Trace-based control-flow analysis

Abstract

We define a small-step semantics for the untyped λ-calculus, that traces the β-reductions that occur during evaluation. By abstracting the computation traces, we reconstruct -CFA using abstract interpretation, and justify constraint-based -CFA in a semantic way. The abstract interpretation of the trace semantics also paves the way for introducing widening operators in CFA that go beyond existing analyses, that are all based on exploring a finite state space. We define ∇CFA, a widening-based analysis that limits the cycles in call stacks, and can achieve better precision than -CFA at a similar cost.

Detection of Uncaught Exceptions in Functional Programs by Abstract Interpretation

“…The role of the fixpoint solver is to find a post-fixpoint of this functional. Similar approaches-leveraging fixpoint solvers to define static analysers-have been successfully used in other work on static analysis [22,64,50,4]. Our abstract interpreter is defined in Figure 2, where t eval E denotes the abstract value of type m ♯ A obtained by analysing the program t under the abstract environment E, and using the analysis function eval for recursive calls.…”

“…Our analyser is context sensitive: we implemented a form of call site sensitivity, that is akin to an abstraction of the call stack. Following [50], we retain full sensitivity until the list of call sites becomes maximal, i.e., when a program point appears more than once in that list, which may indicate a recursive call to some function. In addition, we always remember the last call site.…”

“…In practice, the list of call sites is an additional parameter to the abstract interpreter. Following [50] again, we use this list of call sites to decide when widening on the environments should be performed: it is performed only when eval is called on a maximal list of call sites. The same list of call sites is also used to derive dynamic exception names and abstract pointers (see §6.4 and §6.5).…”

“…The goal of CFA is to determine which functions might be called at a call site, and on which arguments. CFA can be expressed as instances of abstract interpretation [46,44,47,50]. CFA can easily be extended to analyse exceptions.…”

Clustered Relational Thread-Modular Abstract Interpretation with Local Traces

“…In a sequential setting, splitting control locations according to some abstraction of reaching traces is a common technique for improving the precision of dataflow analyses [9,27] or abstract interpretation [25,34,41,47]. Control point splitting can be understood as an instance of the reduced cardinal power domain [12,13,22].…”