Memory-efficient fixpoint computation

Abstract Practical adoption of static analysis often requires trading precision for performance. This paper focuses on improving the memory efficiency of abstract interpretation without sacrificing precision or time efficiency. Computationally, abstract interpretation reduces the problem of inferring program invariants to computing a fixpoint of a set of equations. This paper presents a method to minimize the memory footprint in Bourdoncle’s iteration strategy, a widely-used technique for fixpoint computation. Our technique is agnostic to the abstract domain used. We prove that our technique is optimal (i.e., it results in minimum memory footprint) for Bourdoncle’s iteration strategy while computing the same result. We evaluate the efficacy of our technique by implementing it in a tool called $$\textsc {Mikos}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>M</mml:mi> <mml:mstyle> <mml:mi>I</mml:mi> <mml:mi>K</mml:mi> <mml:mi>O</mml:mi> <mml:mi>S</mml:mi> </mml:mstyle> </mml:mrow> </mml:math> , which extends the state-of-the-art abstract interpreter $$\text {IKOS}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mtext>IKOS</mml:mtext> </mml:math> . On average $$\textsc {Mikos}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>M</mml:mi> <mml:mstyle> <mml:mi>I</mml:mi> <mml:mi>K</mml:mi> <mml:mi>O</mml:mi> <mml:mi>S</mml:mi> </mml:mstyle> </mml:mrow> </mml:math> demonstrated a $$24.57\times $$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>24.57</mml:mn> <mml:mo>×</mml:mo> </mml:mrow> </mml:math> and $$2.29\times $$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mn>2.29</mml:mn> <mml:mo>×</mml:mo> </mml:mrow> </mml:math> reduction in peak-memory usage compared to $$\text {IKOS}$$ <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mtext>IKOS</mml:mtext> </mml:math> when verifying user-provided assertions and performing interprocedural buffer-overflow analysis, respectively.