[Paper Review] Event-Flow Graphs for Efficient Path-Sensitive Analyses

Ahmed Tamrawi, Suresh Kothari|arXiv (Cornell University)|Apr 4, 2014

Software Testing and Debugging Techniques22 references3 citations

TL;DR

This paper introduces Event-Flow Graphs (EFGs), a compact, linear-time derivative of control-flow graphs (CFGs) that groups paths into equivalence classes based on shared event traces—sequences of relevant events and branch nodes. By focusing only on event traces and relevant branches, EFGs reduce path explosion by up to 99% and simplify feasibility checking, enabling efficient, accurate path-sensitive analysis with human-comprehensible, minimal graphs.

ABSTRACT

Efficient and accurate path-sensitive analyses pose the challenges of: (a) analyzing an exponentially-increasing number of paths in a control-flow graph (CFG), and (b) checking feasibility of paths in a CFG. We address these challenges by introducing an equivalence relation on the CFG paths to partition them into equivalence classes. It is then sufficient to perform analysis on these equivalence classes rather than on the individual paths in a CFG. This technique has two major advantages: (a) although the number of paths in a CFG can be exponentially large, the essential information to be analyzed is captured by a small number of equivalence classes, and (b) checking path feasibility becomes simpler. The key challenge is how to efficiently compute equivalence classes of paths in a CFG without examining each path in the CFG? In this paper, we present a linear-time algorithm to form equivalence classes without the need for examination of each path in a CFG. The key to this algorithm is construction of an event-flow graph (EFG), a compact derivative of the CFG, in which each path represents an equivalence class of paths in the corresponding CFG. EFGs are defined with respect to the set of events that are in turn defined by the analyzed property. The equivalence classes are thus guaranteed to preserve all the event traces in the original CFG. We present an empirical evaluation of the Linux kernel (v3.12). The EFGs in our evaluation are defined with respect to events of the spin safe-synchronization property. Evaluation results show that there are many fewer EFG-based equivalence classes compared to the corresponding number of paths in a CFG. This reduction is close to 99% for CFGs with a large number of paths. Moreover, our controlled experiment results show that EFGs are human comprehensible and compact compared to their corresponding CFGs.

Motivation & Objective

• Address the exponential growth of paths in control-flow graphs (CFGs), a major bottleneck in path-sensitive static analysis.
• Overcome the computational infeasibility of checking path feasibility for all CFG paths due to exponential path explosion.
• Develop a method to analyze only representative paths (equivalence classes) rather than all individual paths in a CFG.
• Ensure that the analysis remains sound and complete by preserving all relevant event traces and feasibility conditions.
• Create a compact, human-comprehensible, and efficiently computable graph structure (EFG) that enables scalable verification of software properties like spin lock safety.

Proposed method

• Define event traces as sequences of events and relevant branch nodes on a CFG path, where paths with identical event traces are grouped into equivalence classes.
• Introduce the Event-Flow Graph (EFG) as a derivative of the CFG that captures one path per equivalence class, with a one-to-one and onto mapping between EFG paths and equivalence classes.
• Construct EFGs in linear time using a four-step algorithm: (1) identify relevant and irrelevant branch nodes, (2) remove irrelevant branches, (3) condense the graph, and (4) apply transformations to produce a T-irreducible, acyclic, and minimal EFG.
• Leverage the concept of irrelevant branch nodes—those whose branches lead to the same event or terminal node—whose presence does not affect event traces or feasibility.
• Prove that path feasibility can be checked using only relevant branch nodes, since irrelevant branches do not affect feasibility of an equivalence class.
• Use graph-theoretic properties (e.g., boundary nodes, successor sets) to formally establish that EFGs preserve event traces and feasibility, ensuring soundness and completeness of the analysis.

Experimental results

Research questions

• RQ1 Can path-sensitive analysis be made scalable by reducing the number of paths analyzed from exponential to a manageable number of equivalence classes?
• RQ2 Can a compact, human-comprehensible graph structure be constructed in linear time that preserves all necessary event traces and feasibility information from a CFG?
• RQ3 Does focusing only on relevant branch nodes and event traces maintain soundness and completeness for verifying properties like spin lock safety?
• RQ4 To what extent can EFGs reduce the number of paths and branch nodes compared to original CFGs in real-world systems?
• RQ5 Can EFGs improve the practicality of static analysis by reducing manual verification time and enabling detection of real bugs?

Key findings

• EFGs reduce the number of paths in a CFG by up to 99% for CFGs with a large number of paths, as demonstrated in the Linux kernel v3.12 evaluation.
• The number of branch nodes is drastically reduced in EFGs compared to their corresponding CFGs, with only relevant branch nodes retained.
• The EFG construction algorithm runs in linear time, enabling efficient generation of compact, representative graphs for path-sensitive analysis.
• EFGs are human-comprehensible and significantly more compact than their corresponding CFGs, reducing manual verification time and effort.
• A controlled experiment using EFGs revealed a previously undetected bug in the Linux kernel that was accepted by the community, validating the practical effectiveness of the approach.
• Feasibility checking can be restricted to relevant branch nodes only, as irrelevant branches do not affect path feasibility, simplifying the analysis process.