How to combine widening and narrowing for non-monotonic systems of equations

Abstract

Non-trivial analysis problems require complete lattices with infinite ascending and descending chains. In order to compute reasonably precise post-fixpoints of the resulting systems of equations, Cousot and Cousot have suggested accelerated fixpoint iteration by means of widening and narrowing [6,7].The strict separation into phases, however, may unnecessarily give up precision that cannot be recovered later. While widening is also applicable if equations are non-monotonic, this is no longer the case for narrowing. A narrowing iteration to improve a given post-fixpoint, additionally, must assume that all right-hand sides are monotonic. The latter assumption, though, is not met in presence of widening. It is also not met by equation systems corresponding to context-sensitive interprocedural analysis, possibly combining context-sensitive analysis of local information with flow-insensitive analysis of globals [1].As a remedy, we present a novel operator that combines a given widening operator with a given narrowing operator . We present adapted versions of round-robin as well as of worklist iteration, local, and side-effecting solving algorithms for the combined operator and prove that the resulting solvers always return sound results and are guaranteed to terminate for monotonic systems whenever only finitely many unknowns (constraint variables) are encountered.

Enforcing Termination of Interprocedural Analysis

“…In [4], a variation of round-robin iteration is presented which is guaranteed to terminate for monotonic systems, while it may not terminate for non-monotonic systems. In order to remedy this failure, we re-design this algorithm by additionally maintaining a flag which indicates whether the variable presently under consideration has or has not reached a sound value ( Fig.…”

“…For that, these solvers have been extended to deal with side-effects (see [3] for a detailed discussion of this mechanism) to jointly deal with flow-and context-sensitive and flow-insensitive analyses. In order to perform a fair comparison of the new solvers with warrowing-based local solving as proposed in [4,2], we provided a simplified version of TSMP. This simplified solver performs priority based iteration in the same way as TSMP but uses the warrowing operator instead of selecting operators according to extra flags.…”

“…No further assumptions, e.g., w.r.t. monotonicity of right-hand sides must be made as in [4,2]. Upon termination, the algorithm is guaranteed to return sound results.…”

“…This strict arrangement into separate phases, though, has the disadvantage that precision unnecessarily may be given up which later is difficult to recover. It has been observed that widening and narrowing need not be organized into separate phases [4,5,2]. Instead various algorithms are proposed which intertwine widening with narrowing in order to compute a (reasonably small) post-fixpoint of the given system of equations.…”

“…In order to enhance precision of this demand-driven two-phase solver, we then design a new local solver which intertwines the two phases. In contrast to the solvers in [4,2], however, we can no longer rely on a fixed combination of a widening and a narrowing operator, but must enhance the solver with extra logic to decide when to apply which operator. For both solvers, we prove that they terminate -whenever only finitely many variables are encountered: irrespective whether the abstract system is monotonic or not.…”