Path-Sensitive Analysis Using Edge Strings

Path sensitivity improves the quality of static analysis by avoiding approximative merging of dataflow facts collected along distinct program paths. Because full path sensitivity has prohibitive cost, it is worthwhile to consider hybrid approaches that provide path sensitivity on selected subsets of paths. In this paper, we consider such a technique based on an edge string, a compact abstraction of a set of static program paths. The edge string es = [e1, e2, . . . , ek], where each ei is an edge label found in a program’s control-flow graph, is used to disambiguate dataflow facts that manifest only on paths in which es occurs as a subsequence. The length of es dictates the tradeoff between precision and analysis cost. Loosely speaking, edge strings are a path-sensitive analog to the notion of call-strings exploited by context-sensitive analyses . We present a formalization of edge strings and discuss optimizations that incorporate additional relevance measures, based on the structure of the controlflow graph, to avoid exploring edge-string paths if no added precision accrues. We also provide a detailed implementation study in the context of the functional SSA intermediate representation used by MLton, a whole-program optimizing compiler for Standard ML. Our results indicate that small edge strings provide the necessary precision to identify infeasible paths for functional programs that leverage complex control and dataflow.