Statically Analyzing the Dataflow of R Programs

Statically Analyzing the Dataflow of R Programs Florian Sihler and Matthias Tichy 1) Parse We rely on either the R parser or a tree-sitter grammar to convert the input files into an abstract syntax tree (AST). The figure on the right illustrates the AST for the R code a<-42;b<-3;a assuming we are interested in the use of a. exprlist expr expr SYMBOL LEFT_ASSIGN expr NUM_CONST ; ... expr SYMBOL a <- ;42 a 2) Normalize Subsequently, we create a uniform and version-independent representation of the AST, abstracting away from the intricacies of R. Currently, our normalization supports R versions 3.6–4.5. RExpressionList RBinaryOp RSymbol RNumber ... RSymbol 0 lhs rhs 1 2 a <- 42 a 3) Dataflow Analysis The analysis uses a syntax-guided approach in the form of a stateful fold over the normalized AST, intertwining dataand controlflow analysis. Fold handlers are dispatched dynamically using an abstractinterpretation of the R environment (mapping symbols to their definitions). We support side-effects, higher-order functions, sourced files, and more of R’s dynamic nature. The figure on the left illustrates the incrementally constructed dataflow graph, desugaring constructs like <- into a function call (mirroring R’s semantics). For packages, we currently rely on predefined dataflow summaries. <- 42 a arg arg, ret def-by def-by a<- 3 b arg arg, ret def-by def-by reads Symbol use Value Symbol definition Function call (very simplified) 4) Backward Program Slicing A backward slice for a program point is a subset of the program containing only the parts that may have an influence on the computation at that point. Using the dataflow graph, this can be reduced to to a reachability problem (and the dual forward slice to reachability on the inverted graph). Slicing can help researchers in various ways, e.g., by reducing the program to just the parts relevant ot a specific visualization or test. <- 42 a arg arg, ret def-by def-by a<- 3 b arg arg, ret def-by def-by reads 1 2 3 4 5) Reconstruction Asafinalstep,weusethenodesselectedbythebackwardprogram slicing to reconstruct an executable R program. a <- 42 a OOPSLA 25 flowR A dataflow analysis framework for the R programming language. Available for VS Code, Positron, and RStudio. 87.5% average reduction in LOC when slicing for points of interest 576ms average time to analyze an R project (no caching, 1 thread) 99.7% identical results with automated input-output equivalence testing 4103 real-world research artifacts 779 points of interest October, 2025 Institute of Software Engineering and Programming Languages Ulm University