Modern software verification tools are moving towards incremental verification of program properties to ensure safety of evolving software systems. These tools analyze each and every change in the code. However, not every change in the program impacts verification outcome of program properties. Moreover, analyzing these irrelevant changes adds to cost of incremental verification. To address this, we are proposing a light-weight pre-analysis phase that identifies relevant changes with respect to program properties before applying any incremental verification technique. To identify such relevant changes, we present the Relevant Change Identification Technique (RCIT). RCIT uses a variant of the Strongly Live Variables (SLV) analysis to compute variables that are influencing the verification outcome of program properties. RCIT, then uses these variables to identify relevant changes. We evaluated RCIT on the changes made in five versions of open source applications with respect to two type of program properties - array index out of bound and zero division. RCIT identifies 59% of the actual changes as irrelevant.

Static analysis tools, being scalable, are widely used to detect runtime errors in industry strength software. However, the downside is that these tools generate a large number of false alarms which considerably reduces their effectiveness in detecting the real bugs and fixing them. This shortcoming becomes more pronounced in analysis of evolving software where false alarms reported in an earlier version are re-reported while analysing subsequent versions. Ideally, developers would not like to see the re-reporting of old alarms that are inconsequential to the changes made. To address this problem, static analyzers have been enhanced with techniques like syntactic masking, and several heuristics to decide if an old alarm should be reported again or not. Naturally, however, as they do not take semantics of change into consideration, they are either unsound, or still end up reporting a large number of old alarms. This paper proposes a change-based alarm reporting approach, that reports an alarm only if the alarm point lies on a newly introduced, potentially unsafe, execution path. For this, we intro-duce a novel and effective semantic-aware change-impact analysis (CIA), that helps in detecting presence of such execution paths. In order to make this efficient, especially for development processes involving frequent code commits, our technique incrementally builds the required dataflow analyses and program dependence information. Our experiments, on 124 versions of a core banking application, demonstrate that the proposed approach is i) 66% faster than whole program analysis, ii) leads to 83% reduction in repetitive alarms, and iii) reports 62% lesser alarms as compared to syntactic CIA.