Path-Sensitive Data Flow Analysis Simplified

  • Kirsten Winter
  • Chenyi Zhang
  • Ian J. Hayes
  • Nathan Keynes
  • Cristina Cifuentes
  • Lian Li
Part of the Lecture Notes in Computer Science book series (LNCS, volume 8144)


Path-sensitive data flow analysis pairs classical data flow analysis with an analysis of feasibility of paths to improve precision. In this paper we propose a framework for path-sensitive backward data flow analysis that is enhanced with an abstraction of the predicate domain. The abstraction is based on a three-valued logic. It follows the strategy that path predicates are simplified if possible (without calling an external predicate solver) and every predicate that could not be reduced to a simple predicate is abstracted to the unknown value, for which the feasibility is undecided. The implementation of the framework scales well and delivers promising results.


Information Order Disjunctive Normal Form Feasible Path Abstract Domain Complex Predicate 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. [BGS97]
    Bodík, R., Gupta, R., Soffa, M.L.: Refining data flow information using infeasible paths. In: Proc. of ESEC/FSE, pp. 361–377. ACM (1997)Google Scholar
  2. [CC77]
    Cousot, P., Cousot, R.: Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints. In: Proc. of POPL, pp. 238–252. ACM (1977)Google Scholar
  3. [CS08]
    Cifuentes, C., Scholz, B.: Parfait – designing a scalable bug checker. In: Proc. of the Static Analysis Workshop, pp. 4–11. ACM (2008)Google Scholar
  4. [DDY06]
    Dhurjati, D., Das, M., Yang, Y.: Path-sensitive dataflow analysis with iterative refinement. In: Yi, K. (ed.) SAS 2006. LNCS, vol. 4134, pp. 425–442. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  5. [Dij76]
    Dijkstra, E.W.: A Discipline of Programming. Prentice Hall (1976)Google Scholar
  6. [DLS02]
    Das, M., Lerner, S., Seigle, M.: ESP: Path-sensitive program verification in polynomial time. In: Proc. of PLDI, pp. 57–68. ACM (2002)Google Scholar
  7. [FJM05]
    Fisher, J., Jhala, R., Majumdar, R.: Joining dataflow with predicates. In: Proc. of ESEC/FSE, pp. 227–236. ACM (2005)Google Scholar
  8. [Gin88]
    Ginsberg, M.: Multivalued logics: A uniform approach to inference in artificial intelligence. Computational Intelligence 4, 265–316 (1988)CrossRefGoogle Scholar
  9. [HFL01]
    Hayes, I.J., Fidge, C.J., Lermer, K.: Semantic characterisation of dead control-flow paths. IEE Proceedings—Software 148(6), 175–186 (2001)Google Scholar
  10. [HJMS02]
    Henzinger, T., Jhala, R., Majumdar, R., Sutre, G.: Lazy abstraction. In: Proc. of POPL, pp. 58–70. ACM (2002)Google Scholar
  11. [HR80]
    Holley, L.H., Rosen, B.K.: Qualified data flow problems. In: Proc. of POPL, pp. 68–82. ACM (1980)Google Scholar
  12. [HYD05]
    Hampapuram, H., Yang, Y., Das, M.: Symbolic path simulation in path-sensitive dataflow analysis. In: Proc. of PASTE, pp. 52–58. ACM (2005)Google Scholar
  13. [Kil73]
    Kildall, G.A.: A unified approach to global program optimization. In: Proc. of POPL, pp. 194–206. ACM (1973)Google Scholar
  14. [LA04]
    Lattner, C., Adve, V.: LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation. In: Proc. of the International Symposium on Code Generation and Optimization (CGO 2004), pp. 75–86 (2004)Google Scholar
  15. [NNH99]
    Nielson, F., Nielson, H.R., Hankin, C.: Principles of program analysis. Springer (1999)Google Scholar
  16. [RM07]
    Rival, X., Mauborgne, L.: The trace partitioning abstract domain. In: ACM TOPLAS (August 29, 2007)Google Scholar
  17. [SRW02]
    Sagiv, S., Reps, T.W., Wilhelm, R.: Parametric shape analysis via 3-valued logic. In: ACM TOPLAS, vol. 24(3), pp. 217–298 (2002)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2013

Authors and Affiliations

  • Kirsten Winter
    • 1
  • Chenyi Zhang
    • 1
  • Ian J. Hayes
    • 1
  • Nathan Keynes
    • 2
  • Cristina Cifuentes
    • 3
  • Lian Li
    • 3
  1. 1.School of ITEEUniversity of QueenslandAustralia
  2. 2.OracleBrisbaneAustralia
  3. 3.Oracle LabsBrisbaneAustralia

Personalised recommendations