Predicate-Encoded Call Graphs for Static Analysis Precision
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Call graphs in static program analysis can be imprecise due to control flow constraints, leading to inefficient solutions when dealing with large codebases, as they may contain infeasible execution paths that are difficult to scale and resolve.
Innovation Solution
A method is introduced to modify call graphs by labeling edges with predicate encodings, using a constraint solver and code analyzer to determine predicate satisfaction and violations, allowing for a compressed representation of predicate information, enabling quick feasibility determination of call paths during execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If call graphs are used to represent execution paths in large codebases, then program analysis coverage is improved, but computational efficiency deteriorates due to the large number of infeasible paths
Solution Approach 1:
The patent extracts predicate information from call sites and separates it from the call graph structure. By taking out the control flow constraints and storing them as labeled encodings on graph edges, the system can quickly filter infeasible paths without processing the entire call graph, thus improving computational efficiency while maintaining analysis coverage.
Solution Approach 2:
The patent performs preliminary encoding of predicates at call sites before executing path analysis. By pre-computing and storing predicate encodings on graph edges during graph construction, the system prepares control flow constraint information in advance, enabling fast feasibility determination during query execution without sacrificing analysis precision.
2Measurement precision
If predicate information is stored in detailed form for each call site, then analysis accuracy is improved, but storage requirements increase
Solution Approach 1:
The patent transforms predicate information from detailed Boolean expressions into compressed encodings that capture essential control flow constraints. By changing the representation parameter from full predicate text to encoded forms, the system maintains the ability to determine path feasibility while significantly reducing the storage space required for predicate information.
Solution Approach 2:
The patent creates compressed copies of predicate information as encodings on graph edges rather than storing complete predicate expressions. These encoded copies contain sufficient information to determine predicate satisfaction during path analysis, providing a space-efficient representation that maintains analytical accuracy.
Data Source
AI summary
A method for modifying a call graph may include identifying, in source code, a first call site including a first predicate and a call from a first function to a second function. The first call site may correspond to a first edge of the call graph. The first edge may connect a first node corresponding to the first function and a second node corresponding to the second function. The method may further include modifying the call graph by labelling the first edge with a first encoding of the first predicate, and identifying, in the source code, a second call site including a second predicate and a call from a third function to the first function. The method may further include in response to determining that the first predicate is unsatisfied, modifying the call graph by labelling the second edge with a second encoding of a violation of the first predicate.