Same Engine, Multiple Gears: Parallelizing Fixpoint Iteration at Different Granularities (Extended Version)

TL;DR

This work addresses accelerating fixpoint-based static analyses by introducing a parametric, parallelizable TLTD engine whose task granularity is driven by root unknowns. It presents two parallelization strategies—Immediate (shared transactional data) and Independent (local task state with publish/subscribe for globals)—and demonstrates their effectiveness within Goblint on real-world C programs. Empirical results show meaningful speedups across 47 programs, with average improvements around 3x and maximum gains up to roughly 11x under certain configurations, while precision remains broadly preserved. The findings highlight the importance of demand placement and granularity in parallel analyses and establish a foundation for flexible, scalable parallel fixpoint computation in static analysis tools.

Abstract

Fixpoint iteration constitutes the algorithmic core of static analyzers. Parallelizing the fixpoint engine can significantly reduce analysis times. Previous approaches typically fix the granularity of tasks upfront, e.g., at the level of program threads or procedures - yielding an engine permanently stuck in one gear. Instead, we propose to parallelize a generic fixpoint engine in a way that is parametric in the task granularity - meaning that our engine can be run in different gears. We build on the top-down solver TD, extended with support for mixed-flow sensitivity, and realize two competing philosophies for parallelization, both building on a task pool that schedules tasks to a fixed number of workers. The nature of tasks differs between the philosophies. In the immediate approach, all tasks access a single thread-safe hash table maintaining solver state, while in the independent approach, each task has its own state and exchanges data with other tasks via a publish/subscribe data structure. We have equipped the fixpoint engine of the static analysis framework Goblint with implementations following both philosophies and report on our results for large real-world programs.

Figures (5)

• Figure 1: A multi-threaded C program
• Figure 2: The top-level loop of TLTD
• Figure 3: The core fixpoint iterator of TLTD.
• Figure 4: The auxiliary function destabilize
• Figure 5: Pub/Sub system for global unknown updates