• Intraprocedural data flow analysis
  • PDF, PPSX (with animation)
• Interprocedural analysis techniques
  • Overview:
    • PDF, PPSX (with animations)
  • Control-flow analysis:
    • see above
  • Data-flow (Points-to) analysis:
    • Field-sensitive: PDF, PPSX (with animation)
    • Context-sensitive: PDF, PPSX (with animations)
    • On-the-fly: PDF, PPSX (with animations) ← file damaged, to be recovered, Original Publication by Sridharan and his PhD thesis

The first two variants of points-to-analysis (PTA) are “just” increasingly precise versions of PTA. The last one (on-the-fly) is both, more precise and more efficient because it only explores parts of the program “on demand” and continues only if the result is not found to be sufficiently precise yet.

• Java Language Specification 5 / 6: HTML, PDF

To analyse Java we need a good understanding of the “anatomy” of the language. Seminar topics could be its type system, concurrency, etc. Basically everything that is necessary to fully understand the FindBugs bug specifications (which are often very brief and assume very detailed knowledge of the language specification).

Currently, there exists a Prolog-based implementation of

• a simple call graph (based on static type information, not on PTA) and
• a simple, field-sensitive PTA

created in another lab. In this prototype, the call graph is created upfront based on “worst case” assumpitons (just the static type information. Then the PTA is performed on the worst-case call graph.

In our lab, a team of 3-4 people would work on improving it by

• eliminating the time-consuming normalization step that is performed prior to both analyses
• connecting the existing field-sensitive PTA and call graph creation, so that they

mutually use each other. This would probably integrate some “on-the-fly” ideas.

• If you are very prodictive, you could then venture on refining the integrated

approach to include context-sensitivity.

In the seminar, this team would start by giving talks on

• field-sensitive
• context-sensitive and
• on-the-fly analysis

as introduced above.