Demanded Abstract Interpretation (Extended Version)

TL;DR

This paper introduces demanded abstract interpretation, a novel approach that makes static analyzers interactive by combining incremental and demand-driven techniques, enabling faster analysis results for complex programs.

Contribution

It presents a new framework that applies incremental computation to abstract interpretation, preserving soundness and termination while enabling interactive analysis speeds.

Findings

95% of queries answered within 1.2 seconds

Framework maintains soundness and termination properties

Prototype shows promise for practical interactive static analysis

Abstract

We consider the problem of making expressive static analyzers interactive. Formal static analysis is seeing increasingly widespread adoption as a tool for verification and bug-finding, but even with powerful cloud infrastructure it can take minutes or hours to get batch analysis results after a code change. While existing techniques offer some demand-driven or incremental aspects for certain classes of analysis, the fundamental challenge we tackle is doing both for arbitrary abstract interpreters. Our technique, demanded abstract interpretation, lifts program syntax and analysis state to a dynamically evolving graph structure, in which program edits, client-issued queries, and evaluation of abstract semantics are all treated uniformly. The key difficulty addressed by our approach is the application of general incremental computation techniques to the complex, cyclic dependency structure induced by abstract interpretation of loops with widening operators. We prove that desirable abstract interpretation meta-properties, including soundness and termination, are preserved in our approach, and that demanded analysis results are equal to those computed by a batch abstract interpretation. Experimental results suggest promise for a prototype demanded abstract interpretation framework: by combining incremental and demand-driven techniques, our framework consistently delivers analysis results at interactive speeds, answering 95% of queries within 1.2 seconds.