Higher-order Demand-driven Program Analysis

Abstract

We explore a novel approach to higher-order program analysis that brings ideas of on-demand lookup from first-order CFL-reachability program analyses to higher-order programs. The analysis needs to produce only a control-flow graph; it can derive all other information including values of variables directly from the graph. Several challenges had to be overcome, including how to build the control-flow graph on-the-fly and how to deal with non-local variables in functions. The resulting analysis is flow-and context-sensitive with a provable polynomial-time bound. The analysis is formalized and proved correct and terminating, and an initial implementation is described.

Higher-order demand-driven symbolic evaluation

“…For recursive functions, definable here via self-passing, the context stack may grow unboundedly but there is no need for any special handling in the lookup definition. The demand-driven evaluator described here is novel but is based on ideas in [Facchinetti et al 2019] (the ωDDPAc evaluator there), where it was used for the purpose of proving a program analysis sound.…”

“…Section 2.1 gave an informal treatment of how a demand-driven interpreter operates; here we make that informal intuition precise. This interpreter design was initially inspired by the ωDDPAc interpreter of [Facchinetti et al 2019]; unlike that interpreter it depends on and constructs no control flow graph in a forward direction, so it is łeven more demand drivenž than [Facchinetti et al 2019].…”

“…The demand-driven interpreter which we symbolize here was inspired by the ωDDPAc interpreter [Facchinetti et al 2019;Palmer and Smith 2016], which was developed solely to show soundness of a demand-driven program analysis. The interpreter of this paper is significantly simplified from ωDDPAc in that it does not require (forward) construction of a control flow graph, and for this reason it is purely demand-driven unlike ωDDPAc.…”

“…The interpreter of this paper is significantly simplified from ωDDPAc in that it does not require (forward) construction of a control flow graph, and for this reason it is purely demand-driven unlike ωDDPAc. But the main contribution here beyond [Facchinetti et al 2019] is to show how demand interpreters also can be turned into demand symbolic evaluators, producing the first such known system for a higher-order functional language. Beyond the very different natures of program analyses and symbolic evaluators, several particular features of DDSE were not found in previous work, including the modeling of input equivalently as a mapping; the use of stack-indexed variables in formulae to disambiguate across different activations; and, the novel relative stack construction for building a call stack starting from the middle of a program and working backward.…”

“…There exist demand-driven program analyses in parallel with demand-driven symbolic evaluators, both for imperative languages [Horwitz et al 1995] and more recently for functional languages [Facchinetti et al 2019;Germane et al 2019]; DDSE is built on the infrastructure of one particular higher-order demand-driven program analysis, DDPA [Facchinetti et al 2019].…”