Abstract:Analyzing programs with loops is a challenging task, suffering from potential issues such as indeterminate number of iterations and exponential growth of control flow complexity. Loop summarization, as a static analysis method for concrete semantic interpretation, receives increasing focuses. It produces symbolic expressions semantically equivalent to the loop program. However, current loop summarization methods are only suitable for single-branch loops or multi-branch loops with simple cycles, without supporting complex loops with irregular branch-to-branch transitions. In this paper, we proposed LoopSCC, a novel loop summarization technique, to achieve concrete semantic interpretation on complex loop. LoopSCC analyzes the control flow at the granularity of single-loop-path and applies the strongly connected components (SCC for short) for contraction and simplification, resulting in the contracted single-loop-path graph (CSG for short). Based on the control flow information provided by the CSG, we can convert the loop summary into a combination of SCC summaries. When an SCC contains irregular branch-to-branch transitions, we propose to explore a convergent range to identify the determinate cycles of different execution paths, referred as oscillatory interval. The loop summarization composed of both iteration conditions and execution operations can eventually be derived recursively. Extensive experiments compared to six state-of-the-art loop interpretation methods are conducted to evaluate the effectiveness of LoopSCC. From the results, LoopSCC outperforms comparative methods in both interpretation accuracy and application effectiveness. Especially, LoopSCC achieves a 100% interpretation accuracy on public common-used benchmark. A systematical study for loop properties on three large-scale programs illustrates that LoopSCC presents outstanding scalability for real-world loop programs.

Loopster: Static Loop Termination Analysis

Loopster++: Termination Analysis for Multi-path Linear Loop

Data-driven Loop Bound Learning for Termination Analysis

Proteus: Computing Disjunctive Loop Summary Via Path Dependency Analysis

S-looper: automatic summarization for multipath string loops.

A Proving the Termination of Loops Based on the Generation of Invariants

Automatic Loop Summarization Via Path Dependency Analysis

Analytic Method of Loop Run-Time Information Based on Edge Profiling

A Symbolic Execution Guided Inner Loop Bound Analysis

EndWatch: A Practical Method for Detecting Non-Termination in Real-World Software

LoopSCC: Towards Summarizing Multi-branch Loops within Determinate Cycles

Loop Transparency for Scalable Dynamic Symbolic Execution

Characteristic Studies of Loop Problems for Structural Test Generation Via Symbolic Execution

Bit-Precise Procedure-Modular Termination Analysis

Static Detection of Real-World Buffer Overflow Induced by Loop

Loops under Strategies ... Continued

Termination Analysis Without the Tears

Inferring Loop Invariants for Multi-Path Loops

Heuristic Guided Selective Path Exploration for Loop Structure in Coverage Testing

Iterative-free Program Analysis

Synthesising Interprocedural Bit-Precise Termination Proofs (T).