Demand-driven interprocedural analysis for map-based abstract domains

Abstract

Many data flow analysis problems can be succinctly formalized using constraint systems. For interprocedural analysis, the system may contain an infinite number of constraints, but it can still be solved using a local solver that evaluates the constraints in a demand-driven fashion. In this paper, we use local solvers to develop a compositional framework for interprocedural on-demand static analysis. We can integrate any map-based abstract domain into our framework, such as a points-to analysis that maps pointers to their possible target addresses. Driven by the local solving algorithm that tracks the required dependencies, only those points-to sets that are of interest to the user are computed. The approach is applicable whenever the keys of the map are efficiently comparable and the domain operations are applied pointwise; we place no additional restrictions on the value domain nor on the transfer functions of the analysis beyond the standard termination requirements of the solvers.