## Modular Static Program Analysis (2002)

### Cached

### Download Links

- [www.di.ens.fr]
- [www.di.ens.fr]
- [www.di.ens.fr]
- DBLP

### Other Repositories/Bibliography

Venue: | Proceedings of Compiler Construction |

Citations: | 28 - 2 self |

### BibTeX

@INPROCEEDINGS{Cousot02modularstatic,

author = {Patrick Cousot and Radhia Cousot},

title = {Modular Static Program Analysis},

booktitle = {Proceedings of Compiler Construction},

year = {2002},

pages = {159--178},

publisher = {Springer-Verlag}

}

### Years of Citing Articles

### OpenURL

### Abstract

Abstract. The purpose of this paper is to present four basic methods for interpretation: – simplification-based separate analysis; – worst-case separate analysis; – separate analysis with (user-provided) interfaces; – symbolic relational separate analysis; as well as a fifth category which is essentially obtained by composition of the above separate local analyses together with global analysis methods. 1

### Citations

1880 |
Abstract Interpretation: A Unified Lattice Model for Static Analysis of Programs by Construction or Approximation of Fixpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...n independent computers, the global program analysis time may also reduced. 2 Global Static Program Analysis The formulation of global static program analysis in the abstract interpretation framework =-=[11, 16, 17, 21]-=- consists in computing an approximation of a program semantics expressing the properties of interest of the program P to be analyzed. The semantics can often be expressed as a least fixpoint S�P � =lf... |

639 |
Partial Evaluation and Automatic Program Generation. Available online: http://www.itu.dk/people/sestoft/pebook
- Jones, Gomard, et al.
- 1993
(Show Context)
Citation Context ...functional programs, many program static analysis, transformation and optimization techniques are directly applicable to do so such as algebraic simplication, constant propagation, partial evaluation =-=[54]-=-, compilation, etc. For each program part, the xpoint transformersF #P i # (often expressed as a system of equations X =sF #P i #(X) or equivalently as constraintssF #P i #(X) # i X, [26]) is simplied... |

631 | Systematic Design of Program Analysis Frameworks
- Cousot, Cousot
- 1979
(Show Context)
Citation Context ...n independent computers, the global program analysis time may also reduced. 2 Global Static Program Analysis The formulation of global static program analysis in the abstract interpretation framework =-=[11, 16, 17, 21]-=- consists in computing an approximation of a program semantics expressing the properties of interest of the program P to be analyzed. The semantics can often be expressed as a least xpoint S#P # = lfp... |

572 | Automatic discovery of linear restraints among variables of a program
- Cousot, Halbwachs
- 1978
(Show Context)
Citation Context ... assumption interface). A similar example is the interprocedural pointer analysis of [59] using parameterized points-to graphs. Another example, illustrated below, uses the polyhedral abstract domain =-=[31]-=- so that functions (or procedures in the case of imperative programs) can be approximated by relations. These relations can be further approximated by linear inequalities between values of variables [... |

563 |
Assigning meanings to programs
- Floyd
- 1967
(Show Context)
Citation Context ...to one connected component only, so as to reduce the memory size needed to separately analyze the parts. If we have G 12 # A 12 and G 21 # A 21 then G 12 and G 21 are invariants in the sense of Floyd =-=[40]-=- so that no global iteration is needed. Otherwise the external iteration can be used to strengthen the interface until a xpoint is reached, as done in Sec. 8.2. The limit of this approach is close to ... |

386 | Context-sensitive interprocedural points-to analysis in the presence of function pointers
- EMAMI, GHIYA, et al.
- 1994
(Show Context)
Citation Context ...ady indicated that a preliminary rough global program analysis can always be performed to improve the information available before performing a local analysis. A classical example is pointer analysis =-=[35, 41, 5053, 56, 58, 59, 64, 67, 72]-=-, see an overview in [69]. A preliminary pointer analysis is often mandatory since making conservative assumptions regarding pointer accesses can adversely aect the precision and eciency of the analys... |

324 | Optimization of object-oriented programs using static class hierarchy analysis
- DEAN, GROVE, et al.
- 1995
(Show Context)
Citation Context ...te analysis of Sec. 5 or by an over-estimation of the dependence graph (such as the 0-CFA control-ow analysis in functional languages [70] or the class hierarchy analysis in object-oriented languages =-=[33]-=-). 9 Conclusion The wide range of program static analysis techniques that have been developed over the past two decades allows to analyze very large programs (over 1.4 million lines of code) in a few ... |

286 | Abstract Interpretation and Applications to Logic Programs
- Cousot, Cousot
- 1994
(Show Context)
Citation Context ...c steps of program analysis (e.g. for forward reachability analysis, backward ancestry analysis, etc.). More complex analyzes are obtained by combining these basic xpoint computations (see e.g. [11], =-=[23]-=- or [29, 61] for abstract testing of temporal properties of program) . 4 P. Cousot & P. Cousot The type of static whole-program analysis methods that we have briey described above is global in that th... |

238 | Abstract interpretation frameworks
- Cousot, Cousot
- 1992
(Show Context)
Citation Context ...at p # #(p) and has a best/more precise abstraction #(p) #sD (Other formalizations through closure operators, ideals, etc. are equivalent [11, 21]. The best abstraction hypothesis can also be relaxed =-=[24]-=-). Then global static program analysis consists in computing an abstract least xpoint S#P # = lfp #sF #P # which is a sound approximation of the concrete semantics in that lfp # F #P # # #(lfp # F #P ... |

141 | Undecidability of static analysis
- Landi
- 1992
(Show Context)
Citation Context ...ady indicated that a preliminary rough global program analysis can always be performed to improve the information available before performing a local analysis. A classical example is pointer analysis =-=[35, 41, 5053, 56, 58, 59, 64, 67, 72]-=-, see an overview in [69]. A preliminary pointer analysis is often mandatory since making conservative assumptions regarding pointer accesses can adversely aect the precision and eciency of the analys... |

136 |
Abstract interpretation: a unied lattice model for static analysis of programs by construction or approximation of xpoints
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...n independent computers, the global program analysis time may also reduced. 2 Global Static Program Analysis The formulation of global static program analysis in the abstract interpretation framework =-=[11, 16, 17, 21]-=- consists in computing an approximation of a program semantics expressing the properties of interest of the program P to be analyzed. The semantics can often be expressed as a least xpoint S#P # = lfp... |

118 | Efficient chaotic iteration strategies with widenings
- Bourdoncle
- 1993
(Show Context)
Citation Context ...bed above is global in that the whole program text is needed to establish the system of equations and this system of equations is solved iteratively at once. In practice, chaotic iteration strategies =-=[5, 18]-=- can be used to iterate successively on components of the system of equations (as determined by a topological ordering of the dependency graph of the system of equations). However, in the worst case, ... |

109 | Componential set-based analysis
- Flanagan, Felleisen
- 1997
(Show Context)
Citation Context ... a more precise abstraction, into F s #P i #. Examples of application of this simplication idea can be found in the analysis of procedures of [17, Sec. 4.2], in the componential set-based analysis of =-=[38]-=-, in the variable substitution transformation of [66] and in the summary optimization of [67]. Another example is abstract compilation where the equations and xpoint computation are compiled (often in... |

102 | Relevant context inference
- CHATTERJEE, RYDER, et al.
- 1999
(Show Context)
Citation Context ...t if the function/procedure may be analyzed only once, not for all dierent possible contexts). An example of such a symbolic relational separate analysis is the notion of summary transfer function of =-=[6, 7]-=- in the context of points-to analysis for C++. Modular Static Program Analysis 13 A summary transfer function for a method expresses the eects of the method invocation on the points-to solution parame... |

99 | Avoiding exponential explosion: generating compact verification conditions
- Flanagan, Saxe
- 2001
(Show Context)
Citation Context ... based upon the simplication of the equations to be solved. We do not consider here local simplications of the equations (that is simplication of one equation independently of the others such as e.g. =-=[39]-=-) but global simplications, where the simplication of one equation requires the examination of other equations. Since these systems of equations can be considered as functional programs, many program ... |

99 | Role analysis
- Kuncak, Lam, et al.
- 2002
(Show Context)
Citation Context ...ntee specications of [10]). Examples of user-provided interfaces in static program analysis are the control-ow analysis of [71], the notion of summary information of [48, 67] and the role analysis of =-=[55]-=-. A particular case is when no assumption is made on the interface of each program part with its external environment so that the automatic generation of the properties guaranteed by the program part ... |

98 | Interprocedural pointer alias analysis
- Hind, Burke, et al.
- 1999
(Show Context)
Citation Context ...ady indicated that a preliminary rough global program analysis can always be performed to improve the information available before performing a local analysis. A classical example is pointer analysis =-=[35,41,50,51,52,53,56, 58,59,64,67,72]-=-, see an overview in [69]. A preliminary pointer analysis is often mandatory since making conservative assumptions regarding pointer accesses can adversely affect the precision and efficiency of the a... |

93 |
Making abstract interpretations complete
- Giacobazzi, Ranzato, et al.
(Show Context)
Citation Context ...e abstract domains 〈D, ⊑〉, 〈D1, ⊑ 1〉, ..., 〈Dn, ⊑ n〉 between the successive iterations k. The choice of this refinement can be guided by interaction with the user. Sometimes, it can also be automated =-=[43,44,45]-=-. 8.3 Creating Parts through Cutpoints x Most often the parts P1, ..., Pn of a program P [P1,...,Pn] are determined on syntactic criteria (such as components, modules, classes, functions, procedures, ... |

92 |
Static determination of dynamic properties of recursive procedures
- Cousot, Cousot
- 1977
(Show Context)
Citation Context ...= lfp # F #P #[lfp # 1 F #P 1 #, . . . , lfp # n F #P n #] where F #P i # # D i m #--# D i , i = 1, . . . , n and F #P # # (D 1 . . . D n ) m #--# (D m #--# D) are (componentwise) monotonic (see e.g. =-=[20]-=-). The compositional separate modular static analysis of the program P [P 1 , . . . , P n ] is based on separate abstractions #D i , # i # ---# #--- # i # i # D i ,s# i #, for each part P i , i = 1, .... |

92 | Putting pointer analysis to work
- GHIYA, HENDREN
- 1998
(Show Context)
Citation Context ...ady indicated that a preliminary rough global program analysis can always be performed to improve the information available before performing a local analysis. A classical example is pointer analysis =-=[35, 41, 5053, 56, 58, 59, 64, 67, 72]-=-, see an overview in [69]. A preliminary pointer analysis is often mandatory since making conservative assumptions regarding pointer accesses can adversely aect the precision and eciency of the analys... |

90 |
Méthodes itératives de construction et d’approximation de points fixes d’opérateurs monotones sur un treillis, analyse sémantique des programmes. Université Scientifique et Médicale de Grenoble
- Cousot
- 1978
(Show Context)
Citation Context ...n independent computers, the global program analysis time may also reduced. 2 Global Static Program Analysis The formulation of global static program analysis in the abstract interpretation framework =-=[11, 16, 17, 21]-=- consists in computing an approximation of a program semantics expressing the properties of interest of the program P to be analyzed. The semantics can often be expressed as a least fixpoint S�P � =lf... |

89 |
Escape Analysis for Object-Oriented Languages: Application to Java
- Blanchet
- 1999
(Show Context)
Citation Context ...is computed as a function of the escape information for the result. For Java TM , it is not a function but a relation between the various escape information available on the parameters and the result =-=[3]-=-. This symbolic relational separate analysis may degenerate in the simplication case of Sec. 4 if no local iteration is possible. However this situation is rare since it is quite uncommon that all pro... |

89 |
Semantic foundations of program analysis
- Cousot
- 1981
(Show Context)
Citation Context ...is interface can sometimes be generated automatically. For example, a backward analysis of absence of run-time errors or exceptions (such as the backward analysis using greatest xpoints introduced in =-=[12]-=-) or any other ancestry analysis (e.g. to compute necessary termination conditions [12] or success conditions for logic programs [42]) can be used to automatically determine conditions on the interfac... |

84 | Efficient points-to analysis for whole-program analysis
- Liang, Harrold
- 1999
(Show Context)
Citation Context |

80 |
The undecidability of aliasing
- Ramalingam
- 1994
(Show Context)
Citation Context |

73 | Automatic Mode Inference for Logic Programs
- Debray, Warren
- 1988
(Show Context)
Citation Context ... equations and xpoint computation are compiled (often in the same language as the one to be analyzed so that program analysis amounts to the execution of an abstract compilation of program), see e.g. =-=[1, 4, 9, 34, 60]-=-. Since the local analysis phases of the program parts P i , which consist in computing the xpoints lfp # isF #P i # are delayed until the global analysis phase, which consists in computing lfp #sF #P... |

72 |
Methods and logics for proving programs
- Cousot
- 1990
(Show Context)
Citation Context ...ions in the program and use and/or modify global variables. In Pascal, a program may modify variables on the program execution stack at a program point where these variables are even not visible (see =-=[13]-=-). A very simple formalization consists in considering that the semantics of the program can be specied in the following equational form: # # # # Y = F #P [P 1 , . . . , P n ]## # Y , # X 1 , . . ., #... |

71 | Formal language, grammar and set-constraint-based program analysis by abstract interpretation
- Cousot, Cousot
- 1995
(Show Context)
Citation Context ...thods [17] as follows: X0 = { x:_O_ } X1 = { x:[1,1000] } X2 = { x:[1,999] } X3 = { x:[2,1000] } X4 = { x:[1000,1000] } Some static program analysis methods (such as typing [14] or set based-analysis =-=[27]-=-) consist in solving constraints (also called verication conditions, etc.), but this is equivalent to iterative xpoint computation [26], maybe with widening [27] (since the least solution to the const... |

62 | A New Numeric Abstract Domain Based on Difference-Bound Matrices
- Miné
- 2001
(Show Context)
Citation Context ...e numerical constants) by a more precise symbolic interval analysis (using intervals [L, H] where L and H are mathematical variables, which can be implemented through the octagonal abstract domain of =-=[63]-=-). The global analysis of the program consists in composing the analyses � Ai, i = 1,...,n of these program parts Pi, i =1,...,n to get the required information on the whole program by computing lfp ¯... |

61 | Escape analysis: correctness proof, implementation and experimental results
- Blanchet
- 1998
(Show Context)
Citation Context ...ystem of equations is then approximated iteratively using widening/narrowing iterative convergence acceleration methods [17] as follows: X0 = { x:_O_ } X1 = { x:[1,1000] } X2 = { x:[1,999] } X3 = { x:=-=[2,1000]-=- } X4 = { x:[1000,1000] } Some static program analysis methods (such as typing [14] or set based-analysis [27]) consist in solving constraints (also called verication conditions, etc.), but this is eq... |

61 | Efficient computation of interprocedural definition-use chains
- Harrold, Soffa
- 1994
(Show Context)
Citation Context ...stem of equations (as determined by a topological ordering of the dependency graph of the system of equations). Such dependences can also be refined on semantic grounds (such as definition-use chains =-=[49]-=-). These dependences can be used as a basis to split the whole program into parts by introducing interfaces as considered in Sec. 6. For example, with a dependence graph of the form: C 1 the iteration... |

57 | Systematic design of program transformation frameworks by abstract interpretation
- Cousot, Cousot
- 2002
(Show Context)
Citation Context ...1sF s #P 1 #, . . . , lfp # nsF s #P n #] so that the xpoints for the parts are computed in a completely known context or environment. Very often,sF s is obtained by abstract interpretation ofsF (see =-=[30]-=- for a formalization of such transformations as abstract interpretations). A frequently used variant of this idea consists in rst using a preliminary global analysis of the whole program P [P 1 , . . ... |

55 | Compositional Analysis of Modular Logic Programs
- Codish, Debray, et al.
- 1993
(Show Context)
Citation Context ...## # Y , # X 1 , . . ., # X # j , . . ., # X n #). It is often the case that this dependency graph is built before the analysis and parts are analyzed in sequence by their topological order (see e.g. =-=[8, 57]-=-). As in most incremental compilation systems, circular dependency may not be considered (i.e. all circularly dependent parts are grouped into a single part since an iterative analysis is necessary). ... |

55 |
Automatic synthesis of optimal invariant assertions mathematical foundation
- Cousot, Cousot
(Show Context)
Citation Context ...ies, etc.). A preliminary static analysis can also be used to determine the parts on semantic grounds. For example in Sec. 2 on global static analysis, we have considered chaotic iteration strategies =-=[5, 18]-=- that can be used to iterate successively on components of the system of equations (as determined by a topological ordering of the dependency graph of the system of equations). Such dependences can al... |

55 | The semantics of Scheme control-flow analysis
- Shivers
- 1991
(Show Context)
Citation Context ...al costs can then only cut down through of the worst-case separate analysis of Sec. 5 or by an over-estimation of the dependence graph (such as the 0-CFA control-flow analysis in functional languages =-=[70]-=- or the class hierarchy analysis in object-oriented languages [33]). 9 Conclusion The wide range of program static analysis techniques that have been developed over the past two decades allows to anal... |

54 | Estimating the impact of scalable pointer analysis on optimization
- Das, Liblit, et al.
- 2001
(Show Context)
Citation Context ...analysis techniques that have been developed over the past two decades allows to analyze very large programs (over 1.4 million lines of code) in a few seconds or minutes but with a very low precision =-=[32]-=- up to precise relational analyses which are able to analyze large programs (over 120 thousands lines of code) in a few hours or days [65] and to very detailed and precise analyzes that do not scale u... |

54 | Safety checking of machine code
- Xu, Miller, et al.
- 2000
(Show Context)
Citation Context ...yhedral domain is too expensive, the less precise domain of dierence bound matrices [63] can also be used for the local relational analyzes of program parts. This is essentially the technique used by =-=[73]-=-. 8.5 Unknown Dependence Graph Separate static program analysis is very dicult when the dependence graph is not known in a modular way (which is the case with higher-order functions in functional lang... |

53 | The calculational design of a generic abstract interpreter - Cousot - 1999 |

53 | Incompleteness, counterexamples and refinements in abstract model-checking
- Giacobazzi, Quintarelli
- 2001
(Show Context)
Citation Context ...e abstract domains 〈D, ⊑〉, 〈D1, ⊑ 1〉, ..., 〈Dn, ⊑ n〉 between the successive iterations k. The choice of this refinement can be guided by interaction with the user. Sometimes, it can also be automated =-=[43,44,45]-=-. 8.3 Creating Parts through Cutpoints x Most often the parts P1, ..., Pn of a program P [P1,...,Pn] are determined on syntactic criteria (such as components, modules, classes, functions, procedures, ... |

51 | Off-line variable substitution for scaling points-to analysis
- Rountev, Chandra
- 2000
(Show Context)
Citation Context ...of application of this simplification idea can be found in the analysis of procedures of [17, Sec. 4.2], in the componential set-based analysis of [38], in the variable substitution transformation of =-=[66]-=- and in the summary optimization of [67]. Another example is abstract compilation where the equations and fixpoint computation are compiled (often in the same language as the one to be analyzed so tha... |

43 | Data-flow analysis of program fragments
- Rountev, Ryder, et al.
- 1999
(Show Context)
Citation Context ...nformation on the interface # Y , # X 1 , . . . , # X i-1 , # X i+1 , . . . , # X n more precise than the unknown #. An example is the preliminary inexpensive whole-program points-to analysis made by =-=[68]-=- before their modular/fragment analysis. 6 Separate Analysis with (User-Provided) Interfaces The idea of interface-based separate program analysis is to ask the user to provide information about the p... |

39 | Deriving polymorphic type dependencies for logic programs using multiple incarnations of Prop
- Codish, Demoen
- 1994
(Show Context)
Citation Context ... equations and xpoint computation are compiled (often in the same language as the one to be analyzed so that program analysis amounts to the execution of an abstract compilation of program), see e.g. =-=[1, 4, 9, 34, 60]-=-. Since the local analysis phases of the program parts P i , which consist in computing the xpoints lfp # isF #P i # are delayed until the global analysis phase, which consists in computing lfp #sF #P... |

39 | Accessing the effects of flow-sensitivity on pointer alias analyses
- Hind, Pioli
- 1998
(Show Context)
Citation Context ...ady indicated that a preliminary rough global program analysis can always be performed to improve the information available before performing a local analysis. A classical example is pointer analysis =-=[35,41,50,51,52,53,56, 58,59,64,67,72]-=-, see an overview in [69]. A preliminary pointer analysis is often mandatory since making conservative assumptions regarding pointer accesses can adversely affect the precision and efficiency of the a... |

38 | Types as abstract interpretations (Invited Paper
- Cousot
- 1997
(Show Context)
Citation Context ...convergence acceleration methods [17] as follows: X0 = { x:_O_ } X1 = { x:[1,1000] } X2 = { x:[1,999] } X3 = { x:[2,1000] } X4 = { x:[1000,1000] } Some static program analysis methods (such as typing =-=[14]-=- or set based-analysis [27]) consist in solving constraints (also called verication conditions, etc.), but this is equivalent to iterative xpoint computation [26], maybe with widening [27] (since the ... |

37 | Precise flow-insensitive May-Alias analysis is NP-hard
- Horwitz
- 1997
(Show Context)
Citation Context ...ady indicated that a preliminary rough global program analysis can always be performed to improve the information available before performing a local analysis. A classical example is pointer analysis =-=[35,41,50,51,52,53,56, 58,59,64,67,72]-=-, see an overview in [69]. A preliminary pointer analysis is often mandatory since making conservative assumptions regarding pointer accesses can adversely affect the precision and efficiency of the a... |

36 |
Détermination Automatique de Relations Linéaires Vérifiées par les Variables d’un Programme
- Halbwachs
- 1979
(Show Context)
Citation Context ... can be approximated by relations. These relations can be further approximated by linear inequalities between values of variables [31]. Let us illustrate this method using a Pascal example taken from =-=[46]-=-: procedure Hanoi (n : integer; var a, b, c : integer; var Ta, Tb, Tc : Tower); begin { n = n0 ∧ a = a0 ∧ b = b0 ∧ c = c0 } if n = 1 then begin b := b + 1; Tb[b] := Ta[a]; Ta[a] := 0; a := a − 1; { n ... |

30 | Points-to and side-effect analyses for programs built with precompiled libraries
- Rountev, Ryder
(Show Context)
Citation Context ...ea can be found in the analysis of procedures of [17, Sec. 4.2], in the componential set-based analysis of [38], in the variable substitution transformation of [66] and in the summary optimization of =-=[67]-=-. Another example is abstract compilation where the equations and fixpoint computation are compiled (often in the same language as the one to be analyzed so that program analysis amounts to the execut... |

29 | Abstract interpretation based formal methods and future challenges, invited paper
- Cousot
- 2001
(Show Context)
Citation Context ...n independent computers, the global program analysis time may also reduced. 2 Global Static Program Analysis The formulation of global static program analysis in the abstract interpretation framework =-=[11, 16, 17, 21]-=- consists in computing an approximation of a program semantics expressing the properties of interest of the program P to be analyzed. The semantics can often be expressed as a least xpoint S#P # = lfp... |

28 | Refining and compressing abstract domains
- Giacobazzi, Ranzato
- 1997
(Show Context)
Citation Context ...e abstract domains 〈D, ⊑〉, 〈D1, ⊑ 1〉, ..., 〈Dn, ⊑ n〉 between the successive iterations k. The choice of this refinement can be guided by interaction with the user. Sometimes, it can also be automated =-=[43,44,45]-=-. 8.3 Creating Parts through Cutpoints x Most often the parts P1, ..., Pn of a program P [P1,...,Pn] are determined on syntactic criteria (such as components, modules, classes, functions, procedures, ... |

27 | Efficient computation of parameterized pointer information for interprocedural analyses
- Liang, Harrold
- 2001
(Show Context)
Citation Context ...eters which are in the same class as the formal parameters (as well as their potential aliases, as specified in the assumption interface). A similar example is the interprocedural pointer analysis of =-=[59]-=- using parameterized points-to graphs. Another example, illustrated below, uses the polyhedral abstract domain [31] so that functions (or procedures in the case of imperative programs) can be approxim... |