svf-lib 1.0.1056 → 1.0.1059

package/SVF-linux/include/Util/ExtAPI.h

@@ -40,54 +40,66 @@
 #include <map>
 
 #define EXTAPI_JSON_PATH "/lib/Util/ExtAPI.json"
+#define JSON_OPT_OVERWRITE "overwrite_app_function"
+#define JSON_OPT_FUNCTIONTYPE "type"
 
 namespace SVF
 {
 
 /*
 
-    Specifications in ExtAPI.json
-
-    Specification language: The specification language of external function includes:
-    1. the name of the function,
-    2. the type of the function,
-    3. the operations of the function.
-
-    Funtion type: Funtion type represents some property of the function.
-    For example,
-    ”EFT_ALLOC“, represents if this external function allocates a new object and assigns it to one of its arguments,
-    For the selection of Function type and a more detailed explanation, please refer to enum extf_t in ExtAPI.h.
-
-    Function operations: Function operations indicates the relationship between input and output,
-    mainly the relationship between function parameters, or between parameters and return values after function is executed.
-    For example,
-    "copy": ["A2", "L"], indicates that after this external function is executed, the value of the 2th parameter is copied into the return value.
-    For the selection of Function type and a more detailed explanation, please refer to enum extType in ExtAPI.h.
-
-    For operands of function operation, e.g., "A2", "L", there are the following options:
-    "A": represents an parameter;
-    "N": represents a number;
-    "R": represents a reference;
-    "L": represents a return value;
-    "V": represents a dummy node;
-
-    Among them, parameter may have multiple forms, because there may be multiple parameters, and parameter may be a reference or complex structure,
-
-    Here we use regular expressions "(AN)(R|RN)^*" to represent parameter, for example,
-    "A0":    represents the 1th parameter;
-    "A2R":   represents that the 3th parameter is a reference;
-    "A1R2":  represents the 3th substructure of 2th parameter "A1R", where "A1R" is a complex structure;
-    "A2R3R": represents the 4th substructure of 3th parameter "A2R" is a reference, where "A2R" is a complex structure;
-
-
-    Specification format:
-    "functionName": {
-        "type": "functional type",
-        "function operation_1": [ operand_1, operand_2, ... , operand_n],
-        "function operation_2": [ operand_1, operand_2, ... , operand_n],
-        ...
-        "function operation_n": [ operand_1, operand_2, ... , operand_n]
-    }
+** Specifications in ExtAPI.json
+
+*** [1] Overview of the Specification Language
+The specification language of external functions is based on the JSON format. And every function defined by the Specification Language is an object that represents the specification rules. These Specification Language objects for functions contain four parts:
+1. the name of the function,
+2. the switch that controls whether the specification rules defined in the ExtAPI.json overwrite the functions defined in the user code,
+3. the type of the function,
+4. the operations conducted by the function.
+
+*** [2] Overwriting the user-defined functions
+The switch *overwrite_app_function* controls whether the specification rules defined in the ExtAPI.json overwrite the functions defined in the user code (e.g., CPP files). When the switch *overwrite_app_function* is set to a value of 1, SVF will use the specification rules in ExtAPI.json to conduct the analysis and ignore the user-defined functions in the input CPP/bc files.
+overwrite_app_function = 0: Analyze the user-defined functions.
+overwrite_app_function = 1: Use specifications in ExtAPI.json to overwrite the user-defined functions.
+
+*** [3] Function types
+Function type represents the properties of the function.
+For example,
+"EFT_ALLOC" represents if this external function allocates a new object and assigns it to one of its arguments,
+For the selection of function type and a more detailed explanation, please refer to the definition of enum *extf_t* in ExtAPI.h.
+
+*** [4] Function operations
+Function operations indicate the relationships between input and output,
+mainly between function parameters or between parameters and return values after the execution.
+For example,
+"copy": ["A2", "L"] indicates that after this external function is executed, the value of the 2nd parameter is copied into the return value.
+For the selection of function type and a more detailed explanation, please refer to the definition of enum *extType* in ExtAPI.h.
+
+For operands of function operation, e.g., "A2", "L", there are the following options:
+"A": represents a parameter;
+"N": represents a number;
+"R": represents a reference;
+"L": represents a return value;
+"V": represents a dummy node;
+
+Among them, a parameter may have multiple forms because there may be various parameters, and the parameter may be a reference or complex structure,
+
+Here we use regular expressions "(AN)(R|RN)^*" to represent parameters, for example,
+"A0": represents the 1st parameter;
+"A2R": represents that the 3rd parameter is a reference;
+"A1R2": represents the 3rd substructure of the 2nd parameter "A1R", where "A1R" is a complex structure;
+"A2R3R": represents the 4th substructure of the 3rd parameter "A2R" is a reference, where "A2R" is a complex structure;
+
+
+** Specification format:
+"functionName": {
+"type": "functional type",
+"overwrite_app_function:" 0/1,
+"function operation_1": [ operand_1, operand_2, ... , operand_n],
+"function operation_2": [ operand_1, operand_2, ... , operand_n],
+...
+"function operation_n": [ operand_1, operand_2, ... , operand_n]
+}
 */
 
 
@@ -233,6 +245,11 @@ public:
     // Get property of the operation, e.g. "EFT_A1R_A0R"
     extType get_type(const SVF::SVFFunction *callee);
 
+    // Get priority of he function, return value
+    // 0: Apply user-defined functions
+    // 1: Apply function specification in ExtAPI.json
+    u32_t isOverwrittenAppFunction(const SVF::SVFFunction *callee);
+
     // Does (F) have a static var X (unavailable to us) that its return points to?
     bool has_static(const SVFFunction *F);
 

package/SVF-osx/include/CFL/CFGNormalizer.h

@@ -27,8 +27,8 @@
  *      Author: Pei Xu
  */
 
-#ifndef CFGNormalizer_H_
-#define CFGNormalizer_H_
+#ifndef INCLUDE_CFL_CFGNormalizer_H_
+#define INCLUDE_CFL_CFGNormalizer_H_
 
 #include "CFLGrammar.h"
 
@@ -36,7 +36,12 @@ namespace SVF
 {
 
 /*!
- *  Normalize Grammar from a grammarbase
+ *  Generate Normalized Grammar from a grammarbase
+ *
+ *  To Do:
+ *      Error Notice for ill formed production,
+ *      e.g. not end with ';' and '*' not preceding with '()' and extra space before ';'
+ *      '|' sign support
  */
 
 class CFGNormalizer
@@ -47,23 +52,23 @@ public:
     {
     }
 
-    /// Normalization with attribute expanded
+    /// Binary Normal Form(BNF) normalization with variable attribute expanded
     CFLGrammar* normalize(GrammarBase *generalGrammar);
 
-    /// Fill Every attribute in CFL grammar
+    /// Expand every variable attribute in rawProductions of grammarbase
     CFLGrammar* fillAttribute(CFLGrammar *grammar, const Map<CFLGrammar::Kind, Set<CFLGrammar::Attribute>>& kind2AttrsMap);
 
 private:
     /// Add nonterminal to tranfer long rules to binary rules
     void ebnf_bin(CFLGrammar *grammar);
 
-    void ebnf_sign_replace(char sign, CFLGrammar *grammar);
+    void ebnfSignReplace(char sign, CFLGrammar *grammar);
 
     void insertToCFLGrammar(CFLGrammar *grammar, GrammarBase::Production &prod);
 
-    int ebnf_bracket_match(GrammarBase::Production& prod, int i, CFLGrammar *grammar) ;
+    int ebnfBracketMatch(GrammarBase::Production& prod, int i, CFLGrammar *grammar) ;
 
-    int check_head(Map<GrammarBase::Symbol, GrammarBase::Productions>& grammar, GrammarBase::Production& rule);
+    GrammarBase::Symbol check_head(GrammarBase::SymbolMap<GrammarBase::Symbol, GrammarBase::Productions>& grammar, GrammarBase::Production& rule);
 
     GrammarBase::Production strTrans(std::string strPro, CFLGrammar *grammar);
 
@@ -74,4 +79,4 @@ private:
 
 } // End namespace SVF
 
-#endif /* CFGNormalizer_H_*/
+#endif /* INCLUDE_CFL_CFGNormalizer_H_*/

package/SVF-osx/include/CFL/CFLAlias.h

@@ -51,50 +51,11 @@ public:
     /// Destructor
     virtual ~CFLAlias()
     {
-        delete graph;
-        delete grammar;
         delete solver;
     }
 
     /// Start Analysis here (main part of pointer analysis).
-    virtual void analyze()
-    {
-        GrammarBuilder gReader = GrammarBuilder(Options::GrammarFilename);
-        CFGNormalizer normalizer = CFGNormalizer();
-        CFLGraphBuilder cflGraphBuilder = CFLGraphBuilder();
-        CFLGramGraphChecker cflChecker = CFLGramGraphChecker();
-        /// Assume Read From Const Graph, associate label symbol is hard coded
-        if (Options::GraphIsFromDot == false)
-        {
-            PointerAnalysis::initialize();
-            Map<std::string, SVF::CFLGraph::Symbol> ConstMap =  {{"Addr",0}, {"Copy", 1},{"Store", 2},{"Load", 3},{"Gep_i", 4},{"Vgep", 5},{"Addrbar",6}, {"Copybar", 7},{"Storebar", 8},{"Loadbar", 9},{"Gepbar_i", 10},{"Vgepbar", 11}};
-            GrammarBase *generalGrammar = gReader.build(ConstMap);
-            ConstraintGraph *consCG = new ConstraintGraph(svfir);
-            graph = cflGraphBuilder.buildBigraph(consCG, generalGrammar->getStartKind());
-            cflChecker.check(generalGrammar, &cflGraphBuilder, graph);
-            grammar = normalizer.normalize(generalGrammar);
-            cflChecker.check(grammar, &cflGraphBuilder, graph);
-            svfir->dump("SVFIR");
-            grammar->dump();
-            delete consCG;
-            delete generalGrammar;
-        }
-        else
-        {
-            GrammarBase *generalGrammar = gReader.build();
-            graph = cflGraphBuilder.buildFromDot(Options::InputFilename, generalGrammar);
-            cflChecker.check(generalGrammar, &cflGraphBuilder, graph);
-            grammar = normalizer.normalize(generalGrammar);
-            cflChecker.check(grammar, &cflGraphBuilder, graph);
-            delete generalGrammar;
-        }
-        solver = new CFLSolver(graph, grammar);
-        solver->solve();
-        if (Options::GraphIsFromDot == false)
-        {
-            PointerAnalysis::finalize();
-        }
-    }
+    virtual void analyze();
 
     /// Interface exposed to users of our pointer analysis, given Value infos
     virtual AliasResult alias(const Value* v1, const Value* v2)

package/SVF-osx/include/CFL/CFLGrammar.h

@@ -28,20 +28,155 @@
  */
 #ifndef CFLGrammar_H_
 #define CFLGrammar_H_
-#include "Util/BasicTypes.h"
+#include "Util/SVFBasicTypes.h"
 
 namespace SVF
 {
+
 class GrammarBase
 {
 public:
-    typedef u32_t Symbol;
-    typedef std::vector<Symbol> Production;
-    typedef Set<Production> Productions;
-    typedef u32_t Attribute;
     typedef u32_t Kind;
+    typedef u32_t Attribute;
+    typedef u32_t VariableAttribute;
+    typedef struct Symbol
+    {
+        Kind kind: 8;
+        Attribute attribute: 16;
+        VariableAttribute variableAttribute: 8;
+
+        /// Default Value for Symbol is 0.
+        Symbol() : kind(0), attribute(0), variableAttribute(0) {}
+
+        /// Contruct from u32_t move the bit to right field
+        Symbol(const u32_t& num) : kind(num & 0xFF), attribute((num >> 8 ) & 0xFFFF), variableAttribute((num >> 24)) {}
+
+        /// Conversion of u32_t
+        operator u32_t()
+        {
+            u32_t num = 0;
+            num += this->variableAttribute << 24;
+            num += this->attribute << 8;
+            num += this->kind;
+            return num;
+        }
+
+        /// Conversion of u64_t
+        operator u64_t()
+        {
+            u64_t num = 0;
+            num += this->variableAttribute << 24;
+            num += this->attribute << 8;
+            num += this->kind;
+            return num;
+        }
+
+        operator s64_t() const
+        {
+            s64_t num = 0;
+            num += this->variableAttribute << 24;
+            num += this->attribute << 8;
+            num += this->kind;
+            return num;
+        }
+
+        bool operator<(const Symbol& rhs)
+        {
+            return this->kind < rhs.kind;
+        }
+
+        void operator=(const int& i)
+        {
+            this->kind = EdgeKindMask & i;
+            this->attribute = i >> EdgeKindMaskBits;
+            this->variableAttribute = i >> AttributedKindMaskBits;
+        }
+
+        void operator=(unsigned long long num)
+        {
+            this->kind = num & 0xFF;
+            this->attribute = (num >> 8 ) & 0xFFFF;
+            this->variableAttribute = num >> 24;
+        }
+
+        void operator=(const Kind& kind)
+        {
+            this->kind = kind;
+        }
+
+        bool operator==(const Symbol& s)
+        {
+            return ((this->kind == s.kind) && (this->attribute == s.attribute) && (this->variableAttribute == s.variableAttribute));
+        }
+
+        bool operator==(const Symbol& s) const
+        {
+            return ((kind == s.kind) && (attribute == s.attribute) && (variableAttribute == s.variableAttribute));
+        }
+
+        bool operator!=(const Symbol& s) const
+        {
+            return ! (*this == s) ;
+        }
+
+
+        bool operator==(const int& i)
+        {
+            return ((this->kind == (EdgeKindMask & i)) && (this->attribute == (i >> EdgeKindMaskBits)) && (this->variableAttribute == (i >> AttributedKindMaskBits)));
+        }
+
+        bool operator==(const Kind& k) const
+        {
+            return (this->kind == k);
+        }
+
+        bool operator==(const Kind& k)
+        {
+            return (this->kind == k);
+        }
+    } Symbol;
+
+    class SymbolHash
+    {
+    public:
+        size_t operator()(const Symbol &s) const
+        {
+            std::hash<u32_t> h;
+            return h(u32_t(s));
+        }
+    };
+
 
-    inline Map<std::string, Kind>& getNonterminals()
+    struct SymbolVectorHash
+    {
+        size_t operator()(const std::vector<Symbol> &v) const
+        {
+            size_t h = v.size();
+
+            SymbolHash hf;
+            for (const Symbol &t : v)
+            {
+                h ^= hf(t) + 0x9e3779b9 + (h << 6) + (h >> 2);
+            }
+
+            return h;
+        }
+    };
+
+    template<typename Key, typename Value, typename Hash = SymbolHash,
+             typename KeyEqual = std::equal_to<Key>,
+             typename Allocator = std::allocator<std::pair<const Key, Value>>>
+                     using SymbolMap = std::unordered_map<Key, Value, Hash, KeyEqual, Allocator>;
+
+             template <typename Key, typename Hash = SymbolVectorHash, typename KeyEqual = std::equal_to<Key>,
+                       typename Allocator = std::allocator<Key>>
+             using SymbolSet = std::unordered_set<Key, Hash, KeyEqual, Allocator>;
+
+             typedef std::vector<Symbol> Production;
+             typedef SymbolSet<Production> Productions;
+
+
+             inline Map<std::string, Kind>& getNonterminals()
     {
         return this->nonterminals;
     }
@@ -61,7 +196,7 @@ public:
         this->terminals = terminals;
     }
 
-    inline Map<Symbol, Productions>& getRawProductions()
+    inline SymbolMap<Symbol, Productions>& getRawProductions()
     {
         return this->rawProductions;
     }
@@ -91,7 +226,11 @@ public:
         this->totalKind = totalKind;
     }
 
-    void setRawProductions(Map<Symbol, Productions>& rawProductions);
+    std::string extractKindStrFromSymbolStr(const std::string symbolStr) const;
+
+    std::string extractAttributeStrFromSymbolStr(const std::string symbolStr) const;
+
+    void setRawProductions(SymbolMap<Symbol, Productions>& rawProductions);
 
     void setKind2AttrsMap(const Map<Kind,  Set<Attribute>>& kind2AttrsMap);
 
@@ -99,6 +238,8 @@ public:
 
     Kind str2Kind(std::string str) const;
 
+    Symbol str2Symbol(const std::string str) const;
+
     std::string kind2Str(Kind kind) const;
 
     std::string sym2StrDump(Symbol sym) const;
@@ -108,41 +249,46 @@ public:
         return prod.at(pos);
     }
 
-    inline const Set<Symbol>& getAttrSyms() const
+    inline const Set<Kind>& getAttrSyms() const
     {
         return this->attributeKinds;
     }
 
+    /// Insert kind to nonterminal and return kind.
+    Kind insertNonterminalKind(std::string const kindStr);
+
+    /// From SymbolStr extract kind to inserted in nonterminal
+    /// symbolStr = <kindStr> [_] [ attributeStr | variableattributeStr ]
     Kind insertTerminalKind(std::string strLit);
-    Kind insertNonTerminalKind(std::string strLit);
-    void insertAttribute(Kind kind, Attribute a);
 
-    inline static Kind getSymKind(Symbol sym)
-    {
-        return (EdgeKindMask & sym);
-    }
+    Symbol insertSymbol(std::string strLit);
 
-    inline static Attribute getSymAttribute(Symbol sym)
-    {
-        return (sym >> EdgeKindMaskBits);
-    }
+    Symbol insertNonTerminalSymbol(std::string strLit);
+
+    void insertAttribute(Kind kind, Attribute a);
 
     inline static Kind getAttributedKind(Attribute attribute, Kind kind)
     {
         return ((attribute << EdgeKindMaskBits)| kind );
     }
 
+    inline static Kind getVariabledKind(VariableAttribute variableAttribute, Kind kind)
+    {
+        return ((variableAttribute << AttributedKindMaskBits) | kind);
+    }
+
 protected:
     static constexpr unsigned char EdgeKindMaskBits = 8;  ///< We use the lower 8 bits to denote edge kind
+    static constexpr unsigned char AttributedKindMaskBits = 24; ///< We use the lower 24 bits to denote attributed kind
     static constexpr u64_t EdgeKindMask = (~0ULL) >> (64 - EdgeKindMaskBits);
     Kind startKind;
 private:
-    Set<Kind> attributeKinds;
-    Map<Kind,  Set<Attribute>> kind2AttrsMap;
-    Map<Symbol, Productions> rawProductions;
-    Kind totalKind;
     Map<std::string, Kind> nonterminals;
     Map<std::string, Kind> terminals;
+    Set<Kind> attributeKinds;
+    Map<Kind,  Set<Attribute>> kind2AttrsMap;
+    SymbolMap<Symbol, Productions> rawProductions;
+    u32_t totalKind;
 };
 
 class CFLGrammar : public GrammarBase
@@ -168,17 +314,17 @@ public:
         return epsilonProds;
     }
 
-    Map<Symbol, Productions>& getSingleRHS2Prods()
+    SymbolMap<Symbol, Productions>& getSingleRHS2Prods()
     {
         return singleRHS2Prods;
     }
 
-    Map<Symbol, Productions>& getFirstRHS2Prods()
+    SymbolMap<Symbol, Productions>& getFirstRHS2Prods()
     {
         return firstRHS2Prods;
     }
 
-    Map<Symbol, Productions>& getSecondRHS2Prods()
+    SymbolMap<Symbol, Productions>& getSecondRHS2Prods()
     {
         return secondRHS2Prods;
     }
@@ -240,17 +386,86 @@ public:
 
     void dump() const;
 
+    void dump(std::string fileName) const;
+
+
     const inline int num_generator()
     {
         return newTerminalSubscript++;
     }
 
 private:
-    Set<Production> epsilonProds;
-    Map<Symbol, Productions> singleRHS2Prods;
-    Map<Symbol, Productions> firstRHS2Prods;
-    Map<Symbol, Productions> secondRHS2Prods;
-    Symbol newTerminalSubscript;
+    SymbolSet<Production> epsilonProds;
+    SymbolMap<Symbol, Productions> singleRHS2Prods;
+    SymbolMap<Symbol, Productions> firstRHS2Prods;
+    SymbolMap<Symbol, Productions> secondRHS2Prods;
+    u32_t newTerminalSubscript;
+};
+
+/**
+ * Worklist with "first in first out" order.
+ * New nodes will be pushed at back and popped from front.
+ * Elements in the list are unique as they're recorded by Set.
+ */
+template<class Data>
+class CFLFIFOWorkList
+{
+    typedef GrammarBase::SymbolSet<Data> DataSet;
+    typedef std::deque<Data> DataDeque;
+public:
+    CFLFIFOWorkList() {}
+
+    ~CFLFIFOWorkList() {}
+
+    inline bool empty() const
+    {
+        return data_list.empty();
+    }
+
+    inline bool find(Data data) const
+    {
+        return (data_set.find(data) == data_set.end() ? false : true);
+    }
+
+    /**
+     * Push a data into the work list.
+     */
+    inline bool push(Data data)
+    {
+        if (data_set.find(data) == data_set.end())
+        {
+            data_list.push_back(data);
+            data_set.insert(data);
+            return true;
+        }
+        else
+            return false;
+    }
+
+    /**
+     * Pop a data from the END of work list.
+     */
+    inline Data pop()
+    {
+        assert(!empty() && "work list is empty");
+        Data data = data_list.front();
+        data_list.pop_front();
+        data_set.erase(data);
+        return data;
+    }
+
+    /*!
+     * Clear all the data
+     */
+    inline void clear()
+    {
+        data_list.clear();
+        data_set.clear();
+    }
+
+private:
+    DataSet data_set;	///< store all data in the work list.
+    DataDeque data_list;	///< work list using std::vector.
 };
 
 }

package/SVF-osx/include/CFL/CFLGrammar.txt

@@ -1,19 +1,17 @@
 Start:  
-   V
+   V 
+Terminal:
+   Addr Copy Store Load Gep Vgep 
 Productions:
-   F -> Addr;
-   F -> Addr ( Copy ) *;
-   F -> Addr ( Store V Load ) *;
-   F -> ( Copy ) *;
-   F -> ( Store V Load ) *;
-   Fbar -> Addrbar;
-   Fbar -> Addrbar ( Copybar ) *;
-   Fbar -> Addrbar ( Loadbar V Storebar ) *;
-   Fbar -> ( Copybar ) *;
-   Fbar -> ( Loadbar V Storebar ) *;
+   F -> epsilon;
+   F -> F Copy;
+   F -> F Store V Load;
+   Gepbar_j -> Vgepbar Fbar Gepbar_i; 
+   Fbar -> epsilon;
+   Fbar -> Copybar Fbar;
+   Fbar -> Loadbar V Storebar Fbar;
    V -> Fbar V F;
-   V -> Gepbar_i V Gep_i;
    V -> Addrbar Addr;
-   V -> epsilon;
-
-   
+   V -> Gepbar_i V Gep_i;
+   Gep_j -> Gep_i F Vgep;
+   

package/SVF-osx/include/CFL/CFLGraphBuilder.h

@@ -39,14 +39,14 @@ namespace SVF
 
 class CFLGraphBuilder
 {
-private:
+protected:
     typedef CFLGrammar::Kind Kind;
     typedef CFLGrammar::Symbol Symbol;
     Map<std::string, Kind> label2KindMap;
     Map<Kind, std::string> kind2LabelMap;
     Map<CFLGrammar::Kind,  Set<CFLGrammar::Attribute>> kind2AttrsMap;
     bool externMap;
-    Symbol current;
+    Kind current;
 
 public:
     /// add attribute to kind2Attribute Map
@@ -73,12 +73,22 @@ public:
 
     /// Build Bidirectional graph by copying nodes and edges from any graph inherited from GenericGraph
     template<class N, class E>
-    CFLGraph* buildBigraph(GenericGraph<N,E>* graph, Kind startKind)
+    CFLGraph* buildBigraph(GenericGraph<N,E>* graph, Kind startKind, GrammarBase *grammar)
     {
         CFLGraph *cflGraph = new CFLGraph(startKind);
-        Map<std::string, SVF::CFLGraph::Symbol> ConstMap =  {{"Addr",0}, {"Copy", 1},{"Store", 2},{"Load", 3},{"Gep_i", 4},{"Vgep", 5},{"Addrbar",6}, {"Copybar", 7},{"Storebar", 8},{"Loadbar", 9},{"Gepbar_i", 10},{"Vgepbar", 11}};
         externMap = true;
-        for(auto pairV : ConstMap)
+        for(auto pairV : grammar->getTerminals())
+        {
+            if(label2KindMap.find(pairV.first) == label2KindMap.end())
+            {
+                label2KindMap.insert(pairV);
+            }
+            if(kind2LabelMap.find(pairV.second) == kind2LabelMap.end())
+            {
+                kind2LabelMap.insert(make_pair(pairV.second, pairV.first));
+            }
+        }
+        for(auto pairV : grammar->getNonterminals())
         {
             if(label2KindMap.find(pairV.first) == label2KindMap.end())
             {
@@ -100,29 +110,10 @@ public:
             for(E* edge : node->getOutEdges())
             {
                 CFLGrammar::Kind edgeLabel = edge->getEdgeKind();
-                // Need to get the offset from the Const Edge
-                // The offset present edge is only from Normal Gep CG at moment
-                if(NormalGepCGEdge::classof(edge))
-                {
-                    NormalGepCGEdge *nGepEdge = SVFUtil::dyn_cast<NormalGepCGEdge>(edge);
-                    CFLGrammar::Attribute attr =  nGepEdge->getConstantFieldIdx();
-                    addAttribute(edgeLabel, attr);
-                    edgeLabel = CFLGrammar::getAttributedKind(attr, edgeLabel);
-                    cflGraph->addCFLEdge(cflGraph->getGNode(edge->getSrcID()), cflGraph->getGNode(edge->getDstID()), edgeLabel);
-                    std::string key = kind2LabelMap[edge->getEdgeKind()];
-                    key.pop_back();
-                    key.pop_back();    // _i standsfor attribute variable should place at last
-                    key.append("bar_i");   // for example Gep_i should be Gepbar_i, not Gep_ibar
-                    cflGraph->addCFLEdge(cflGraph->getGNode(edge->getDstID()), cflGraph->getGNode(edge->getSrcID()), CFLGrammar::getAttributedKind(attr, label2KindMap[key]));
-                    addAttribute(label2KindMap[key], attr);
-                }
-                else
-                {
-                    cflGraph->addCFLEdge(cflGraph->getGNode(edge->getSrcID()), cflGraph->getGNode(edge->getDstID()), edgeLabel);
-                    std::string key = kind2LabelMap[edge->getEdgeKind()];
-                    key.append("bar");
-                    cflGraph->addCFLEdge(cflGraph->getGNode(edge->getDstID()), cflGraph->getGNode(edge->getSrcID()), label2KindMap[key]);
-                }
+                cflGraph->addCFLEdge(cflGraph->getGNode(edge->getSrcID()), cflGraph->getGNode(edge->getDstID()), edgeLabel);
+                std::string key = kind2LabelMap[edge->getEdgeKind()];
+                key.append("bar");
+                cflGraph->addCFLEdge(cflGraph->getGNode(edge->getDstID()), cflGraph->getGNode(edge->getSrcID()), label2KindMap[key]);
             }
         }
         return cflGraph;
@@ -147,8 +138,15 @@ public:
     {
         return this->kind2AttrsMap;
     }
+};
 
-
+class AliasCFLGraphBuilder : public CFLGraphBuilder
+{
+public:
+    /// Build Bidirectional graph by copying nodes and edges from const graph inherited from GenericGraph
+    CFLGraph* buildBigraph(ConstraintGraph *graph, Kind startKind, GrammarBase *grammar);
 };
+
 }// SVF
 
+

package/SVF-osx/include/CFL/GrammarBuilder.h

@@ -27,54 +27,74 @@
  *      Author: Pei Xu
  */
 
+#ifndef INCLUDE_CFL_GRAMMARBUILDER_H_
+#define INCLUDE_CFL_GRAMMARBUILDER_H_
 
 #include "CFL/CFLGrammar.h"
-#include "Graphs/CFLGraph.h"
+
 namespace SVF
 {
 
-/*!
+/**
  * Build Grammar from a user specified grammar text
+ *
+ * Symbol Format:
+ *      <kind> [bar] [ _alpha | _number ]
+ *      kind: any nonspace string start with alphabet, epsilon stand for empty string
+ *      bar: stand for reverse edge
+ *      alpha: any single alpha
+ *      number: any number
+ *      start with capital: nonterminal
+ *      start with noncapital: terminal
+ *
+ * Production Format:
+ *      <symbol> -> <symbol> *;
+ *      LHS and RHS, Seperate by '->', symbol seperate by ' ', end by ';'
+ *      support '*', '?', '(', ')'
+ *
  * Input Format:
- *      Start:              // Special string 'epsilon' for empty RHS
+ *      Start:
  *      M                   // Specify Start Symbol in Second Line
+ *      Terminal:
+ *      Addr Copy Store Load Gep Vgep // Specify the order of terminal Addr->0, Copy->1 ..
  *      Productions:        // Each Symbol seperate by 'Space', production end with ';'
  *      M -> V d;           // Terminal in NonCapital
  *      M -> dbar V d;      // NonTerminal in Capital
  *      V -> M abar M a M;  // LHS and RHS, Seperate by '->'
  *      V -> ( M ? abar ) * M ? ( a M ? ) *;    // Support '(' ')' '?' '*' four regular expression sign
- * Note:
- *      When provide EBNF form text (i.e Last production above),
- *      Please specify -ebnf flag, otherwise regular experssion sign will treat as NonTerminal.
+ *      Gep_j -> Gep_i F vgep; // Support variable attribute with variable attribute
+ *      Gep_1 -> Gep_2;      // Support fix number attribute
+ *
  */
 
 class GrammarBuilder
 {
 private:
-    /// Load whole file content to string
-    const inline std::string loadFileString() const;
+    std::string fileName;
+    GrammarBase *grammar;
 
     /// Parse start symbol and production from file string
-    const inline std::string parseProduction() const;
+    const inline std::string parseProductionsString() const;
 
     /// Parse whole production string to production vector
     const inline std::vector<std::string> loadWordProductions() const;
 
-    /// Strip frond and tail space
+    /// Strip front and tail space
     const inline std::string stripSpace(std::string s) const;
 
 public:
-    std::string fileName;
-    GrammarBase *grammar;
-
     GrammarBuilder(std::string fileName): fileName(fileName), grammar(nullptr)
     {
         grammar = new GrammarBase();
     };
 
+    /// Build grammarBase from fileName
     GrammarBase* build() const;
 
-    GrammarBase* build(Map<std::string, SVF::CFLGraph::Symbol> &preMap) const;
+    /// Build grammarBase from fileName with preset str2KindMap
+    GrammarBase* build(Map<std::string, SVF::GrammarBase::Symbol> &preMap) const;
 };
 
 } // SVF
+
+#endif /* INCLUDE_CFL_GRAMMARBUILDER_H_ */

package/SVF-osx/include/Graphs/CFLGraph.h

@@ -57,6 +57,16 @@ public:
     {
         return this->getEdgeKindWithoutMask();
     }
+
+    inline GEdgeKind getEdgeKindWithMask() const
+    {
+        return (EdgeKindMask & this->getEdgeKindWithoutMask());
+    }
+
+    inline GEdgeKind getEdgeAttri() const
+    {
+        return (getEdgeKind() >> this->EdgeKindMaskBits);
+    }
 };
 
 
@@ -87,6 +97,8 @@ public:
     }
     ~CFLGraph() override = default;
 
+    Kind getStartKind() const;
+
     virtual void addCFLNode(NodeID id, CFLNode* node);
 
     virtual const CFLEdge* addCFLEdge(CFLNode* src, CFLNode* dst, CFLEdge::GEdgeFlag label);

package/SVF-osx/include/Graphs/ConsGEdge.h

@@ -308,6 +308,7 @@ public:
     {
         return ls.accumulateConstantFieldIdx();
     }
+
 };
 
 /*!

package/SVF-osx/include/SVF-FE/CallGraphBuilder.h

@@ -28,8 +28,8 @@
  *      Author: Yulei Sui
  */
 
-#ifndef INCLUDE_UTIL_CALLGRAPHBUILDER_H_
-#define INCLUDE_UTIL_CALLGRAPHBUILDER_H_
+#ifndef INCLUDE_SVF_FE_CALLGRAPHBUILDER_H_
+#define INCLUDE_SVF_FE_CALLGRAPHBUILDER_H_
 
 #include "Graphs/PTACallGraph.h"
 #include "Graphs/ThreadCallGraph.h"

package/SVF-osx/include/Util/ExtAPI.h

@@ -40,54 +40,66 @@
 #include <map>
 
 #define EXTAPI_JSON_PATH "/lib/Util/ExtAPI.json"
+#define JSON_OPT_OVERWRITE "overwrite_app_function"
+#define JSON_OPT_FUNCTIONTYPE "type"
 
 namespace SVF
 {
 
 /*
 
-    Specifications in ExtAPI.json
-
-    Specification language: The specification language of external function includes:
-    1. the name of the function,
-    2. the type of the function,
-    3. the operations of the function.
-
-    Funtion type: Funtion type represents some property of the function.
-    For example,
-    ”EFT_ALLOC“, represents if this external function allocates a new object and assigns it to one of its arguments,
-    For the selection of Function type and a more detailed explanation, please refer to enum extf_t in ExtAPI.h.
-
-    Function operations: Function operations indicates the relationship between input and output,
-    mainly the relationship between function parameters, or between parameters and return values after function is executed.
-    For example,
-    "copy": ["A2", "L"], indicates that after this external function is executed, the value of the 2th parameter is copied into the return value.
-    For the selection of Function type and a more detailed explanation, please refer to enum extType in ExtAPI.h.
-
-    For operands of function operation, e.g., "A2", "L", there are the following options:
-    "A": represents an parameter;
-    "N": represents a number;
-    "R": represents a reference;
-    "L": represents a return value;
-    "V": represents a dummy node;
-
-    Among them, parameter may have multiple forms, because there may be multiple parameters, and parameter may be a reference or complex structure,
-
-    Here we use regular expressions "(AN)(R|RN)^*" to represent parameter, for example,
-    "A0":    represents the 1th parameter;
-    "A2R":   represents that the 3th parameter is a reference;
-    "A1R2":  represents the 3th substructure of 2th parameter "A1R", where "A1R" is a complex structure;
-    "A2R3R": represents the 4th substructure of 3th parameter "A2R" is a reference, where "A2R" is a complex structure;
-
-
-    Specification format:
-    "functionName": {
-        "type": "functional type",
-        "function operation_1": [ operand_1, operand_2, ... , operand_n],
-        "function operation_2": [ operand_1, operand_2, ... , operand_n],
-        ...
-        "function operation_n": [ operand_1, operand_2, ... , operand_n]
-    }
+** Specifications in ExtAPI.json
+
+*** [1] Overview of the Specification Language
+The specification language of external functions is based on the JSON format. And every function defined by the Specification Language is an object that represents the specification rules. These Specification Language objects for functions contain four parts:
+1. the name of the function,
+2. the switch that controls whether the specification rules defined in the ExtAPI.json overwrite the functions defined in the user code,
+3. the type of the function,
+4. the operations conducted by the function.
+
+*** [2] Overwriting the user-defined functions
+The switch *overwrite_app_function* controls whether the specification rules defined in the ExtAPI.json overwrite the functions defined in the user code (e.g., CPP files). When the switch *overwrite_app_function* is set to a value of 1, SVF will use the specification rules in ExtAPI.json to conduct the analysis and ignore the user-defined functions in the input CPP/bc files.
+overwrite_app_function = 0: Analyze the user-defined functions.
+overwrite_app_function = 1: Use specifications in ExtAPI.json to overwrite the user-defined functions.
+
+*** [3] Function types
+Function type represents the properties of the function.
+For example,
+"EFT_ALLOC" represents if this external function allocates a new object and assigns it to one of its arguments,
+For the selection of function type and a more detailed explanation, please refer to the definition of enum *extf_t* in ExtAPI.h.
+
+*** [4] Function operations
+Function operations indicate the relationships between input and output,
+mainly between function parameters or between parameters and return values after the execution.
+For example,
+"copy": ["A2", "L"] indicates that after this external function is executed, the value of the 2nd parameter is copied into the return value.
+For the selection of function type and a more detailed explanation, please refer to the definition of enum *extType* in ExtAPI.h.
+
+For operands of function operation, e.g., "A2", "L", there are the following options:
+"A": represents a parameter;
+"N": represents a number;
+"R": represents a reference;
+"L": represents a return value;
+"V": represents a dummy node;
+
+Among them, a parameter may have multiple forms because there may be various parameters, and the parameter may be a reference or complex structure,
+
+Here we use regular expressions "(AN)(R|RN)^*" to represent parameters, for example,
+"A0": represents the 1st parameter;
+"A2R": represents that the 3rd parameter is a reference;
+"A1R2": represents the 3rd substructure of the 2nd parameter "A1R", where "A1R" is a complex structure;
+"A2R3R": represents the 4th substructure of the 3rd parameter "A2R" is a reference, where "A2R" is a complex structure;
+
+
+** Specification format:
+"functionName": {
+"type": "functional type",
+"overwrite_app_function:" 0/1,
+"function operation_1": [ operand_1, operand_2, ... , operand_n],
+"function operation_2": [ operand_1, operand_2, ... , operand_n],
+...
+"function operation_n": [ operand_1, operand_2, ... , operand_n]
+}
 */
 
 
@@ -233,6 +245,11 @@ public:
     // Get property of the operation, e.g. "EFT_A1R_A0R"
     extType get_type(const SVF::SVFFunction *callee);
 
+    // Get priority of he function, return value
+    // 0: Apply user-defined functions
+    // 1: Apply function specification in ExtAPI.json
+    u32_t isOverwrittenAppFunction(const SVF::SVFFunction *callee);
+
     // Does (F) have a static var X (unavailable to us) that its return points to?
     bool has_static(const SVFFunction *F);
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-lib",
-  "version": "1.0.1056",
+  "version": "1.0.1059",
   "description": "SVF's npm support",
   "main": "index.js",
   "scripts": {