Context-sensitive data-dependence analysis via linear conjunctive language reachability

Abstract

Many program analysis problems can be formulated as graph reachability problems. In the literature, context-free language (CFL) reachability has been the most popular formulation and can be computed in subcubic time. The context-sensitive data-dependence analysis is a fundamental abstraction that can express a broad range of program analysis problems. It essentially describes an interleaved matched-parenthesis language reachability problem. The language is not context-free, and the problem is well-known to be undecidable. In practice, many program analyses adopt CFL-reachability to exactly model the matched parentheses for either context-sensitivity or structure-transmitted data-dependence, but not both. Thus, the CFL-reachability formulation for context-sensitive data-dependence analysis is inherently an approximation. To support more precise and scalable analyses, this paper introduces linear conjunctive language (LCL) reachability, a new, expressive class of graph reachability. LCL not only contains the interleaved matched-parenthesis language, but is also closed under all set-theoretic operations. Given a graph with n nodes and m edges, we propose an O ( mn ) time approximation algorithm for solving all-pairs LCL-reachability, which is asymptotically better than known CFL-reachability algorithms. Our formulation and algorithm offer a new perspective on attacking the aforementioned undecidable problem - the LCL-reachability formulation is exact, while the LCL-reachability algorithm yields a sound approximation. We have applied the LCL-reachability framework to two existing client analyses. The experimental results show that the LCL-reachability framework is both more precise and scalable than the traditional CFL-reachability framework. This paper opens up the opportunity to exploit LCL-reachability in program analysis.

Context-free path querying by matrix multiplication

“…Also, path querying problem w.r.t. the conjunctive grammars can be applied to static code analysis [29].…”

“…Problems in many areas can be reduced to one of the formallanguages-constrained path problems [4]. For example, various problems of static code analysis [5,26] can be formulated in terms of the context-free language reachability [20] or in terms of the linear conjunctive language reachability [29].…”

The decidability and complexity of interleaved bidirected Dyck reachability

“…This happens because every path produces the same string when traversed backwards, and thus either both directions witness reachability or none does. From a semantics perspective, bidirectedness is a standard approach to handle mutable heap data [Lu and Xue 2019;Sridharan and Bodík 2006;Xu et al 2009;Zhang and Su 2017] ś though it can sometimes be relaxed for read-only accesses [Milanova 2020], and the de-facto formulation of demand-driven points-to analyses [Shang et al 2012;Sridharan et al 2005;Vedurada and Nandivada 2019;Yan et al 2011;Zheng and Rugina 2008]. Bidirectedness is also used for CFL-reachability formulations of pointer analysis [Reps 1997], and has also been used for simplifying the input graph [Li et al 2020].…”

Optimal Dyck reachability for data-dependence and alias analysis

“…Field sensitivity refers to the requirement that reachability paths must respect field accesses of composite types in Java [Sridharan and Bodík 2006;Sridharan et al 2005;Xu et al 2009;Yan et al 2011a], or references and dereferences of pointers [Zheng and Rugina 2008] in C. Considering both types of sensitivity makes the problem undecidable [Reps 2000]. Although one recent workaround is approximation algorithms [Zhang and Su 2017], the standard approach has been to consider only one type of sensitivity. Field sensitivity has been reported to produce better results, and being more scalable [Lhoták and Hendren 2006].…”