Low-level program analysis is a fundamental problem, taking the shape of "flow analysis" in functional languages and "points-to" analysis in imperative and object-oriented languages. Despite the similarities, the vocabulary and results in the two communities remain largely distinct, with limited cross-understanding. One of the few links is Shivers's k-CFA work, which has advanced the concept of "context-sensitive analysis" and is widely known in both communities. Recent results indicate that the relationship between the functional and object-oriented incarnations of k-CFA is not as well understood as thought. Van Horn and Mairson proved k-CFA for k ≥ 1 to be EXPTIME-complete; hence, no polynomial-time algorithm can exist. Yet, there are several polynomial-time formulations of context-sensitive points-to analyses in object-oriented languages. Thus, it seems that functional k-CFA may actually be a profoundly different analysis from object-oriented k-CFA. We resolve this paradox by showing that the exact same specification of k-CFA is polynomial-time for object-oriented languages yet exponentialtime for functional ones: objects and closures are subtly different, in a way that interacts crucially with context-sensitivity and complexity. This illumination leads to an immediate payoff: by projecting the object-oriented treatment of objects onto closures, we derive a polynomial-time hierarchy of context-sensitive CFAs for functional programs. 1 Although the k-CFA work is often used as a synonym for "k-contextsensitive" in the OO world, k-CFA is more correctly an algorithm that packages context-sensitivity together with several other design decisions. In the terminology of OO points-to analysis, k-CFA is a k-call-site-sensitive, field-sensitive points-to analysis algorithm with a context-sensitive heap and with on-the-fly call-graph construction. (Lhoták [9] and Lhoták and Hendren [10] are good references for the classification of points-to analysis algorithms.) In this paper we use the term "k-CFA" with this more precise meaning, as is common in the functional programming world, and not just as a synonym for "k-context-sensitive". Although this classification is more precise, it still allows for a range of algorithms, as we discuss later.
Work by Might, Smaragdakis and Van Horn REF discusses the relationship between static analysis of higher-order functions and objects.
Resolving and exploiting the k-CFA paradox: illuminating functional vs. object-oriented program analysis
PLDI '10
Computer Science