Abstract:The control flow graph (CFG) representation of a procedure used by virtually all flow-sensitive program analyses, admits a large number of infeasible control flow paths i.e., these paths do not occur in any execution of the program. Hence the information reaching along infeasible paths in an analysis is spurious. This affects the precision of the conventional maximum fixed point (MFP) solution of the data flow analysis, because it includes the information reaching along all control flow paths. The existing approaches for removing this imprecision are either specific to a data flow problem with no straightforward generalization or involve control flow graph restructuring which may exponentially blow up the size of the CFG. We lift the notion of MFP solution to define the notion of feasible path MFP (FPMFP) solutions that exclude the data flowing along known infeasible paths. The notion of FPMFP is generic and does not involve CFG restructuring. Instead, it takes externally supplied information about infeasible paths and lifts any data flow analysis to an analysis that maintains the distinctions between different paths where these distinctions are beneficial, and ignores them where they are not. Thus it gets the benefit of a path-sensitive analysis where it is useful without performing a conventional path-sensitive analysis. We evaluated the proposed feasible path MFP solutions for reaching definitions analysis and potentially uninitialized variable analysis on 30 benchmarks. The evaluation results indicate that precision improvement in these two analyses respectively reduce the number def-use pairs by up to 13.6% (average 2.87%, geometric mean 1.75%), and reduce the potentially uninitialized variable alarms by up to 100% (average 18.5%, geo. mean 3%). We found that the FPMFP computation time was 2.9X of MFP computation time on average.

Detecting Interprocedural Infeasible Paths Via Symbolic Propagation and Dataflow Analysis

Effective code coverage in compositional systematic dynamic testing

Scalable Fault Detection Based on Precise Access Path

Towards Efficient Data-flow Test Data Generation

Towards an Efficient Path-Oriented Tool for Bounded Reachability Analysis of Linear Hybrid Systems using Linear Programming

Automated Test Data Generation Based on Program Execution

Visualizing Path Exploration to Assist Problem Diagnosis for Structural Test Generation

Context-dependent Flow-Sensitive Interprocedural Dataflow Analysis.

Path Coverage Metric Based on Critical Signals

Steering Symbolic Execution to Less Traveled Paths

Proteus: Computing Disjunctive Loop Summary Via Path Dependency Analysis

Data Automatic Generation Approach for Path Test

Detecting Infeasible Traces in Process Models.

Towards Efficient Large-Scale Interprocedural Program Static Analysis on Distributed Data-Parallel Computation

BigDataflow: A Distributed Interprocedural Dataflow Analysis Framework

Computing Maximum Fixed Point Solutions over Feasible Paths in Data Flow Analyses

Dependence Guided Symbolic Execution.

Fitness-guided Path Exploration in Dynamic Symbolic Execution

Octopus : Scaling Value-Flow Analysis via Parallel Collection of Realizable Path Conditions

Detecting dead statements for concurrent programs

Motion Planning (In)feasibility Detection using a Prior Roadmap via Path and Cut Search