Boomerang: Demand-driven flow- and context-sensitive pointer analysis for Java

Johannes Späth, Lisa Nguyen Quang Do, Karim Ali, Eric Bodden

Research output: Chapter in Book/Report/Conference proceedingConference contribution


Many current program analyses require highly precise pointer information about small, targeted parts of a given program. This motivates the need for demand-driven pointer analyses that compute information only where required. Pointer analyses generally compute points-to sets of program variables or answer boolean alias queries. However, many client analyses require richer pointer information. For example, taint and typestate analyses often need to know the set of all aliases of a given variable under a certain calling context. With most current pointer analyses clients must compute such information through repeated points-to or alias queries, increasing complexity and computation time for them. This paper presents Boomerang, a demand-driven, flow-, field-, and context-sensitive pointer analysis for Java programs. Boomerang computes rich results that include both the possible allocation sites of a given pointer (points-to information) and all pointers that can point to those allocation sites (alias information). For increased precision and scalability, clients can query Boomerang with respect to particular calling contexts of interest. Our experiments show that Boomerang is more precise than existing demand-driven pointer analyses. Additionally, using Boomerang, the taint analysis Flow Droid issues up to 29.4x fewer pointer queries compared to using other pointer analyses that return simpler pointer information. Furthermore, the search space of Boomerang can be significantly reduced by requesting calling contexts from the client analysis.

Original languageEnglish (US)
Title of host publication30th European Conference on Object-Oriented Programming, ECOOP 2016
EditorsBenjamin S. Lerner, Shriram Krishnamurthi
PublisherSchloss Dagstuhl- Leibniz-Zentrum fur Informatik GmbH, Dagstuhl Publishing
Number of pages2006
ISBN (Electronic)9783959770149
StatePublished - Jul 1 2016
Event30th European Conference on Object-Oriented Programming, ECOOP 2016 - Rome, Italy
Duration: Jul 18 2016Jul 22 2016

Publication series

NameLeibniz International Proceedings in Informatics, LIPIcs
ISSN (Print)1868-8969


Conference30th European Conference on Object-Oriented Programming, ECOOP 2016


  • Aliasing
  • Demand-driven
  • IFDS
  • Points-to analysis
  • Static analysis

ASJC Scopus subject areas

  • Software


Dive into the research topics of 'Boomerang: Demand-driven flow- and context-sensitive pointer analysis for Java'. Together they form a unique fingerprint.

Cite this