Computing partially path-sensitive MFP solutions in data flow analyses

Abstract

Data flow analysis traverses paths in a control flow graph (CFG) representation of programs to compute useful information. Many of these paths are infeasible, i.e. they cannot arise in any possible execution. The information computed along these paths adds imprecision to the conventional Maximal Fixed Point (MFP) solution of a data flow analysis. Existing approaches for removing this imprecision are either specific to a data flow problem or involve control flow graph restructuring which has exponential complexity. We introduce partial path-sensitivity to the MFP solution by identifying clusters of minimal infeasible path segments to distinguish between the data flowing along feasible and infeasible control flow paths. This allows us to lift any data flow analysis to an analysis over k+1 tuples where k is the number of clusters. Our flow function for a k+1 tuple shifts the values of the underlying analysis from an element in the tuple to other element(s) at the start and end of a cluster as appropriate. This allows us to maintain the distinctions where they are beneficial. Since k is linear in the number of conditional edges in the CFG, the effort is multiplied by a factor that is linear in the number of conditional edges (and is not exponential, unlike conventional approaches of achieving path sensitivity.) We have implemented our method of computing partially path sensitive MFP for reaching definitions analysis and value range analysis of variables. Our measurements on benchmark programs show up to 9% reduction in the number of reaching definitions and up to 14% cases where the value range of a variable is smaller.