Control Flow Refinement and Symbolic Computation of Average Case Bound

Abstract

This paper presents a new technique for refining the complex control structure of loops that occur in imperative programs. We first introduce a new way of describing program execution patterns – ( + ,·)-path expressions, which is a subset of conventional path expressions with the operators ∨ and ∗ eliminated. The programs induced by ( + ,·)-path expressions have no path interleaving or skipping-over inner loops, which are the two main issues that cause impreciseness in program analysis. Our refinement process starts from a conventional path expression \(\mathcal{E}\) obtained from the control flow graph, and aims to calculate a finite set of ( + ,·)-path expressions \(\{\mathfrak{e}_1, ..., \mathfrak{e}_n\}\) such that the language generated by path expression \(\mathcal{E}\) is equivalent to the union of the languages generated by each ( + ,·)-path expressions \(\mathfrak{e}_i\). In theory, a conventional path expression can potentially generate an infinite set of ( + ,·)-path expressions. To remedy that, we use abstract interpretation techniques to prune the infeasible paths. In practice, the refinement process usually converges very quickly.