Explore a simpler model
Initially, no relationships between branch conditions are remembered. Each individually feasible branch can be taken.
THE PROGRAM · SVF IR
CFG WITH SVF OPERATIONS
Reachable state Unreachable Candidate Rejected
PREDICATES & REASONING
TRACKED PREDICATES
Select a model state to inspect its facts. Its source line will highlight on the left.
Program structure comes from SVF; predicates refine the model.Replay of completed analyses. No compiler runs in your browser.
Inspect the original control-flow graph
CONTROL FLOW · BEFORE ABSTRACTION
click a statement to inspectInspect a program step
Select a statement to see its source and possible next steps.
02 / THE IDEA
Forget details.
Keep the possibilities.
An abstraction includes every real execution—and sometimes a few impossible ones. Refinement teaches it which distinctions matter.
Put the whole path on trial
Z3 checks all its branch constraints together. SAT gives an input that reaches the error. UNSAT exposes a false alarm.
Remember one useful fact
Add a predicate from the rejected path and explore again. States now distinguish whether that fact is true or false.
↺ Repeat until the error is unreachable, a real bug is found, or the checker reaches its limits.
03 / UNDER THE HOOD
Small scope. Real machinery.
A C++ checker built against an existing SVF toolchain. Every verdict above was produced by an actual analysis run.
What SVF contributes
The interprocedural control-flow graph and its attached statements. Comparisons and arithmetic are translated from CmpStmt and BinaryOPStmt; LLVM supplies integer widths, constants, and source locations.
What we added
Boolean predicate valuations, abstract reachability, complete path checks, and refinement. In this acyclic subset, expressions expand to immutable inputs, so predicates keep their meaning across the graph.
Background on predicate analysis ↗Where it stops
32-bit inputs; bit-vector arithmetic. No loops, memory, general function calls, or value-merging phi instructions yet. Unsupported input returns UNKNOWN. SAFE means safe within this supported model.