A Framework for Path Sensitive Program Analysis

We present a framework that produces path-sensitive analyses with different tradeoffs of accuracy and efficiency. The first component is a program transformation that restructures a CFG in order to encode path-sensitivity into it. The method consists of deleting infeasible paths from the CFG while performing selective node splitting based on information captured from infeasible paths. This transformation is fully independent from the analysis and can be built offline. Our initial experiments demonstrate that the size of the resulting CFG increases by a reasonable factor and its use can produce significant accuracy gains for several analyses. The second component is a generic backward algorithm that interleaves the above process with the computation of the analysis. This synergy allows using analysis information in order to decide whether a node should be joined or not. We use the concept of witness that establishes the conditions, using some knowledge from the analysis, to ensure that a node can be joined without incurring in any loss of accuracy. We demonstrate that although more expensive this concept can be implemented producing more precise results.