A Path-Sensitive Control Flow Graph

Control Flow Graph (CFG) is a compact representation of all executable paths of a program and it is central to most program analyses. Unfortunately, the direct use of a CFG has two major sources of imprecision: (a) the existence of infeasible paths, and (b) the merging of states along incoming edges of a control-flow merge. Addressing these two problems is the path-sensitivity issue, and it is a folklore that path-sensitive analyses are more accurate. In this paper, we present a method to systematically restructure a CFG in order to encode path-sensitivity into it. The path-sensitive CFG is generated from the symbolic execution tree by (a) removing infeasible paths, and (b) duplicating subgraphs when it is likely to produce more accurate results by the underlying analyzer. We use constraint solving to test path infeasibility. To produce a graph of manageable size, we systematically generalize the state associated with a tree node while preserving its reason of infeasibility. This increases the likelihood of subsuming other nodes. If a node is subsumed then it is merged together with its subsumer. Otherwise, our method splits the subsumer and the subsumed nodes. The above transformation is done offline and independent to the analysis. We finally present experimental data on real benchmarks that shows the efficiency and effectiveness of the approach.