Mutual Refinements of Context-Free Language Reachability

Abstract

Context-free language reachability is an important program analysis framework, but the exact analysis problems can be intractable or undecidable, where CFL-reachability approximates such problems. For the same problem, there could be many over-approximations based on different CFLs $C_1,\ldots ,C_n$. Suppose the reachability result of each $C_i$ produces a set $P_i$ of reachable vertex pairs. Is it possible to achieve better precision than the straightforward intersection $\bigcap _{i=1}^n P_i$?

This paper gives an affirmative answer: although CFLs are not closed under intersections, in CFL-reachability we can “intersect” graphs. Specifically, we propose mutual refinement to combine different CFL-reachability-based over-approximations. Our key insight is that the standard CFL-reachability algorithm can be slightly modified to trace the edges that contribute to the reachability results of $C_1$, and $C_2$-reachability only need to consider contributing edges of $C_1$, which can, in turn, trace the edges that contribute to $C_2$-reachability, etc. We prove that there exists a unique optimal refinement result (fix-point). Experimental results show that mutual refinement can achieve better precision than the straightforward intersection with reasonable extra cost.