paper on speculative analysis of C/C++ code?

At some point while browsing the LLVM web site, I stumbled across a
paper that discussed using LLVM with an analysis technique that
used dataflow analysis and generated speculative data for code.

They used the technique on binutils and found a number of errors in
that package.

Does anyone recall the specific paper/system so that I can revisit it?

I tried a number of google searches but I keep getting false hits
instead of what I remember reading previously.