Establish the scalability and diagnostic accuracy of the SSA-to-Z3 layer

Establish the speed and diagnostic accuracy of CPL’s SSA-form HIR symbolic diagnostic layer for path-conditioned Z3 queries, including how solver cost grows with function size and path count and the layer’s false-positive and false-negative rates.

Background

CPL includes an experimental symbolic-analysis layer that operates on SSA-form High IR and uses Z3 to detect null dereferences, unreachable code, and related path-sensitive conditions. The paper evaluates this component architecturally, demonstrating that SSA-form HIR can drive path-conditioned queries, but it does not measure solver time or characterize how analysis cost changes with function size and path count.

The evaluation also lacks a labeled defect corpus with known ground truth, so the precision and diagnostic accuracy of the symbolic layer cannot be quantified. Establishing these properties would require stratified functions, seeded null-dereference defects, and separate measurements of solver and total compilation time.

References

The present evaluation does not isolate solver time or characterize its growth with function size and path count. It also does not use a labeled defect corpus from which false-positive and false-negative rates could be computed. Consequently, the evaluation of the symbolic diagnostic layer remains architectural: SSA-form HIR can drive path-conditioned Z3 queries, but the speed and diagnostic accuracy of this design remain unestablished.

— CPL: A Compact C-like Systems Language with Explicit Low-Level Control  (2609.04904 - Fot et al., 4 Sep 2026) in Section 4.3, “Scalability”; Table 4, “Evaluation evidence and limitations for the evaluated aspects”