Efficiency, Precision, Simplicity, and Generality in Interprocedural Data Flow Analysis: Resurrecting the Classical Call Strings Method

Abstract

Abstract. The full call strings method is the most general, simplest, and most precise method of performing context sensitive interprocedural data flow analysis. It remembers contexts using call strings. For full precision, all call strings up to a prescribed length must be constructed. Two limitations of this method are (a) it cannot be used for frameworks with infinite lattices, and (b) the prescribed length is quadratic in the size of the lattice resulting in an impractically large number of call strings. These limitations have resulted in a proliferation of ad hoc methods which compromise on generality, precision, or simplicity.We propose a variant of the classical full call strings method which reduces the number of call strings, and hence the analysis time, by orders of magnitude as corroborated by our empirical measurements. It reduces the worst case call string length from quadratic in the size of the lattice to linear. Further, unlike the classical method, this worst case length need not be reached. Our approach retains the precision, generality, and simplicity of call strings method without imposing any additional constraints. It can accommodate demand-driven approximations and hence can be used for frameworks with infinite lattices.

Contribution-based call stack abstraction for call string based pointer analysis

“…Their empirical results show that this is enough for achieving high precision and can significantly reduce the analysis time. Besides [32], Khedker and Karkare [33] also modify the classical call string method by identifying contexts which need not be explicitly maintained. This reduces the number of calling contexts dramatically without compromising on the precision, generality and simplicity of the method.…”

“…Our contribution-based call stack abstraction method suggests a possible direction for improving the context-sensitive pointer analysis. The work in [8,33] merges calling contexts to speed up the analysis. In fact, we also improve the analysis by some kind of context merging.…”

A Correspondence between Two Approaches to Interprocedural Analysis in the Presence of Join

“…Most cloning-based approaches approximate recursion in an ad hoc manner. An exception is the work of Khedker et al [KMR12,KK08] which maintains a single representative call string for each equivalence class. Unlike the above approaches, it does not approximate recursion in an ad hoc manner, and yet it is efficient in practice by avoiding the computation of redundant call-string contexts.…”

A Knowledge based method for Data Flow Analysis

“…In data flow analysis, a program is usually represented by its CFO [1,7]. For example, the CFO corresponding to the following SimC program code is shown in Figure 2.…”

“…The goal of reaching definition analysis determines which particular definitions of each variable may, by some control flow path, reach any particular point in the program [6]. This is a forward analysis [1, 6,7]. To do this we introduce predicates killrdO and genrdO.…”