Optimization pass: demand-driven sink slicing (2026-05-25)

Area map

The working backlog is in docs/internal/perf-audit/optimization-backlog.md. The first implemented slice is demand-driven sink slicing: detectors can now tell the walker whether a statement subtree contains a detector-relevant sink before the walker pays full symbolic encoding cost for pure non-sink expression statements.

Safety rule for this slice: still encode declarations, writes, calls, new, and delete, because those can feed later sinks or mutate detector state. Only pure non-sink expression statements are skipped.

Implemented

Added SafetyObserver::shouldEncodeForObserver(const clang::Stmt*).
Added detector-specific sink-shape recognizers for:
- null deref: deref/member/subscript/call shapes
- div-by-zero: /, %, calls
- int overflow: signed integer arithmetic, calls
- oob/uaf: array subscripts and modeled libc/string sinks
Added walker-side conservative side-effect guard so slicing is precision-neutral for stateful expressions.

Validation

meson test -C build/release fold:null_deref fold:div_by_zero fold:int_overflow fold:oob_access --print-errorlogs
meson test -C build/release --print-errorlogs
git diff --check

Results:

Focused detector suite: 4/4 passed.
Full suite: 49/49 passed.
Whitespace check: passed.

Benchmarks

Synthetic micro: control nesting

python3 bench/run_micro_opt.py --case control-nesting --size 4 --repeats 5 --out-dir /tmp/fold-micro-slice-r5

Result medians:

Findings: unchanged for this gate (fold.null-deref: 1 proved finding).
total_wall_ms: 54 ms.
null-deref.wall_ms: 46 ms.
null-deref.walker_ms: 44 ms.
null-deref.control_walk_ms: 36 ms.
z3_queries: 1, z3_timeouts: 0.

Yams wide20 security preset

python3 bench/run_security_targets.py --preset yams-wide20-security --repeats 1 --out-dir /tmp/fold-security-slice-smoke

Result:

Return code: 0.
Findings: 0.
External elapsed: 117.1 s.
Scan total wall: 117.0 s across 20 TUs / 4,983 functions.

Curl security preset

python3 bench/run_security_targets.py --preset curl-security --repeats 1 --out-dir /tmp/fold-curl-slice-smoke