Interprocedurally Analyzing Linear Inequality Relations

We present an abstraction of the effect of procedures through convex sets of transition matrices. Conditional branching is handled by postponing the conditional evaluation after the procedure call. In order to obtain an effective analysis convex sets are represented by polyhedra. For an efficient implementation we approximate polyhedra by means of simplices. In [CH78], Cousot and Halbwachs present an intraprocedural analysis of linear inequalities based on an abstraction of the collecting semantics [CC92] by means of convex polyhedra. They draw upon both the frame and the constraint representation of polyhedra to perform the subsumption test and widening [CH78] on polyhedra. More precise widening strategies on convex polyhedra are provided in [BZHR03]. Based on this approach, an interprocedural analysis can be obtained by relating input and output states of a procedure call by means of linear inequalities. This leads to transition invariants on program variables before and after the procedure call. In the simple example in figure 1 (from [MOS04]) the relational semantics of procedure call f() at program state 2 can be described by the transition invariants x = xold ∨ x = 2 · xold − 2. The approximation of these invariants by polyhedra leads to a complete loss of information. Although this approach works in several practical cases (e.g. McCarthy91 function [MM70]), it is too restrictive for a precise interprocedural analysis.