Abstractions from Tests

In this talk, I will present a framework for leveraging dynamic
analysis to find good abstractions for static analysis.  A static analysis
in our framework is parametrised.  Our main insight is to directly and
efficiently compute from a concrete trace, a necessary condition on the
parameter configurations to prove a given query, and thereby prune the
space of parameter configurations that the static analysis must consider.
Following this framework, we have developed two cost-effective static
analyses: a flow- and context-sensitive thread-escape analysis and
a flow- and context-insensitive points-to analysis. In the talk,
I will use the former analysis as a running example, and explain the
key ideas of our framework concretely. I will also comment on
the results of running this analysis on six Java programs
comprising two million bytecodes.