Program Analysis Too Loopy? Set the Loops Aside

Among the many obstacles in efficient and sound program analysis, loops may be the most prevalent. In program analyses that traverse paths, loops introduce a variable, possibly infinite, number of paths. This paper looks at whether loops could be analyzed separately and replaced with a summary. First, the complexity of a loop is estimated by counting the paths through the body of the loop. 85% of the loops have fewer than ten paths and less than 1% have more than 10,000 paths. Second, the number of paths is computed by analyzing loops separately to assess the feasibility of such an analysis approach. While the number of paths is decreased in many cases, it is typically not sufficient for long, complex functions. Finally, loops are classified based on their stopping condition and further analyzed for programming elements that may make loop analysis more difficult. Nearly half of the loops are array traversals and over half of the loops contain a function call.