{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,26]],"date-time":"2026-09-26T11:58:55Z","timestamp":1790423935894,"version":"4.1.0"},"reference-count":72,"publisher":"Association for Computing Machinery (ACM)","issue":"OOPSLA1","license":[{"start":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T00:00:00Z","timestamp":1775779200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/legalcode"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Program. Lang."],"published-print":{"date-parts":[[2026,4,10]]},"abstract":"<jats:p>\n                    Sparse Value-Flow Analysis (SVFA) is essential for detecting software bugs such as null pointer dereference and memory leak. However, SVFA heavily relies on path-sensitive pointer analysis, which faces significant scalability challenges when analyzing industrial-scale projects, notably the summary-explosion problem. To address this issue, we propose\n                    <jats:sc>Hermes<\/jats:sc>\n                    , which symbolizes memory side effects and constructs an incomplete Sparse Value-Flow Graph (SVFG) called Lazy Symbolic Expression Graph (LSEG). Leveraging this structure,\n                    <jats:sc>Hermes<\/jats:sc>\n                    builds inter-procedural value flows relevant to bug detection only when necessary, significantly reducing the overhead of pointer analysis and streamlining the bug-search paths. Evaluations on large-scale real-world projects demonstrate that, compared to the state-of-the-art,\n                    <jats:sc>Hermes<\/jats:sc>\n                    achieves average speedups of at least 9.84\u00d7 and 9.84\u00d7 for pointer analysis and bug search, respectively, without sacrificing the effectiveness of bug detection.\n                  <\/jats:p>","DOI":"10.1145\/3798211","type":"journal-article","created":{"date-parts":[[2026,4,10]],"date-time":"2026-04-10T14:33:43Z","timestamp":1775831623000},"page":"314-342","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":0,"title":["Hermes: Making Path-Sensitive Pointer Analysis Scalable for Sparse Value-Flow Analysis"],"prefix":"10.1145","volume":"10","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-7260-141X","authenticated-orcid":false,"given":"Yuxuan","family":"He","sequence":"first","affiliation":[{"name":"Xiamen University, School of Informatics, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0002-5018-4277","authenticated-orcid":false,"given":"Ruilin","family":"Jiang","sequence":"additional","affiliation":[{"name":"Xiamen University, School of Informatics, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-1830-9205","authenticated-orcid":false,"given":"He","family":"Zhang","sequence":"additional","affiliation":[{"name":"Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8297-8998","authenticated-orcid":false,"given":"Qingkai","family":"Shi","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-1778-3721","authenticated-orcid":false,"given":"Huaxun","family":"Huang","sequence":"additional","affiliation":[{"name":"Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4648-3795","authenticated-orcid":false,"given":"Rongxin","family":"Wu","sequence":"additional","affiliation":[{"name":"Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,4,10]]},"reference":[{"key":"e_1_3_1_2_2","doi-asserted-by":"publisher","unstructured":"Domagoj Babic and Alan J. Hu. 2008. Calysto: scalable and precise extended static checking. In Proceedings of the 30th International Conference on Software Engineering (Leipzig Germany) (ICSE '08). Association for Computing Machinery New York NY USA 211\u2013220. doi:10.1145\/1368088.1368118","DOI":"10.1145\/1368088.1368118"},{"key":"e_1_3_1_3_2","doi-asserted-by":"publisher","unstructured":"Subarno Banerjee Lazaro Clapp and Manu Sridharan. 2019. NullAway: practical type-based null safety for Java. In Proceedings of the 2019 27th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (Tallinn Estonia) (ESEC\/FSE '19). 740\u2013750. doi:10.1145\/3338906.3338919","DOI":"10.1145\/3338906.3338919"},{"key":"e_1_3_1_4_2","doi-asserted-by":"publisher","DOI":"10.1145\/359588.359596"},{"key":"e_1_3_1_5_2","doi-asserted-by":"publisher","unstructured":"Sam Blackshear Bor-Yuh Evan Chang and Manu Sridharan. 2013. Thresher: precise refutations for heap reachability. In Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation (Seattle Washington USA) (PLDI '13). 275\u2013286. doi:10.1145\/2491956.2462186","DOI":"10.1145\/2491956.2462186"},{"key":"e_1_3_1_6_2","unstructured":"Cristian Cadar Daniel Dunbar and Dawson Engler. 2008. KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation (San Diego California) (OSDI '08). 209\u2013224."},{"key":"e_1_3_1_7_2","doi-asserted-by":"publisher","unstructured":"Yuandao Cai Chengfeng Ye Qingkai Shi and Charles Zhang. 2022. Peahen: fast and precise static deadlock detection via context reduction. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering (Singapore Singapore) (ESEC\/FSE '22). 784\u2013796. doi:10.1145\/3540250.3549110","DOI":"10.1145\/3540250.3549110"},{"key":"e_1_3_1_8_2","doi-asserted-by":"crossref","unstructured":"Sigmund Cherem Lonnie Princehouse and Radu Rugina. 2007. Practical memory leak detection using guarded value-flow analysis. In Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation (San Diego USA) (PLDI '07). 480\u2013491.","DOI":"10.1145\/1250734.1250789"},{"key":"e_1_3_1_9_2","doi-asserted-by":"publisher","unstructured":"Manuvir Das Sorin Lerner and Mark Seigle. 2002. ESP: path-sensitive program verification in polynomial time. In Proceedings of the ACM SIGPLAN 2002 Conference on Programming Language Design and Implementation (Berlin Germany) (PLDI '02). 57\u201368. doi:10.1145\/512529.512538","DOI":"10.1145\/512529.512538"},{"key":"e_1_3_1_10_2","doi-asserted-by":"publisher","unstructured":"Nurit Dor Stephen Adams Manuvir Das and Zhe Yang. 2004. Software validation via scalable path-sensitive value flow analysis. In Proceedings of the 2004 ACM SIGSOFT International Symposium on Software Testing and Analysis (Boston Massachusetts USA) (ISSTA '04). 12\u201322. doi:10.1145\/1007512.1007515","DOI":"10.1145\/1007512.1007515"},{"key":"e_1_3_1_11_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.1982.234773"},{"key":"e_1_3_1_12_2","doi-asserted-by":"publisher","unstructured":"Gang Fan Rongxin Wu Qingkai Shi Xiao Xiao Jinguo Zhou and Charles Zhang. 2019. Smoke: scalable path-sensitive memory leak detection for millions of lines of code. In Proceedings of the 41st International Conference on Software Engineering (Montreal Quebec Canada) (ICSE '19). 72\u201382. doi:10.1109\/ICSE.2019.00025","DOI":"10.1109\/ICSE.2019.00025"},{"key":"e_1_3_1_13_2","doi-asserted-by":"publisher","unstructured":"Yu Feng Xinyu Wang Isil Dillig and Calvin Lin. 2015. EXPLORER: query- and demand-driven exploration of interprocedural control flow properties. In Proceedings of the 2015 ACM SIGPLAN International Conference on Object-Oriented Programming Systems Languages and Applications (Pittsburgh PA USA) (OOPSLA '15). 520\u2013534. doi:10.1145\/2814270.2814284","DOI":"10.1145\/2814270.2814284"},{"key":"e_1_3_1_14_2","doi-asserted-by":"publisher","DOI":"10.1145\/1348250.1348255"},{"key":"e_1_3_1_15_2","doi-asserted-by":"publisher","unstructured":"Yiyuan Guo Jinguo Zhou Peisen Yao Qingkai Shi and Charles Zhang. 2022. Precise divide-by-zero detection with affirmative evidence. In Proceedings of the 44th International Conference on Software Engineering (Pittsburgh Pennsylvania) (ICSE '22). 1718\u20131729. doi:10.1145\/3510003.3510066","DOI":"10.1145\/3510003.3510066"},{"key":"e_1_3_1_16_2","doi-asserted-by":"crossref","unstructured":"Ben Hardekopf and Calvin Lin. 2011. Flow-sensitive pointer analysis for millions of lines of code. In Proceedings of the 9th Annual IEEE\/ACM International Symposium on Code Generation and Optimization (CGO '11). 289\u2013298.","DOI":"10.1109\/CGO.2011.5764696"},{"key":"e_1_3_1_17_2","doi-asserted-by":"crossref","unstructured":"Ben Hardekopf and Calvin Lin. 2011. Flow-sensitive pointer analysis for millions of lines of code. In Proceedings of the 9th Annual IEEE\/ACM International Symposium on Code Generation and Optimization (CGO '11). IEEE Computer Society USA 289\u2013298.","DOI":"10.1109\/CGO.2011.5764696"},{"key":"e_1_3_1_18_2","doi-asserted-by":"publisher","unstructured":"Behnaz Hassanshahi Raghavendra Kagalavadi Ramesh Padmanabhan Krishnan Bernhard Scholz and Yi Lu. 2017. An efficient tunable selective points-to analysis for large codebases. In Proceedings of the 6th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis (Barcelona Spain) (SOAP '17). 13\u201318. doi:10.1145\/3088515.3088519","DOI":"10.1145\/3088515.3088519"},{"key":"e_1_3_1_19_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2022.3162236"},{"key":"e_1_3_1_20_2","doi-asserted-by":"publisher","unstructured":"Nevin Heintze and Olivier Tardieu. 2001. Demand-driven pointer analysis. In Proceedings of the ACM SIGPLAN 2001 Conference on Programming Language Design and Implementation (Snowbird Utah USA) (PLDI '01). 24\u201334. doi:10.1145\/378795.378802","DOI":"10.1145\/378795.378802"},{"key":"e_1_3_1_21_2","doi-asserted-by":"publisher","DOI":"10.1145\/3293607"},{"key":"e_1_3_1_22_2","doi-asserted-by":"publisher","DOI":"10.1145\/3276510"},{"key":"e_1_3_1_23_2","doi-asserted-by":"publisher","DOI":"10.1145\/3428247"},{"key":"e_1_3_1_24_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133924"},{"key":"e_1_3_1_25_2","doi-asserted-by":"publisher","unstructured":"Vineet Kahlon. 2008. Bootstrapping: a technique for scalable flow and context-sensitive pointer alias analysis. In Proceedings of the 29th ACM SIGPLAN Conference on Programming Language Design and Implementation (Tucson AZ USA) (PLDI '08). 249\u2013259. doi:10.1145\/1375581.1375613","DOI":"10.1145\/1375581.1375613"},{"key":"e_1_3_1_26_2","doi-asserted-by":"publisher","DOI":"10.1007\/BF00290339"},{"key":"e_1_3_1_27_2","doi-asserted-by":"publisher","unstructured":"George Kastrinis and Yannis Smaragdakis. 2013. Hybrid context-sensitivity for points-to analysis. In Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation (Seattle Washington USA) (PLDI '13). 423\u2013434. doi:10.1145\/2491956.2462191","DOI":"10.1145\/2491956.2462191"},{"key":"e_1_3_1_28_2","doi-asserted-by":"publisher","unstructured":"Lian Li Cristina Cifuentes and Nathan Keynes. 2011. Boosting the performance of flow-sensitive points-to analysis using value flow. In Proceedings of the 19th ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering (Szeged Hungary) (ESEC\/FSE '11). 343\u2013353. doi:10.1145\/2025113.2025160","DOI":"10.1145\/2025113.2025160"},{"key":"e_1_3_1_29_2","doi-asserted-by":"publisher","DOI":"10.1145\/3276511"},{"key":"e_1_3_1_30_2","doi-asserted-by":"publisher","unstructured":"Yue Li Tian Tan Anders M\u00f8ller and Yannis Smaragdakis. 2018. Scalability-first pointer analysis with self-tuning context-sensitivity. In Proceedings of the 2018 26th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Software Engineering (Lake Buena Vista FL USA) (ESEC\/FSE '18). 129\u2013140. doi:10.1145\/3236024.3236041","DOI":"10.1145\/3236024.3236041"},{"key":"e_1_3_1_31_2","doi-asserted-by":"publisher","DOI":"10.1145\/3381915"},{"key":"e_1_3_1_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/2644805"},{"key":"e_1_3_1_33_2","doi-asserted-by":"publisher","unstructured":"V. Benjamin Livshits and Monica S. Lam. 2003. Tracking pointers with path and context sensitivity for bug detection in C programs. In Proceedings of the 9th European Software Engineering Conference Held Jointly with 11th ACM SIGSOFT International Symposium on Foundations of Software Engineering (Helsinki Finland) (ESEC\/FSE '11). 317\u2013326. doi:10.1145\/940071.940114","DOI":"10.1145\/940071.940114"},{"key":"e_1_3_1_34_2","doi-asserted-by":"publisher","unstructured":"Alexey Loginov Eran Yahav Satish Chandra Stephen Fink Noam Rinetzky and Mangala Nanda. 2008. Verifying dereference safety via expanding-scope analysis. In Proceedings of the 2008 International Symposium on Software Testing and Analysis (Seattle WA USA) (ISSTA '08). 213\u2013224. doi:10.1145\/1390630.1390657","DOI":"10.1145\/1390630.1390657"},{"key":"e_1_3_1_35_2","doi-asserted-by":"publisher","unstructured":"Jingbo Lu Dongjie He and Jingling Xue. 2021. Selective Context-Sensitivity for k-CFA with CFL-Reachability. In Static Analysis: 28th International Symposium SAS 2021 Chicago IL USA October 17\u201319 2021 Proceedings (Chicago IL USA) (SAS '21). 261\u2013285. doi:10.1007\/978-3-030-88806-0_13","DOI":"10.1007\/978-3-030-88806-0_13"},{"key":"e_1_3_1_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3360574"},{"key":"e_1_3_1_37_2","doi-asserted-by":"publisher","unstructured":"Yi Lu Lei Shang Xinwei Xie and Jingling Xue. 2013. An incremental points-to analysis with CFL-Reachability. In Proceedings of the 22nd International Conference on Compiler Construction (Rome Italy) (CC '13). 61\u201381. doi:10.1007\/978-3-642-37051-9_4","DOI":"10.1007\/978-3-642-37051-9_4"},{"key":"e_1_3_1_38_2","doi-asserted-by":"publisher","unstructured":"Sen Ma MingYang Jiao ShiKun Zhang Wen Zhao and Dong Wei Wang. 2015. Practical null pointer dereference detection via value-dependence analysis. In Proceedings of the 2015 IEEE International Symposium on Software Reliability Engineering Workshops (ISSREW) (ISSREW '15). 70\u201377. doi:10.1109\/ISSREW.2015.7392049","DOI":"10.1109\/ISSREW.2015.7392049"},{"key":"e_1_3_1_39_2","doi-asserted-by":"publisher","unstructured":"Ravichandhran Madhavan and Raghavan Komondoor. 2011. Null dereference verification via over-approximated weakest pre-conditions analysis. In Proceedings of the 2011 ACM International Conference on Object Oriented Programming Systems Languages and Applications (Portland Oregon USA) (OOPSLA '11). 1033\u20131052. doi:10.1145\/2048066.2048144","DOI":"10.1145\/2048066.2048144"},{"key":"e_1_3_1_40_2","doi-asserted-by":"publisher","unstructured":"Mangala Gowri Nanda and Saurabh Sinha. 2009. Accurate Interprocedural Null-Dereference Analysis for Java. In Proceedings of the 31st International Conference on Software Engineering (ICSE '09). 133\u2013143. doi:10.1109\/ICSE.2009.5070515","DOI":"10.1109\/ICSE.2009.5070515"},{"key":"e_1_3_1_41_2","doi-asserted-by":"publisher","unstructured":"Hakjoo Oh Kihong Heo Wonchan Lee Woosuk Lee and Kwangkeun Yi. 2012. Design and implementation of sparse global analyses for C-like languages. In Proceedings of the 33rd ACM SIGPLAN Conference on Programming Language Design and Implementation (Beijing China) (PLDI '12). 229\u2013238. doi:10.1145\/2254064.2254092","DOI":"10.1145\/2254064.2254092"},{"key":"e_1_3_1_42_2","doi-asserted-by":"publisher","unstructured":"Diptikalyan Saha and C. R. Ramakrishnan. 2005. Incremental and demand-driven points-to analysis using logic programming. In Proceedings of the 7th ACM SIGPLAN International Conference on Principles and Practice of Declarative Programming (Lisbon Portugal) (PPDP '05). 117\u2013128. doi:10.1145\/1069774.1069785","DOI":"10.1145\/1069774.1069785"},{"key":"e_1_3_1_43_2","doi-asserted-by":"publisher","unstructured":"Lei Shang Xinwei Xie and Jingling Xue. 2012. On-demand dynamic summary-based points-to analysis. In Proceedings of the Tenth International Symposium on Code Generation and Optimization (San Jose California) (CGO '12). 264\u2013274. doi:10.1145\/2259016.2259050","DOI":"10.1145\/2259016.2259050"},{"key":"e_1_3_1_44_2","doi-asserted-by":"publisher","DOI":"10.1145\/3563339"},{"key":"e_1_3_1_45_2","doi-asserted-by":"publisher","unstructured":"Qingkai Shi Rongxin Wu Gang Fan and Charles Zhang. 2020. Conquering the extensional scalability problem for value-flow analysis frameworks. In Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering (Seoul South Korea) (ICSE '20). 812\u2013823. doi:10.1145\/3377811.3380346","DOI":"10.1145\/3377811.3380346"},{"key":"e_1_3_1_46_2","doi-asserted-by":"publisher","unstructured":"Qingkai Shi Xiao Xiao Rongxin Wu Jinguo Zhou Gang Fan and Charles Zhang. 2018. Pinpoint: fast and precise sparse value flow analysis for million lines of code. In Proceedings of the 39th ACM SIGPLAN Conference on Programming Language Design and Implementation (Philadelphia PA USA) (PLDI '18). 693\u2013706. doi:10.1145\/3192366.3192418","DOI":"10.1145\/3192366.3192418"},{"key":"e_1_3_1_47_2","doi-asserted-by":"publisher","unstructured":"Qingkai Shi Peisen Yao Rongxin Wu and Charles Zhang. 2021. Path-sensitive sparse analysis without path conditions. In Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation (Virtual Canada) (PLDI '21). 930\u2013943. doi:10.1145\/3453483.3454086","DOI":"10.1145\/3453483.3454086"},{"key":"e_1_3_1_48_2","doi-asserted-by":"publisher","unstructured":"Qingkai Shi and Charles Zhang. 2020. Pipelining bottom-up data flow analysis. In Proceedings of the ACM\/IEEE 42nd International Conference on Software Engineering (Seoul South Korea) (ICSE '20). 835\u2013847. doi:10.1145\/3377811.3380425","DOI":"10.1145\/3377811.3380425"},{"key":"e_1_3_1_49_2","doi-asserted-by":"publisher","unstructured":"Yannis Smaragdakis George Kastrinis and George Balatsouras. 2014. Introspective analysis: context-sensitivity across the board. In Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation (Edinburgh United Kingdom) (PLDI '14). 485\u2013495. doi:10.1145\/2594291.2594320","DOI":"10.1145\/2594291.2594320"},{"key":"e_1_3_1_50_2","doi-asserted-by":"publisher","DOI":"10.1145\/1178625.1178628"},{"key":"e_1_3_1_51_2","doi-asserted-by":"publisher","unstructured":"Manu Sridharan and Rastislav Bodik. 2006. Refinement-based context-sensitive points-to analysis for Java. In Proceedings of the 27th ACM SIGPLAN Conference on Programming Language Design and Implementation (Ottawa Ontario Canada) (PLDI '06). 387\u2013400. doi:10.1145\/1133981.1134027","DOI":"10.1145\/1133981.1134027"},{"key":"e_1_3_1_52_2","doi-asserted-by":"publisher","unstructured":"Manu Sridharan Denis Gopan Lexin Shan and Rastislav Bodik. 2005. Demand-driven points-to analysis for Java. In Proceedings of the 20th Annual ACM SIGPLAN Conference on Object-Oriented Programming Systems Languages and Applications (San Diego CA USA) (OOPSLA '05). 59\u201376. doi:10.1145\/1094811.1094817","DOI":"10.1145\/1094811.1094817"},{"key":"e_1_3_1_53_2","doi-asserted-by":"publisher","unstructured":"Yu Su Ding Ye and Jingling Xue. 2014. Parallel Pointer Analysis with CFL-Reachability. In Proceedings of the 2014 Brazilian Conference on Intelligent Systems (BRACIS '14). 451\u2013460. doi:10.1109\/ICPP.2014.54","DOI":"10.1109\/ICPP.2014.54"},{"key":"e_1_3_1_54_2","doi-asserted-by":"publisher","unstructured":"Yulei Sui Peng Di and Jingling Xue. 2016. Sparse flow-sensitive pointer analysis for multithreaded programs. In Proceedings of the 2016 International Symposium on Code Generation and Optimization (Barcelona Spain) (CGO '16). 160\u2013170. doi:10.1145\/2854038.2854043","DOI":"10.1145\/2854038.2854043"},{"key":"e_1_3_1_55_2","doi-asserted-by":"publisher","unstructured":"Yulei Sui and Jingling Xue. 2016. On-demand strong update analysis via value-flow refinement. In Proceedings of the 2016 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering (Seattle WA USA) (FSE '16). 460\u2013473. doi:10.1145\/2950290.2950296","DOI":"10.1145\/2950290.2950296"},{"key":"e_1_3_1_56_2","doi-asserted-by":"publisher","unstructured":"Yulei Sui and Jingling Xue. 2016. SVF: interprocedural static value-flow analysis in LLVM. In Proceedings of the 25th International Conference on Compiler Construction (Barcelona Spain) (CC '16). 265\u2013266. doi:10.1145\/2892208.2892235","DOI":"10.1145\/2892208.2892235"},{"key":"e_1_3_1_57_2","doi-asserted-by":"publisher","unstructured":"Yulei Sui Ding Ye and Jingling Xue. 2012. Static memory leak detection using full-sparse value-flow analysis. In Proceedings of the 2012 International Symposium on Software Testing and Analysis (Minneapolis MN USA) (ISSTA '12). 254\u2013264. doi:10.1145\/2338965.2336784","DOI":"10.1145\/2338965.2336784"},{"key":"e_1_3_1_58_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2014.2302311"},{"key":"e_1_3_1_59_2","doi-asserted-by":"publisher","unstructured":"Yulei Sui Sen Ye Jingling Xue and Pen-Chung Yew. 2011. SPAS: scalable path-sensitive pointer analysis on full-sparse SSA. In Proceedings of the 9th Asian Conference on Programming Languages and Systems (Kenting Taiwan) (APLAS '11). 155\u2013171. doi:10.1007\/978-3-642-25318-8_14","DOI":"10.1007\/978-3-642-25318-8_14"},{"key":"e_1_3_1_60_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2024.3466551"},{"key":"e_1_3_1_61_2","doi-asserted-by":"publisher","DOI":"10.1145\/3485524"},{"key":"e_1_3_1_62_2","doi-asserted-by":"publisher","unstructured":"David Trabish Andrea Mattavelli Noam Rinetzky and Cristian Cadar. 2018. Chopped symbolic execution. In Proceedings of the 40th International Conference on Software Engineering (Gothenburg Sweden) (ICSE '18). 350\u2013360. doi:10.1145\/3180155.3180251","DOI":"10.1145\/3180155.3180251"},{"key":"e_1_3_1_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/3565800"},{"key":"e_1_3_1_64_2","doi-asserted-by":"publisher","unstructured":"Wei Wang Clark Barrett and Thomas Wies. 2017. Partitioned memory models for program analysis. In Verification Model Checking and Abstract Interpretation - 18th International Conference VMCAI '17 Proceedings. 539\u2013558. doi:10.1007\/978-3-319-52234-0_29","DOI":"10.1007\/978-3-319-52234-0_29"},{"key":"e_1_3_1_65_2","doi-asserted-by":"publisher","unstructured":"Rongxin Wu Yuxuan He Jiafeng Huang Chengpeng Wang Wensheng Tang Qingkai Shi Xiao Xiao and Charles Zhang. 2024. LibAlchemy: A Two-Layer Persistent Summary Design for Taming Third-Party Libraries in Static Bug-Finding Systems. In Proceedings of the IEEE\/ACM 46th International Conference on Software Engineering (Lisbon Portugal) (ICSE '24). Article 105 13 pages. doi:10.1145\/3597503.3639132","DOI":"10.1145\/3597503.3639132"},{"key":"e_1_3_1_66_2","doi-asserted-by":"publisher","unstructured":"Yichen Xie and Alex Aiken. 2005. Scalable error detection using boolean satisfiability. In Proceedings of the 32nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (Long Beach California USA) (POPL '05). Association for Computing Machinery New York NY USA 351\u2013363. doi:10.1145\/1040305.1040334","DOI":"10.1145\/1040305.1040334"},{"key":"e_1_3_1_67_2","doi-asserted-by":"publisher","unstructured":"Xuezheng Xu Yulei Sui Hua Yan and Jingling Xue. 2019. VFix: value-flow-guided precise program repair for null pointer dereferences. In Proceedings of the 41st International Conference on Software Engineering (Montreal Quebec Canada) (ICSE '19). 512\u2013523. doi:10.1109\/ICSE.2019.00063","DOI":"10.1109\/ICSE.2019.00063"},{"key":"e_1_3_1_68_2","doi-asserted-by":"publisher","unstructured":"Dacong Yan Guoqing Xu and Atanas Rountev. 2011. Demand-driven context-sensitive alias analysis for Java. In Proceedings of the 2011 International Symposium on Software Testing and Analysis (Toronto Ontario Canada) (ISSTA '11). 155\u2013165. doi:10.1145\/2001420.2001440","DOI":"10.1145\/2001420.2001440"},{"key":"e_1_3_1_69_2","doi-asserted-by":"publisher","unstructured":"Hua Yan Yulei Sui Shiping Chen and Jingling Xue. 2018. Spatio-temporal context reduction: a pointer-analysis-based static approach for detecting use-after-free vulnerabilities. In Proceedings of the 40th International Conference on Software Engineering (Gothenburg Sweden) (ICSE '18). 327\u2013337. doi:10.1145\/3180155.3180178","DOI":"10.1145\/3180155.3180178"},{"key":"e_1_3_1_70_2","doi-asserted-by":"publisher","DOI":"10.1145\/3656400"},{"key":"e_1_3_1_71_2","doi-asserted-by":"publisher","unstructured":"Hongtao Yu Jingling Xue Wei Huo Xiaobing Feng and Zhaoqing Zhang. 2010. Level by level: making flow- and context-sensitive pointer analysis scalable for millions of lines of code. In Proceedings of the 8th Annual IEEE\/ACM International Symposium on Code Generation and Optimization (Toronto Ontario Canada) (CGO '10). 218\u2013229. doi:10.1145\/1772954.1772985","DOI":"10.1145\/1772954.1772985"},{"key":"e_1_3_1_72_2","doi-asserted-by":"publisher","unstructured":"Qirun Zhang Michael R. Lyu Hao Yuan and Zhendong Su. 2013. Fast algorithms for Dyck-CFL-reachability with applications to alias analysis. In Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation (Seattle Washington USA) (PLDI '13). Association for Computing Machinery New York NY USA 435\u2013446. doi:10.1145\/2491956.2462159","DOI":"10.1145\/2491956.2462159"},{"key":"e_1_3_1_73_2","doi-asserted-by":"publisher","unstructured":"Xin Zheng and Radu Rugina. 2008. Demand-driven alias analysis for C. In Proceedings of the 35th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages (San Francisco California USA) (POPL '08). 197\u2013208. doi:10.1145\/1328438.1328464","DOI":"10.1145\/1328438.1328464"}],"container-title":["Proceedings of the ACM on Programming Languages"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3798211","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,26]],"date-time":"2026-09-26T11:20:13Z","timestamp":1790421613000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3798211"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,4,10]]},"references-count":72,"journal-issue":{"issue":"OOPSLA1","published-print":{"date-parts":[[2026,4,10]]}},"alternative-id":["10.1145\/3798211"],"URL":"https:\/\/doi.org\/10.1145\/3798211","relation":{},"ISSN":["2475-1421"],"issn-type":[{"value":"2475-1421","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,4,10]]},"assertion":[{"value":"2025-10-06","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-02-17","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-04-10","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}