Summary-Based Context-Sensitive Data-Dependence Analysis in Presence of Callbacks

Abstract

Building a summary for library code is a common approach to speeding up the analysis of client code. In presence of callbacks, some reachability relationships between library nodes cannot be obtained during library-code summarization. Thus, the library code may have to be analyzed again during the analysis of the client code with the library summary. In this paper, we propose to summarize library code with tree-adjoining-language (TAL) reachability. Compared with the summary built with context-free-language (CFL) reachability, the summary built with TAL reachability further contains conditional reachability relationships. The conditional reachability relationships can lead to much lighter analysis of the library code during the client code analysis with the TAL-reachability-based library summary. We also performed an experimental comparison of context-sensitive data-dependence analysis with the TAL-reachability-based library summary and context-sensitive data-dependence analysis with the CFL-reachability-based library summary using 15 benchmark subjects. Our experimental results demonstrate that the former has an 8X speed-up over the latter on average.

Modular Information Flow through Ownership

“…Starting from Rountev et al [26] and Cousot and Cousot [9], one approach has been to design a system of "procedure summaries" understood by the static analyzer and distinct from the language being analyzed. This approach has been widely applied for static analysis of null pointer dereferences [37], pointer aliases [12], data dependencies [32], and other properties.…”

Compositional Information Flow Analysis for WebAssembly Programs

“…A points-to analysis developed with Saturn can scale up to the size of the Linux kernel. Tang et al [61] present summaries in the presence of callbacks in libraries, when a function may have to be reanalysed even if a summary has already been produced, due to new reachability relations. This is not a situation that can occur in our case as each function is analysed independently of its callers.…”

Calling-to-reference context translation via constraint-guided CFL-reachability

“…A variety of program analyses can be formulated as CFLreachability problems [5,16,22,28,40]. CFL-reachability is an extension of standard graph reachability that allows for ltering of uninteresting paths.…”

“…Zheng and Rugina [53] propose a CFL-reachability-based formulation of demand-driven alias analysis for C. Xu et al [45] propose the symbolic points-to graph (SPG) representation of the program. Recent work used CFL-reachability for library summarization [40] or speci cation inference [5]. Much work [10,12,[49][50][51] has also been done to improve the e ciency of solving CFL-reachability.…”