PAGAI: a path sensitive static analyzer

Julien Henry (1) , David Monniaux (2) , Matthieu Moy (1)

1 SYNCHRONE
2 VERIMAG - IMAG - VERIMAG

We describe the design and the implementation of PAGAI, a new static analyzer working over the LLVM compiler infrastructure, which computes inductive invariants on the numerical variables of the analyzed program. PAGAI implements various state-of-the-art algorithms combining abstract interpretation and decision procedures (SMT-solving), focusing on distinction of paths inside the control flow graph while avoiding systematic exponential enumerations. It is parametric in the abstract domain in use, the iteration algorithm, and the decision procedure. We compared the time and precision of various combinations of analysis algorithms and abstract domains, with extensive experiments both on personal benchmarks and widely available GNU programs.

Mots clés: SMT-solving; SSA; static analysis; invariants; abstract interpretation

Domaines: Langage de programmation [cs.PL]; Logique en informatique [cs.LO]

Julien Henry, David Monniaux, Matthieu Moy. PAGAI: a path sensitive static analyzer. Tools for Automatic Program AnalysiS (TAPAS 2012), Sep 2012, Deauville, France. pp.3. ⟨hal-00718438⟩