Inferring grammatical summaries of string values

Abstract

We present a new kind of static analysis that infers grammatical summaries of string values. We are given a context-free grammar and a program which contains string expressions whose values should be partial sentences of the grammar. A grammatical summary of an expression is a vocabulary string of the grammar that derives all the possible string values of the expression. Our analysis automatically finds out such grammatical summaries. We design the analysis using abstract interpretation framework making it pluggable into conventional data-flow analysis frameworks. In addition to the theoretical foundation of the analysis, we present how we make the analysis computable and tractable. While inferring grammatical summaries of a string expression often results in an infinite number of summaries,wemake the inference computable by using aCFL-reachability algorithm and finite state automata representation. Additionally, wemake the analysismore tractable by several optimization techniques such as keeping only relevant summaries and using two-level grammars. These techniques achieve huge speedup in our experiments.