Control Flow Refinement and Symbolic Computation of Average Case Bound

Abstract

This paper presents a new technique for refining the complex control structure of loops that occur in imperative programs. We first introduce a new way of describing program execution patterns – ( + ,·)-path expressions, which is a subset of conventional path expressions with the operators ∨ and ∗ eliminated. The programs induced by ( + ,·)-path expressions have no path interleaving or skipping-over inner loops, which are the two main issues that cause impreciseness in program analysis. Our refinement process starts from a conventional path expression $\mathcal{E}$ obtained from the control flow graph, and aims to calculate a finite set of ( + ,·)-path expressions $\{\mathfrak{e}_1, ..., \mathfrak{e}_n\}$ such that the language generated by path expression $\mathcal{E}$ is equivalent to the union of the languages generated by each ( + ,·)-path expressions $\mathfrak{e}_i$. In theory, a conventional path expression can potentially generate an infinite set of ( + ,·)-path expressions. To remedy that, we use abstract interpretation techniques to prune the infeasible paths. In practice, the refinement process usually converges very quickly.

We have applied our method to symbolic computation of average case bound for running time of programs. To our best knowledge it is the first tool that automatically computes average case bounds. Experiments on a set of complex loop benchmarks clearly demonstrate the utility of our tool.