Introspective pushdown analysis

In the static analysis of functional programs, pushdown flow analysis and abstract garbage collection skirt just inside the boundaries of soundness and decidability. This work illuminates and conquers the theoretical challenges that stand in the way of combining the power of these techniques. Pushdown flow analysis grants unbounded yet computable polyvariance to the analysis of return-flow in higherorder programs. Abstract garbage collection grants unbounded polyvariance to abstract addresses which become unreachable between invocations of the abstract contexts in which they were created. Pushdown analysis solves the problem of precisely analyzing recursion in higher-order languages; abstract garbage collection is essential in solving the “stickiness” problem. Alone, each method reduces analysis times and boosts precision by orders of magnitude. We combine these methods. The challenge in marrying these techniques is not subtle: computing the reachable control states of a pushdown system relies on limiting access during transition to the top of the stack; abstract garbage collection, on the other hand, needs full access to the entire stack to compute a root set, just as concrete collection does. Pushdown flow analysis already skirts just inside the boundary of decidability, so it is not clear that integrating abstract garbage collection will preserve decidability. In fact, introducing abstract garbage collection breaks the pushdown framework: to find the root set of reachable addresses, the analysis must consider the full contents of all possible stacks associated with a given control state. Such introspection clearly violates the constraints on a pushdown system. Introspective pushdown systems resolve this conflict. Introspective pushdown systems provide enough access to the stack to allow abstract garbage collection, but they remain restricted enough to compute control-state reachability, thereby enabling the sound and precise product of pushdown analysis and abstract garbage collection. Experiments reveal synergistic interplay between the techniques, and the fusion demonstrates “better-than-both-worlds” precision. ZU064-05-FPR paper-jfp 8 May 2013 19:18 2 C. Earl, I. Sergey, J.I. Johnson, M. Might, and D. Van Horn (define (id x) x) (define (f n) (cond [(<= n 1) 1] [else (* n (f (n 1)))])) (define (g n) (cond [(<= n 1) 1] [else (+ (* n n) (g (n 1)))])) (print (+ ((id f) 3) ((id g) 4))) Fig. 1. A small example to illuminate the strengths and weaknesses of both pushdown analysis and abstract garbage collection.