一句话：通过符号化内存副作用构建惰性符号表达式图，按需生成过程间值流，大幅加速路径敏感指针分析与缺陷搜索。
稀疏值流分析（SVFA）是检测空指针解引用、内存泄漏等缺陷的关键技术，但其依赖的路径敏感指针分析在工业级项目上面临严重可扩展性问题，尤其是摘要爆炸（summary-explosion）。本文提出 Hermes：它将内存副作用符号化，并构建一种不完整的稀疏值流图——惰性符号表达式图（LSEG）；在此结构上，Hermes 仅在必要时为缺陷检测构建过程间值流，从而显著降低指针分析开销并精简缺陷搜索路径。作者在大规模真实项目上进行了评估，结果表明，与当前最优方法相比，Hermes 在指针分析和缺陷搜索上分别取得至少 9.84 倍的平均加速，且不损失缺陷检测的有效性。
Sparse Value-Flow Analysis (SVFA) is essential for detecting software bugs such as null pointer dereference and memory leak. However, SVFA heavily relies on path-sensitive pointer analysis, which faces significant scalability challenges when analyzing industrial-scale projects, notably the summary-explosion problem. To address this issue, we propose Hermes , which symbolizes memory side effects and constructs an incomplete Sparse Value-Flow Graph (SVFG) called Lazy Symbolic Expression Graph (LSEG). Leveraging this structure, Hermes builds inter-procedural value flows relevant to bug detection only when necessary, significantly reducing the overhead of pointer analysis and streamlining the bug-search paths. Evaluations on large-scale real-world projects demonstrate that, compared to the state-of-the-art, Hermes achieves average speedups of at least 9.84× and 9.84× for pointer analysis and bug search, respectively, without sacrificing the effectiveness of bug detection.
@article{paperbot3842,
title = {Hermes: Making Path-Sensitive Pointer Analysis Scalable for Sparse Value-Flow Analysis},
author = {Yuxuan He and Ruilin Jiang and He Zhang and Qingkai Shi and Huaxun Huang and Rongxin Wu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {10},
number = {OOPSLA1},
year = {2026},
doi = {10.1145/3798211}
}