Efficiently intertwining widening and narrowing

Non-trivial analysis problems require posets with infinite ascending and descending chains. In order to compute reasonably precise post-fixpoints of the resulting systems of equations, Cousot and Cousot have suggested accelerated fixpoint iteration by means of widening and narrowing (Cousot and Cousot, 1976, 1977a). The strict separation into phases, however, may unnecessarily give up precision that cannot be recovered later, as over-approximated interim results have to be fully propagated through the equation the system. Additionally, classical two-phased approach is not suitable for equation systems with infinitely many unknowns—where demand driven solving must be used. Construction of an intertwined approach must be able to answer when it is safe to apply narrowing— or when widening must be applied. In general, this is a difficult problem. In case the right-hand sides of equations are monotonic, however, we can always apply narrowing whenever we have reached a post-fixpoint for an equation. The assumption of monotonicity, though, is not met in presence of widening. It is also not met by equation systems corresponding to context-sensitive inter-procedural ✩This article extends and generalizes results presented by Apinis et al. (2013) by integrating key ideas from Amato and Scozzari (2013). ✩✩This work was partially supported by the ARTEMIS Joint Undertaking under grant agreement n° 269335 and from the German Science Foundation (DFG). Email addresses: [email protected] (Gianluca Amato), [email protected] (Francesca Scozzari), [email protected] (Helmut Seidl), [email protected] (Kalmer Apinis), [email protected] (Vesal Vojdani) Preprint submitted to Elsevier March 4, 2015 analysis, possibly combining context-sensitive analysis of local information with flow-insensitive analysis of globals (Apinis et al., 2012). As a remedy, we present a novel operator that combines a given widening operator with a given narrowing operator . We present adapted versions of round-robin as well as of worklist iteration, local and side-effecting solving algorithms for the combined operator and prove that the resulting solvers always return sound results and are guaranteed to terminate for monotonic systems whenever only finitely many unknowns (constraint variables) are encountered. Practical remedies are proposed for termination in the non-monotonic case. Beyond that, we also discuss extensions of the base local solver that allow to further enhance precision such as localized application of the operator and restarting of the iteration for subsets of unknowns.