1. Improving the Precision of Abstract Simulation using Demand-driven Analysis Olatunji Ruwase Suzanne Rivoire CS 343 - June 12, 2002

2. Background Abstract Simulation Path sensitive analysis of abstract state of program Improves precision of RHS Exploded supergraph Symbolic Store to capture branch correlation Implemented in ESP using constant instantiation

3. Weakness of Abstract Simulation [$u, T,T ] [$u, ~d,~flag] [$u, d,flag] [$u, T, T ] [$u, ~d,~flag][$u, ~d,flag][$o, d,~flag][$o, d,flag] [$u, T, T ] [$e, ~d,flag][$o, d,~flag] entry if(d) f = fopen() if(flag) if(d) flag = 0flag = 1 fclose(f) exit T stands for all behaviours [$u, ~d, T ] [$u, d, T ] [$u, ~d, T ][$u, d,T ] [$u, ~d, T ][$u, d, T ]

4. Our Proposal Short-term goal: Demand-driven intraprocedural algorithm to improve path sensitivity Refinements: Predicate substitution; interprocedural analysis Long-term goal: Build more general framework to handle different FSMs

5. Improving Path Sensitivity: The Basic Algorithm Examine symbolic store Propagate query & running symbolic store back to predecessors, substituting if nec’y Terminate query when it is resolved or when a path is killed Propagate answer, symbolic store values forward

6. Sample code if (d) fclose (…) flag = 1flag = 0 if (flag) fopen (…) if (d) d = 0 …

7. Exploded supergraph entry else fopen(…); if (d) flag = 0; if (d) flag = 1; d = 0; if (flag) (flag == true); Kill query Resolve: YES

8. But isn’t this really complex? Adds an O(N*E) term, with a very low constant Abstract simulation is currently O(N*E*H) N = # of nodes in exploded supergraph E = # of edges in exploded supergraph H = height of lattice (=3 here)

9. Related Work M. Das,S. Lerner and M. Seigle. Path-Sensitive Program Verification in Polynomial Time M. Das, S. Lerner, and M. Seigle. ESP : Path-Sensitive Program Verification in Polynomial Time E. Duesterwald, R. Gupta and M.L. Soffa. Demand-driven Computation of Interprocedural Data Flow R. Bodik, R. Gupta and M.L. Soffa. Refining Data flow Information using Infeasible Paths P. Tu, D. Padua. Gated SSA-based demand-driven symbolic analysis of parallelizing compilers. W. Bush, J. Pincus and D. Sielaff. A static analyzer for finding dynamic programming errors T. Reps, S. Horwitz and M. Sangiv. Precise inter-procedural dataflow analysis via graph reachability

10. Future Extensions Handling of more complex predicates (e.g x > 2) Current approach and strength Introduce boolean variables mapped to predicates on the fly Interprocedural Analysis Procedure entry nodes instantiated with approximation of symbolic stores at all call sites Expected Complexity