Large Spurious Cycle in Global Static Analyses and Its Algorithmic Mitigation

Abstract

We present a simple algorithmic extension of the classical call-strings approach to mitigate substantial performance degradation caused by spurious interprocedural cycles. Spurious interprocedural cycles are, in a realistic setting, key reasons for why approximate call-return semantics in both context-sensitive and -insensitive static analysis can make the analysis much slower than expected.In the traditional call-strings-based context-sensitive static analysis, because the number of distinguished contexts must be finite, multiple call-contexts are inevitably joined at the entry of a procedure and the output at the exit is propagated to multiple returnsites. We found that these multiple returns frequently create a single large cycle (we call it "butterfly cycle") covering almost all parts of the program and such a spurious cycle makes analyses very slow and inaccurate.Our simple algorithmic technique (within the fixpoint iteration algorithm) identifies and prunes these spurious interprocedural flows. The technique's effectiveness is proven by experiments with a realistic C analyzer to reduce the analysis time by 7%-96%. Since the technique is algorithmic, it can be easily applicable to existing analyses without changing the underlying abstract semantics, it is orthogonal to the underlying abstract semantics' context-sensitivity, and its correctness is obvious.

Design and implementation of sparse global analyses for C-like languages

“…The evaluation was performed on top of SPARROW [23,25,26,28,[35][36][37][38], an industrial-strength static analyzer for C programs. For the non-relational analysis, we use the interval domain [9], a representative non-relational domain that is widely used in practice [1,2,4,13,26].…”

“…The fixpoint is computed by a worklist algorithm using the conventional widening operator [9] for interval domain. Details of the analysis can be found in [23,26,28,[35][36][37][38].…”

“…Both our interval and octagon domain-based analyzers can analyze sendmail. Airac [26,35], a general-purpose interval domain-based global static analyzer, scales only to 30 KLOC in global analysis. Recently, a significant progress has been reported by Oh et al [38], but it still does not scale over 120 KLOC.…”

“…We can instantiate these designs with a particular non-relational and relational abstract domains, respectively. • We prove the practicality of our framework by experimentally demonstrating the achieved speedup of an industrial-strength static analyzer [23,26,28,[35][36][37][38]. The sparse analysis can analyze programs up to 1 million lines of C code with interval domain and up to 100K lines of C code with octagon domain.…”

Contribution-based call stack abstraction for call string based pointer analysis

“…This reduces the number of calling contexts dramatically without compromising on the precision, generality and simplicity of the method. Oh [34] finds that in call string based static analysis, there can be spurious inter-procedural cycles caused by approximated connections between the call sites, procedure entries, procedure exits and return-sites. He extends the classical call string approach to mitigate substantial performance degradation caused by such cycles, and the extension seems effective.…”