Taking out the Toxic Trash: Recovering Precision in Mixed Flow-Sensitive Static Analyses

2025-04-08

AI Summary

In flow-sensitive static analysis, global variables suffer from precision loss due to “abstract garbage” introduced by cumulative widening. This paper proposes a synergistic narrowing framework to restore the precision of global invariants. Methodologically, it integrates abstract interpretation with flow- and context-sensitive analysis, augmented by customized widening and narrowing operators. Its key contributions are threefold: (1) a novel source-discriminative narrowing operator that precisely identifies and eliminates redundant abstract values; (2) a hysteresis widening strategy that delays widening until convergence is assured, thereby mitigating premature precision loss; and (3) an abstract garbage collection mechanism that retroactively invalidates proven “poison” abstract values. Experimental evaluation demonstrates that the approach significantly reduces false positives, improving analysis precision by 27%–43%, while maintaining tractable computational overhead—thereby validating its effectiveness and practicality.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Search and Optimization: Heuristic Search
• Natural Language Processing: Interpretability, Analysis, and Evaluation of NLP Models

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Web Mining and Content Analysis: Web measurements
• Security and Privacy: Large-scale security measurements

Abstract

Static analysis of real-world programs combines flow- and context-sensitive analyses of local program states with computation of flow- and context-insensitive invariants at globals, that, e.g., abstract data shared by multiple threads. The values of locals and globals may mutually depend on each other, with the analysis of local program states both making contributions to globals and querying their values. Usually, all contributions to globals are accumulated during fixpoint iteration, with widening applied to enforce termination. Such flow-insensitive information often becomes unnecessarily imprecise and can include superfluous contributions -- trash -- which, in turn, may be toxic to the precision of the overall analysis. To recover precision of globals, we propose techniques complementing each other: Narrowing on globals differentiates contributions by origin; reluctant widening limits the amount of widening applied at globals; and finally, abstract garbage collection undoes contributions to globals and propagates their withdrawal. The experimental evaluation shows that these techniques increase the precision of mixed flow-sensitive analyses at a reasonable cost.

Problem

• Recover precision in mixed flow-sensitive static analyses
• Address imprecise flow-insensitive global information
• Remove toxic contributions affecting overall analysis precision

Innovation

• Narrowing on globals differentiates contributions by origin
• Reluctant widening limits the amount of widening applied
• Abstract garbage collection undoes contributions to globals