Object .toString .thisObject .toString .retC.m.v

Instances

Variable-Type Analysisa receiver o may be of type d at run-time,(where d is a subclass of the declared type of o)Ifthere must be a path in the representative graph from a node n to representative(o) s.t. d in instances(n)then

Variable Type AnalysisImproving PerformanceC.m.pC.fC.m. thisC.m. retC.m.t0Object .toString .thisObject .toString .retC.m.v{B}{C}{S}

Variable Type AnalysisImproving PerformanceC.m.pC.fC.m. thisC.m. retC.m.t0Object .toString .thisObject .toString .retC.m.v{B}{C}{S}

Variable Type AnalysisImproving PerformanceC.m.pC.fC.m. thisC.m. retC.m.t0Object .toString .thisObject .toString .retC.m.v{B}{B,C}{S}{B,C}{S}

Declared-Type AnalysisAll variables of the same declared type are summarized as a single nodeCoarser-grainNot as accurate as variable-type, but still more accurate than class hierarchy and rapid typeFaster and requires much less space

Experimental ResultsDetection of monomorphic call sites