From the Escape Property to Escape Analysis

operations for its analysis. We show that the analysis induced by E is very imprecise. Hence, in Section 5 we refine the domain E into the more precise domain ER for escape analysis. In Section 6, we discuss our prototype implementation and experimental results. Section 7 concludes the paper by highlighting the differences between previous proposals and our own approach. Section 8 contains the proofs not inlined in the main part of the paper. Preliminary and partial versions of this paper appeared in [Hill and Spoto 2002a] and [Hill and Spoto 2002b]. 2. PRELIMINARIES A total (partial) function f is denoted by 7→ (→). The domain (codomain) of f is dom(f) (rng(f)). We denote by [v1 7→ t1, . . . , vn 7→ tn] the function f where dom(f) = {v1, . . . , vn} and f(vi) = ti for i = 1, . . . , n. Its update is f [w1 7→ d1, . . . , wm 7→ dm], where the domain may be enlarged. By f |s (f |−s) we denote the restriction of f to s ⊆ dom(f) (to dom(f) \ s). If f(x) = x then x is a fixpoint of f . The set of fixpoints of f is denoted by fp(f). The two components of a pair are separated by ⋆. A definition of S such as S = a ⋆ b, with a and b meta-variables, silently defines the pair selectors s.a and s.b for s ∈ S. An element x will often stand for the singleton set {x}, like l in l in the definition of put field (Figure 7). A complete lattice is a poset C ⋆≤ where least upper bounds (lub) and greatest lower bounds (glb) always exist. If C ⋆≤ and A ⋆ are posets, then f : C 7→ A is (co-)additive if it preserves lub’s (glb’s). A map f : A 7→ A is a lower closure operator (lco) if it is monotonic, reductive and idempotent. We recall now the basics of abstract interpretation (AI) [Cousot and Cousot 1977]. Let C ⋆≤ and A ⋆ be two posets (the concrete and the abstract domain). A Galois connection is a pair of monotonic maps α : C 7→ A and γ : A 7→ C such that γα is extensive and αγ is reductive. It is a Galois insertion when αγ is the identity map i.e., when the abstract domain does not contain useless elements. This is equivalent to α being onto, or γ one-to-one. If C and A are complete lattices and α is additive, it is the abstraction map of a Galois connection. An abstract operator f̂ : A → A is correct w.r.t. f : C → C if αfγ f̂ . For each operator f , there exists an optimal (most precise) correct abstract operator f̂ defined as f̂ = αfγ. The semantics of a program is the fixpoint of a map f : C 7→ C , where C is the computational domain. Its collecting version [Cousot and Cousot 1977] works over properties of C i.e., over ℘(C ) and is the fixpoint of the powerset extension of f . If f is defined through suboperations, their powerset extensions and ∪ (which merges the semantics of the branches of a conditional) induce the extension of f . 3. THE FRAMEWORK OF ANALYSIS We build on the watchpoint semantics [Spoto 2001; Spoto and Jensen 2003] which allows us to derive a compositional and focused analyser from a specification of a domain of abstract states and operations which work over them. Then problems such as scoping, recursion and name clash can be ignored, since these are already solved by the watchpoint semantics. Moreover, this framework relates the precision of the analysis to that of its abstract domain so that traditional techniques for comparing the precision of abstract domains can be applied [Cortesi et al. 1998; ACM Transactions on Programming Languages and Systems, Vol. TBD, No. TDB, Month Year.