Staged refinement for static analysis

A system, comprising:

• a processor;
• a repository configured to store code, wherein the code comprises an initial plurality of interest points each corresponding to a statement in the code;
• and
• a memory comprising instructions that, when executed by the processor, cause the processor to:
• generate, via a flow-insensitive points-to analysis, the initial plurality of interest points, a plurality of points-to tuples, and a call graph, the initial plurality of interest points each corresponding to a statement in the code, each of the plurality of points-to tuples comprising a points-to variable and an allocation site that refers to a location in a memory of a computer system allocated when the code is executed, wherein the flow-insensitive points-to analysis is independent of data flows and control flows among statements in the code;
• generate, via a flow-sensitive points-to analysis and using the plurality of points-to tuples and the call graph, a plurality of flow tuples and a refined plurality of interest points by removing a subset of the initial plurality of interest points, wherein the flow-sensitive points-to analysis is based on data flows and control flows among the statements in the code;
• construct a flow graph using the refined plurality of interest points, wherein the flow graph comprises:
• a plurality of nodes each corresponding to a statement in the code, and
• a plurality of edges corresponding to the plurality of flow tuples;
• and
• identify a trace through the flow graph, wherein the trace comprises a first node corresponding to a first interest point of the refined plurality of interest points.

A non-transitory computer readable medium storing instructions that, when executed by a processor, perform a method for analyzing code, the method comprising:

• generating, via a flow-insensitive points-to analysis, an initial plurality of interest points, a plurality of points-to tuples, and a call graph, the initial plurality of interest points each corresponding to a statement in the code, each of the plurality of points-to tuples comprising a points-to variable and an allocation site that refers to a location in a memory of a computer system allocated when the code is executed, wherein the flow-insensitive points-to analysis is independent of data flows and control flows among statements in the code;
• generating, via a flow-sensitive points-to analysis and using the plurality of points-to tuples and the call graph, a plurality of flow tuples and a refined plurality of interest points by removing a subset of the initial plurality of interest points, wherein the flow-sensitive points-to analysis is based on data flows and control flows among the statements in the code;
• constructing a flow graph using the refined plurality of interest points, wherein the flow graph comprises:
• a plurality of nodes each corresponding to a statement in the code, and
• a plurality of edges corresponding to the plurality of flow tuples;
• and
• identifying a trace through the flow graph, wherein the trace comprises a first node corresponding to a first interest point of the refined plurality of interest points.