svf-lib 1.0.1111 → 1.0.1114

package/SVF-linux/include/SABER/ProgSlice.h

@@ -30,7 +30,7 @@
 #ifndef PROGSLICE_H_
 #define PROGSLICE_H_
 
-#include "SABER/PathCondAllocator.h"
+#include "SABER/SaberCondAllocator.h"
 #include "Util/WorkList.h"
 #include "Graphs/SVFG.h"
 #include "Util/DPItem.h"
@@ -44,14 +44,14 @@ class ProgSlice
 public:
     typedef Set<const SVFGNode*> SVFGNodeSet;
     typedef SVFGNodeSet::const_iterator SVFGNodeSetIter;
-    typedef PathCondAllocator::Condition Condition;
-    typedef Map<const SVFGNode*, Condition*> SVFGNodeToCondMap; 	///< map a SVFGNode to its condition during value-flow guard computation
+    typedef SaberCondAllocator::Condition Condition;
+    typedef Map<const SVFGNode*, Condition> SVFGNodeToCondMap; 	///< map a SVFGNode to its condition during value-flow guard computation
 
     typedef FIFOWorkList<const SVFGNode*> VFWorkList;		    ///< worklist for value-flow guard computation
     typedef FIFOWorkList<const BasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
 
     /// Constructor
-    ProgSlice(const SVFGNode* src, PathCondAllocator* pa, const SVFG* graph):
+    ProgSlice(const SVFGNode* src, SaberCondAllocator* pa, const SVFG* graph):
         root(src), partialReachable(false), fullReachable(false), reachGlob(false),
         pathAllocator(pa), _curSVFGNode(nullptr), finalCond(pa->getFalseCond()), svfg(graph)
     {
@@ -168,27 +168,27 @@ public:
 
     /// Condition operations
     //@{
-    inline Condition* condAnd(Condition* lhs, Condition* rhs)
+    inline Condition condAnd(const Condition &lhs, const Condition &rhs)
     {
         return pathAllocator->condAnd(lhs,rhs);
     }
-    inline Condition* condOr(Condition* lhs, Condition* rhs)
+    inline Condition condOr(const Condition &lhs, const Condition &rhs)
     {
         return pathAllocator->condOr(lhs,rhs);
     }
-    inline Condition* condNeg(Condition* cond)
+    inline Condition condNeg(const Condition &cond)
     {
         return pathAllocator->condNeg(cond);
     }
-    inline Condition* getTrueCond() const
+    inline Condition getTrueCond() const
     {
         return pathAllocator->getTrueCond();
     }
-    inline Condition* getFalseCond() const
+    inline Condition getFalseCond() const
     {
         return pathAllocator->getFalseCond();
     }
-    inline std::string dumpCond(Condition* cond) const
+    inline std::string dumpCond(const Condition& cond) const
     {
         return pathAllocator->dumpCond(cond);
     }
@@ -210,13 +210,13 @@ protected:
     /// Clear Control flow conditions before each VF computation
     inline void clearCFCond()
     {
-        /// TODO: how to clean bdd memory
+        /// TODO: how to clean z3 memory
         pathAllocator->clearCFCond();
     }
 
     /// Get/set VF (value-flow) and CF (control-flow) conditions
     //@{
-    inline Condition* getVFCond(const SVFGNode* node) const
+    inline Condition getVFCond(const SVFGNode* node) const
     {
         SVFGNodeToCondMap::const_iterator it = svfgNodeToCondMap.find(node);
         if(it==svfgNodeToCondMap.end())
@@ -225,7 +225,7 @@ protected:
         }
         return it->second;
     }
-    inline bool setVFCond(const SVFGNode* node, Condition* cond)
+    inline bool setVFCond(const SVFGNode* node, const Condition &cond)
     {
         SVFGNodeToCondMap::iterator it = svfgNodeToCondMap.find(node);
         // until a fixed-point is reached (condition is not changed)
@@ -239,21 +239,21 @@ protected:
 
     /// Compute guards for value-flows
     //@{
-    inline Condition* ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst)
+    inline Condition ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst)
     {
         return pathAllocator->ComputeIntraVFGGuard(src,dst);
     }
-    inline Condition* ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB)
+    inline Condition ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB)
     {
         return pathAllocator->ComputeInterCallVFGGuard(src,dst,callBB);
     }
-    inline Condition* ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB)
+    inline Condition ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB)
     {
         return pathAllocator->ComputeInterRetVFGGuard(src,dst,retBB);
     }
     //@}
 
-    inline bool isEquivalentBranchCond(const Condition *lhs, const Condition *rhs) const
+    inline bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const
     {
         return pathAllocator->isEquivalentBranchCond(lhs, rhs);
     };
@@ -284,7 +284,7 @@ protected:
     }
     //@}
     /// Set final condition after all path reachability analysis
-    inline void setFinalCond(Condition* cond)
+    inline void setFinalCond(const Condition &cond)
     {
         finalCond = cond;
     }
@@ -298,9 +298,9 @@ private:
     bool partialReachable;					///<  reachable from some paths
     bool fullReachable;						///<  reachable from all paths
     bool reachGlob;							///<  Whether slice reach a global
-    PathCondAllocator* pathAllocator;		///<  path condition allocator
+    SaberCondAllocator* pathAllocator;		///<  path condition allocator
     const SVFGNode* _curSVFGNode;			///<  current svfg node during guard computation
-    Condition* finalCond;					///<  final condition
+    Condition finalCond;					///<  final condition
     const SVFG* svfg;						///<  SVFG
 };
 

package/SVF-linux/include/SABER/SaberCondAllocator.h

@@ -0,0 +1,305 @@
+//===- SaberCondAllocator.h -- Path condition manipulation---------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * PathAllocator.h
+ *
+ *  Created on: Apr 3, 2014
+ *      Author: Yulei Sui
+ */
+
+#ifndef PATHALLOCATOR_H_
+#define PATHALLOCATOR_H_
+
+#include "Util/SVFModule.h"
+#include "SVF-FE/DataFlowUtil.h"
+#include "SVF-FE/BasicTypes.h"
+#include "Util/WorkList.h"
+#include "Graphs/SVFG.h"
+#include "Util/Z3Expr.h"
+
+
+namespace SVF
+{
+
+/**
+ * SaberCondAllocator allocates conditions for each basic block of a certain CFG.
+ */
+class SaberCondAllocator
+{
+
+public:
+
+    typedef Z3Expr Condition;   /// z3 condition
+    typedef Map<u32_t, const Instruction *> IndexToTermInstMap; /// id to instruction map for z3
+    typedef Map<u32_t,Condition> CondPosMap;		///< map a branch to its Condition
+    typedef Map<const BasicBlock*, CondPosMap > BBCondMap;	/// map bb to a Condition
+    typedef Set<const BasicBlock*> BasicBlockSet;
+    typedef Map<const Function*,  BasicBlockSet> FunToExitBBsMap;  ///< map a function to all its basic blocks calling program exit
+    typedef Map<const BasicBlock*, Condition> BBToCondMap;	///< map a basic block to its condition during control-flow guard computation
+    typedef FIFOWorkList<const BasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
+
+
+    /// Constructor
+    SaberCondAllocator();
+
+    /// Destructor
+    virtual ~SaberCondAllocator()
+    {
+    }
+    /// Statistics
+    //@{
+    inline std::string getMemUsage()
+    {
+        return "";
+    }
+    inline u32_t getCondNum()
+    {
+        return totalCondNum;
+    }
+    //@}
+
+    /// Condition operations
+    //@{
+    inline Condition condAnd(const Condition& lhs, const Condition& rhs)
+    {
+        return Condition::AND(lhs,rhs);
+    }
+    inline Condition condOr(const Condition& lhs, const Condition& rhs)
+    {
+        return Condition::OR(lhs,rhs);
+    }
+    inline Condition condNeg(const Condition& cond)
+    {
+        return Condition::NEG(cond);
+    }
+    inline Condition getTrueCond() const
+    {
+        return Condition::getTrueCond();
+    }
+    inline Condition getFalseCond() const
+    {
+        return Condition::getFalseCond();
+    }
+    /// Iterator every element of the condition
+    inline NodeBS exactCondElem(const Condition& cond)
+    {
+        NodeBS elems;
+        extractSubConds(cond, elems);
+        return elems;
+    }
+
+    inline std::string dumpCond(const Condition& cond) const
+    {
+        return Condition::dumpStr(cond);
+    }
+
+    /// Allocate a new condition
+    Condition newCond(const Instruction* inst);
+
+    /// Perform path allocation
+    void allocate(const SVFModule* module);
+
+    /// Get/Set instruction based on Z3 expression id
+    //{@
+    inline const Instruction *getCondInst(u32_t id) const
+    {
+        IndexToTermInstMap::const_iterator it = idToTermInstMap.find(id);
+        assert(it != idToTermInstMap.end() && "this should be a fresh condition");
+        return it->second;
+    }
+
+    inline void setCondInst(const Condition &condition, const Instruction *inst)
+    {
+        assert(idToTermInstMap.find(condition.id()) == idToTermInstMap.end() && "this should be a fresh condition");
+        idToTermInstMap[condition.id()] = inst;
+    }
+    //@}
+
+    bool isNegCond(u32_t id) const
+    {
+        return negConds.test(id);
+    }
+
+    /// Get dominators
+    inline DominatorTree* getDT(const Function* fun)
+    {
+        return cfInfoBuilder.getDT(fun);
+    }
+    /// Get Postdominators
+    inline PostDominatorTree* getPostDT(const Function* fun)
+    {
+        return cfInfoBuilder.getPostDT(fun);
+    }
+    /// Get LoopInfo
+    inline LoopInfo* getLoopInfo(const Function* f)
+    {
+        return cfInfoBuilder.getLoopInfo(f);
+    }
+
+
+    /// Guard Computation for a value-flow (between two basic blocks)
+    //@{
+    virtual Condition ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst);
+    virtual Condition ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB);
+    virtual Condition ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB);
+
+    /// Get complement condition (from B1 to B0) according to a complementBB (BB2) at a phi
+    /// e.g., B0: dstBB; B1:incomingBB; B2:complementBB
+    virtual Condition getPHIComplementCond(const BasicBlock* BB1, const BasicBlock* BB2, const BasicBlock* BB0);
+
+    inline void clearCFCond()
+    {
+        bbToCondMap.clear();
+    }
+    /// Set current value for branch condition evaluation
+    inline void setCurEvalSVFGNode(const SVFGNode* node)
+    {
+        curEvalSVFGNode = node;
+    }
+    /// Get current value for branch condition evaluation
+    inline const SVFGNode* getCurEvalSVFGNode() const
+    {
+        return curEvalSVFGNode;
+    }
+    //@}
+
+    /// Print out the path condition information
+    void printPathCond();
+
+    /// whether condition is satisfiable
+    bool isSatisfiable(const Condition& condition);
+
+    /// whether condition is satisfiable for all possible boolean guards
+    inline bool isAllPathReachable(Condition& condition)
+    {
+        return isEquivalentBranchCond(condition, Condition::getTrueCond());
+    }
+
+    /// Whether lhs and rhs are equivalent branch conditions
+    bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const;
+
+    inline ICFG* getICFG() const
+    {
+        return PAG::getPAG()->getICFG();
+    }
+
+    /// Get/Set control-flow conditions
+    //@{
+    inline bool setCFCond(const BasicBlock* bb, const Condition& cond)
+    {
+        BBToCondMap::iterator it = bbToCondMap.find(bb);
+        // until a fixed-point is reached (condition is not changed)
+        if(it!=bbToCondMap.end() && isEquivalentBranchCond(it->second, cond))
+            return false;
+
+        bbToCondMap[bb] = cond;
+        return true;
+    }
+    inline Condition getCFCond(const BasicBlock* bb) const
+    {
+        BBToCondMap::const_iterator it = bbToCondMap.find(bb);
+        if(it==bbToCondMap.end())
+        {
+            return getFalseCond();
+        }
+        return it->second;
+    }
+    //@}
+
+
+    /// mark neg Z3 expression
+    inline void setNegCondInst(const Condition &condition, const Instruction *inst)
+    {
+        setCondInst(condition, inst);
+        negConds.set(condition.id());
+    }
+private:
+
+    /// Allocate path condition for every basic block
+    virtual void allocateForBB(const BasicBlock& bb);
+
+    /// Get/Set a branch condition, and its terminator instruction
+    //@{
+    /// Set branch condition
+    void setBranchCond(const BasicBlock *bb, const BasicBlock *succ, const Condition& cond);
+    /// Get branch condition
+    Condition getBranchCond(const BasicBlock * bb, const BasicBlock *succ) const;
+    ///Get a condition, evaluate the value for conditions if necessary (e.g., testNull like express)
+    Condition getEvalBrCond(const BasicBlock * bb, const BasicBlock *succ);
+    //@}
+    /// Evaluate branch conditions
+    //@{
+    /// Evaluate the branch condtion
+    Condition evaluateBranchCond(const BasicBlock * bb, const BasicBlock *succ) ;
+    /// Evaluate loop exit branch
+    Condition evaluateLoopExitBranch(const BasicBlock * bb, const BasicBlock *succ);
+    /// Return branch condition after evaluating test null like expression
+    Condition evaluateTestNullLikeExpr(const BranchStmt* branchStmt, const BasicBlock *succ);
+    /// Return condition when there is a branch calls program exit
+    Condition evaluateProgExit(const BranchStmt* branchStmt, const BasicBlock *succ);
+    /// Collect basic block contains program exit function call
+    void collectBBCallingProgExit(const BasicBlock& bb);
+    bool isBBCallsProgExit(const BasicBlock* bb);
+    //@}
+
+    /// Evaluate test null/not null like expressions
+    //@{
+    /// Return true if the predicate of this compare instruction is equal
+    bool isEQCmp(const CmpInst* cmp) const;
+    /// Return true if the predicate of this compare instruction is not equal
+    bool isNECmp(const CmpInst* cmp) const;
+    /// Return true if this is a test null expression
+    bool isTestNullExpr(const Value* test) const;
+    /// Return true if this is a test not null expression
+    bool isTestNotNullExpr(const Value* test) const;
+    /// Return true if two values on the predicate are what we want
+    bool isTestContainsNullAndTheValue(const CmpInst* cmp) const;
+    //@}
+
+    /// Release memory
+    void destroy()
+    {
+
+    }
+
+    /// extract subexpression from a Z3 expression
+    void extractSubConds(const Condition &condition, NodeBS &support) const;
+
+
+    PTACFInfoBuilder cfInfoBuilder;		    ///< map a function to its loop info
+    FunToExitBBsMap funToExitBBsMap;		///< map a function to all its basic blocks calling program exit
+    BBToCondMap bbToCondMap;				///< map a basic block to its path condition starting from root
+    const SVFGNode* curEvalSVFGNode{};			///< current llvm value to evaluate branch condition when computing guards
+    IndexToTermInstMap idToTermInstMap;     ///key: z3 expression id, value: instruction
+    NodeBS negConds;                        ///bit vector for distinguish neg
+    std::vector<Condition> conditionVec;          /// vector storing z3expression
+    static u32_t totalCondNum; /// a counter for fresh condition
+
+protected:
+    BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions
+
+};
+
+} // End namespace SVF
+
+#endif /* PATHALLOCATOR_H_ */

package/SVF-linux/include/SABER/SrcSnkDDA.h

@@ -62,7 +62,7 @@ private:
     ProgSlice* _curSlice;		/// current program slice
     SVFGNodeSet sources;		/// source nodes
     SVFGNodeSet sinks;		/// source nodes
-    PathCondAllocator* pathCondAllocator;
+    SaberCondAllocator* saberCondAllocator;
     SVFGNodeToDPItemsMap nodeToDPItemsMap;	///<  record forward visited dpitems
     SVFGNodeSet visitedSet;	///<  record backward visited nodes
 
@@ -76,7 +76,7 @@ public:
     /// Constructor
     SrcSnkDDA() : _curSlice(nullptr), svfg(nullptr), ptaCallGraph(nullptr)
     {
-        pathCondAllocator = new PathCondAllocator();
+        saberCondAllocator = new SaberCondAllocator();
     }
     /// Destructor
     virtual ~SrcSnkDDA()
@@ -232,10 +232,10 @@ public:
     }
     //@}
 
-    /// Get path condition allocator
-    PathCondAllocator* getPathAllocator() const
+    /// Get saber condition allocator
+    SaberCondAllocator* getSaberCondAllocator() const
     {
-        return pathCondAllocator;
+        return saberCondAllocator;
     }
 
 protected:
@@ -307,7 +307,7 @@ protected:
     //@{
     void dumpSlices();
     void annotateSlice(ProgSlice* slice);
-    void printBDDStat();
+    void printZ3Stat();
     //@}
 
 };

package/SVF-linux/include/Util/DPItem.h

@@ -30,7 +30,6 @@
 #ifndef DPITEM_H_
 #define DPITEM_H_
 
-#include "Util/BDDExpr.h"
 #include "MemoryModel/ConditionalPT.h"
 #include <algorithm>    // std::sort
 

package/SVF-linux/include/Util/Options.h

@@ -218,9 +218,9 @@ public:
     static const llvm::cl::opt<bool> SymTabPrint;
 
     // Conditions.cpp
-    static const llvm::cl::opt<unsigned> MaxBddSize;
+    static const llvm::cl::opt<unsigned> MaxZ3Size;
 
-    // PathCondAllocator.cpp
+    // SaberCondAllocator.cpp
     static const llvm::cl::opt<bool> PrintPathCond;
 
     // SVFUtil.cpp

package/SVF-linux/include/Util/Z3Expr.h

@@ -39,6 +39,7 @@ class Z3Expr
 {
 public:
     static z3::context *ctx;
+    static z3::solver* solver;
 
 private:
     z3::expr e;
@@ -80,22 +81,18 @@ public:
         return e;
     }
 
+    /// Get z3 solver, singleton design here to make sure we only have one context
+    static z3::solver &getSolver();
+
     /// Get z3 context, singleton design here to make sure we only have one context
-    static z3::context &getContext()
-    {
-        if (ctx == nullptr)
-        {
-            ctx = new z3::context();
-        }
-        return *ctx;
-    }
+    static z3::context &getContext();
 
     /// release z3 context
-    static void releaseContext()
-    {
-        delete ctx;
-        ctx = nullptr;
-    }
+    static void releaseContext();
+
+    /// release z3 solver
+    static void releaseSolver();
+
 
     /// null expression
     static z3::expr nullExpr()
@@ -109,6 +106,12 @@ public:
         return e.id();
     }
 
+    /// get hash id
+    inline u32_t hash() const
+    {
+        return e.hash();
+    }
+
     inline const std::string to_string() const
     {
         return e.to_string();
@@ -245,7 +248,7 @@ public:
         return !lhs.getExpr();
     }
 
-    friend Z3Expr ite(const Z3Expr& cond, const Z3Expr& lhs, const Z3Expr& rhs)
+    friend Z3Expr ite(const Z3Expr &cond, const Z3Expr &lhs, const Z3Expr &rhs)
     {
         return ite(cond.getExpr(), lhs.getExpr(), rhs.getExpr());
     }
@@ -266,6 +269,38 @@ public:
         return getExpr().get_sort();
     }
     //%}
+
+    /// output Z3 expression as a string
+    static std::string dumpStr(const Z3Expr &z3Expr);
+
+
+    /// get the number of subexpression of a Z3 expression
+    static u32_t getExprSize(const Z3Expr &z3Expr);
+
+    /// Return the unique true condition
+    static inline Z3Expr getTrueCond()
+    {
+        return getContext().bool_val(true);
+    }
+
+
+    /// Return the unique false condition
+    static inline Z3Expr getFalseCond()
+    {
+        return getContext().bool_val(false);
+    }
+
+    /// compute NEG
+    static inline Z3Expr NEG(const Z3Expr &z3Expr)
+    {
+        return !z3Expr;
+    }
+
+    /// compute AND, used for branch condition
+    static Z3Expr AND(const Z3Expr &lhs, const Z3Expr &rhs);
+
+    /// compute OR, used for branch condition
+    static Z3Expr OR(const Z3Expr &lhs, const Z3Expr &rhs);
 };
 }
 

package/SVF-osx/include/SABER/ProgSlice.h

@@ -30,7 +30,7 @@
 #ifndef PROGSLICE_H_
 #define PROGSLICE_H_
 
-#include "SABER/PathCondAllocator.h"
+#include "SABER/SaberCondAllocator.h"
 #include "Util/WorkList.h"
 #include "Graphs/SVFG.h"
 #include "Util/DPItem.h"
@@ -44,14 +44,14 @@ class ProgSlice
 public:
     typedef Set<const SVFGNode*> SVFGNodeSet;
     typedef SVFGNodeSet::const_iterator SVFGNodeSetIter;
-    typedef PathCondAllocator::Condition Condition;
-    typedef Map<const SVFGNode*, Condition*> SVFGNodeToCondMap; 	///< map a SVFGNode to its condition during value-flow guard computation
+    typedef SaberCondAllocator::Condition Condition;
+    typedef Map<const SVFGNode*, Condition> SVFGNodeToCondMap; 	///< map a SVFGNode to its condition during value-flow guard computation
 
     typedef FIFOWorkList<const SVFGNode*> VFWorkList;		    ///< worklist for value-flow guard computation
     typedef FIFOWorkList<const BasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
 
     /// Constructor
-    ProgSlice(const SVFGNode* src, PathCondAllocator* pa, const SVFG* graph):
+    ProgSlice(const SVFGNode* src, SaberCondAllocator* pa, const SVFG* graph):
         root(src), partialReachable(false), fullReachable(false), reachGlob(false),
         pathAllocator(pa), _curSVFGNode(nullptr), finalCond(pa->getFalseCond()), svfg(graph)
     {
@@ -168,27 +168,27 @@ public:
 
     /// Condition operations
     //@{
-    inline Condition* condAnd(Condition* lhs, Condition* rhs)
+    inline Condition condAnd(const Condition &lhs, const Condition &rhs)
     {
         return pathAllocator->condAnd(lhs,rhs);
     }
-    inline Condition* condOr(Condition* lhs, Condition* rhs)
+    inline Condition condOr(const Condition &lhs, const Condition &rhs)
     {
         return pathAllocator->condOr(lhs,rhs);
     }
-    inline Condition* condNeg(Condition* cond)
+    inline Condition condNeg(const Condition &cond)
     {
         return pathAllocator->condNeg(cond);
     }
-    inline Condition* getTrueCond() const
+    inline Condition getTrueCond() const
     {
         return pathAllocator->getTrueCond();
     }
-    inline Condition* getFalseCond() const
+    inline Condition getFalseCond() const
     {
         return pathAllocator->getFalseCond();
     }
-    inline std::string dumpCond(Condition* cond) const
+    inline std::string dumpCond(const Condition& cond) const
     {
         return pathAllocator->dumpCond(cond);
     }
@@ -210,13 +210,13 @@ protected:
     /// Clear Control flow conditions before each VF computation
     inline void clearCFCond()
     {
-        /// TODO: how to clean bdd memory
+        /// TODO: how to clean z3 memory
         pathAllocator->clearCFCond();
     }
 
     /// Get/set VF (value-flow) and CF (control-flow) conditions
     //@{
-    inline Condition* getVFCond(const SVFGNode* node) const
+    inline Condition getVFCond(const SVFGNode* node) const
     {
         SVFGNodeToCondMap::const_iterator it = svfgNodeToCondMap.find(node);
         if(it==svfgNodeToCondMap.end())
@@ -225,7 +225,7 @@ protected:
         }
         return it->second;
     }
-    inline bool setVFCond(const SVFGNode* node, Condition* cond)
+    inline bool setVFCond(const SVFGNode* node, const Condition &cond)
     {
         SVFGNodeToCondMap::iterator it = svfgNodeToCondMap.find(node);
         // until a fixed-point is reached (condition is not changed)
@@ -239,21 +239,21 @@ protected:
 
     /// Compute guards for value-flows
     //@{
-    inline Condition* ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst)
+    inline Condition ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst)
     {
         return pathAllocator->ComputeIntraVFGGuard(src,dst);
     }
-    inline Condition* ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB)
+    inline Condition ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB)
     {
         return pathAllocator->ComputeInterCallVFGGuard(src,dst,callBB);
     }
-    inline Condition* ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB)
+    inline Condition ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB)
     {
         return pathAllocator->ComputeInterRetVFGGuard(src,dst,retBB);
     }
     //@}
 
-    inline bool isEquivalentBranchCond(const Condition *lhs, const Condition *rhs) const
+    inline bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const
     {
         return pathAllocator->isEquivalentBranchCond(lhs, rhs);
     };
@@ -284,7 +284,7 @@ protected:
     }
     //@}
     /// Set final condition after all path reachability analysis
-    inline void setFinalCond(Condition* cond)
+    inline void setFinalCond(const Condition &cond)
     {
         finalCond = cond;
     }
@@ -298,9 +298,9 @@ private:
     bool partialReachable;					///<  reachable from some paths
     bool fullReachable;						///<  reachable from all paths
     bool reachGlob;							///<  Whether slice reach a global
-    PathCondAllocator* pathAllocator;		///<  path condition allocator
+    SaberCondAllocator* pathAllocator;		///<  path condition allocator
     const SVFGNode* _curSVFGNode;			///<  current svfg node during guard computation
-    Condition* finalCond;					///<  final condition
+    Condition finalCond;					///<  final condition
     const SVFG* svfg;						///<  SVFG
 };
 

package/SVF-osx/include/SABER/SaberCondAllocator.h

@@ -0,0 +1,305 @@
+//===- SaberCondAllocator.h -- Path condition manipulation---------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * PathAllocator.h
+ *
+ *  Created on: Apr 3, 2014
+ *      Author: Yulei Sui
+ */
+
+#ifndef PATHALLOCATOR_H_
+#define PATHALLOCATOR_H_
+
+#include "Util/SVFModule.h"
+#include "SVF-FE/DataFlowUtil.h"
+#include "SVF-FE/BasicTypes.h"
+#include "Util/WorkList.h"
+#include "Graphs/SVFG.h"
+#include "Util/Z3Expr.h"
+
+
+namespace SVF
+{
+
+/**
+ * SaberCondAllocator allocates conditions for each basic block of a certain CFG.
+ */
+class SaberCondAllocator
+{
+
+public:
+
+    typedef Z3Expr Condition;   /// z3 condition
+    typedef Map<u32_t, const Instruction *> IndexToTermInstMap; /// id to instruction map for z3
+    typedef Map<u32_t,Condition> CondPosMap;		///< map a branch to its Condition
+    typedef Map<const BasicBlock*, CondPosMap > BBCondMap;	/// map bb to a Condition
+    typedef Set<const BasicBlock*> BasicBlockSet;
+    typedef Map<const Function*,  BasicBlockSet> FunToExitBBsMap;  ///< map a function to all its basic blocks calling program exit
+    typedef Map<const BasicBlock*, Condition> BBToCondMap;	///< map a basic block to its condition during control-flow guard computation
+    typedef FIFOWorkList<const BasicBlock*> CFWorkList;	///< worklist for control-flow guard computation
+
+
+    /// Constructor
+    SaberCondAllocator();
+
+    /// Destructor
+    virtual ~SaberCondAllocator()
+    {
+    }
+    /// Statistics
+    //@{
+    inline std::string getMemUsage()
+    {
+        return "";
+    }
+    inline u32_t getCondNum()
+    {
+        return totalCondNum;
+    }
+    //@}
+
+    /// Condition operations
+    //@{
+    inline Condition condAnd(const Condition& lhs, const Condition& rhs)
+    {
+        return Condition::AND(lhs,rhs);
+    }
+    inline Condition condOr(const Condition& lhs, const Condition& rhs)
+    {
+        return Condition::OR(lhs,rhs);
+    }
+    inline Condition condNeg(const Condition& cond)
+    {
+        return Condition::NEG(cond);
+    }
+    inline Condition getTrueCond() const
+    {
+        return Condition::getTrueCond();
+    }
+    inline Condition getFalseCond() const
+    {
+        return Condition::getFalseCond();
+    }
+    /// Iterator every element of the condition
+    inline NodeBS exactCondElem(const Condition& cond)
+    {
+        NodeBS elems;
+        extractSubConds(cond, elems);
+        return elems;
+    }
+
+    inline std::string dumpCond(const Condition& cond) const
+    {
+        return Condition::dumpStr(cond);
+    }
+
+    /// Allocate a new condition
+    Condition newCond(const Instruction* inst);
+
+    /// Perform path allocation
+    void allocate(const SVFModule* module);
+
+    /// Get/Set instruction based on Z3 expression id
+    //{@
+    inline const Instruction *getCondInst(u32_t id) const
+    {
+        IndexToTermInstMap::const_iterator it = idToTermInstMap.find(id);
+        assert(it != idToTermInstMap.end() && "this should be a fresh condition");
+        return it->second;
+    }
+
+    inline void setCondInst(const Condition &condition, const Instruction *inst)
+    {
+        assert(idToTermInstMap.find(condition.id()) == idToTermInstMap.end() && "this should be a fresh condition");
+        idToTermInstMap[condition.id()] = inst;
+    }
+    //@}
+
+    bool isNegCond(u32_t id) const
+    {
+        return negConds.test(id);
+    }
+
+    /// Get dominators
+    inline DominatorTree* getDT(const Function* fun)
+    {
+        return cfInfoBuilder.getDT(fun);
+    }
+    /// Get Postdominators
+    inline PostDominatorTree* getPostDT(const Function* fun)
+    {
+        return cfInfoBuilder.getPostDT(fun);
+    }
+    /// Get LoopInfo
+    inline LoopInfo* getLoopInfo(const Function* f)
+    {
+        return cfInfoBuilder.getLoopInfo(f);
+    }
+
+
+    /// Guard Computation for a value-flow (between two basic blocks)
+    //@{
+    virtual Condition ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst);
+    virtual Condition ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB);
+    virtual Condition ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB);
+
+    /// Get complement condition (from B1 to B0) according to a complementBB (BB2) at a phi
+    /// e.g., B0: dstBB; B1:incomingBB; B2:complementBB
+    virtual Condition getPHIComplementCond(const BasicBlock* BB1, const BasicBlock* BB2, const BasicBlock* BB0);
+
+    inline void clearCFCond()
+    {
+        bbToCondMap.clear();
+    }
+    /// Set current value for branch condition evaluation
+    inline void setCurEvalSVFGNode(const SVFGNode* node)
+    {
+        curEvalSVFGNode = node;
+    }
+    /// Get current value for branch condition evaluation
+    inline const SVFGNode* getCurEvalSVFGNode() const
+    {
+        return curEvalSVFGNode;
+    }
+    //@}
+
+    /// Print out the path condition information
+    void printPathCond();
+
+    /// whether condition is satisfiable
+    bool isSatisfiable(const Condition& condition);
+
+    /// whether condition is satisfiable for all possible boolean guards
+    inline bool isAllPathReachable(Condition& condition)
+    {
+        return isEquivalentBranchCond(condition, Condition::getTrueCond());
+    }
+
+    /// Whether lhs and rhs are equivalent branch conditions
+    bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const;
+
+    inline ICFG* getICFG() const
+    {
+        return PAG::getPAG()->getICFG();
+    }
+
+    /// Get/Set control-flow conditions
+    //@{
+    inline bool setCFCond(const BasicBlock* bb, const Condition& cond)
+    {
+        BBToCondMap::iterator it = bbToCondMap.find(bb);
+        // until a fixed-point is reached (condition is not changed)
+        if(it!=bbToCondMap.end() && isEquivalentBranchCond(it->second, cond))
+            return false;
+
+        bbToCondMap[bb] = cond;
+        return true;
+    }
+    inline Condition getCFCond(const BasicBlock* bb) const
+    {
+        BBToCondMap::const_iterator it = bbToCondMap.find(bb);
+        if(it==bbToCondMap.end())
+        {
+            return getFalseCond();
+        }
+        return it->second;
+    }
+    //@}
+
+
+    /// mark neg Z3 expression
+    inline void setNegCondInst(const Condition &condition, const Instruction *inst)
+    {
+        setCondInst(condition, inst);
+        negConds.set(condition.id());
+    }
+private:
+
+    /// Allocate path condition for every basic block
+    virtual void allocateForBB(const BasicBlock& bb);
+
+    /// Get/Set a branch condition, and its terminator instruction
+    //@{
+    /// Set branch condition
+    void setBranchCond(const BasicBlock *bb, const BasicBlock *succ, const Condition& cond);
+    /// Get branch condition
+    Condition getBranchCond(const BasicBlock * bb, const BasicBlock *succ) const;
+    ///Get a condition, evaluate the value for conditions if necessary (e.g., testNull like express)
+    Condition getEvalBrCond(const BasicBlock * bb, const BasicBlock *succ);
+    //@}
+    /// Evaluate branch conditions
+    //@{
+    /// Evaluate the branch condtion
+    Condition evaluateBranchCond(const BasicBlock * bb, const BasicBlock *succ) ;
+    /// Evaluate loop exit branch
+    Condition evaluateLoopExitBranch(const BasicBlock * bb, const BasicBlock *succ);
+    /// Return branch condition after evaluating test null like expression
+    Condition evaluateTestNullLikeExpr(const BranchStmt* branchStmt, const BasicBlock *succ);
+    /// Return condition when there is a branch calls program exit
+    Condition evaluateProgExit(const BranchStmt* branchStmt, const BasicBlock *succ);
+    /// Collect basic block contains program exit function call
+    void collectBBCallingProgExit(const BasicBlock& bb);
+    bool isBBCallsProgExit(const BasicBlock* bb);
+    //@}
+
+    /// Evaluate test null/not null like expressions
+    //@{
+    /// Return true if the predicate of this compare instruction is equal
+    bool isEQCmp(const CmpInst* cmp) const;
+    /// Return true if the predicate of this compare instruction is not equal
+    bool isNECmp(const CmpInst* cmp) const;
+    /// Return true if this is a test null expression
+    bool isTestNullExpr(const Value* test) const;
+    /// Return true if this is a test not null expression
+    bool isTestNotNullExpr(const Value* test) const;
+    /// Return true if two values on the predicate are what we want
+    bool isTestContainsNullAndTheValue(const CmpInst* cmp) const;
+    //@}
+
+    /// Release memory
+    void destroy()
+    {
+
+    }
+
+    /// extract subexpression from a Z3 expression
+    void extractSubConds(const Condition &condition, NodeBS &support) const;
+
+
+    PTACFInfoBuilder cfInfoBuilder;		    ///< map a function to its loop info
+    FunToExitBBsMap funToExitBBsMap;		///< map a function to all its basic blocks calling program exit
+    BBToCondMap bbToCondMap;				///< map a basic block to its path condition starting from root
+    const SVFGNode* curEvalSVFGNode{};			///< current llvm value to evaluate branch condition when computing guards
+    IndexToTermInstMap idToTermInstMap;     ///key: z3 expression id, value: instruction
+    NodeBS negConds;                        ///bit vector for distinguish neg
+    std::vector<Condition> conditionVec;          /// vector storing z3expression
+    static u32_t totalCondNum; /// a counter for fresh condition
+
+protected:
+    BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions
+
+};
+
+} // End namespace SVF
+
+#endif /* PATHALLOCATOR_H_ */

package/SVF-osx/include/SABER/SrcSnkDDA.h

@@ -62,7 +62,7 @@ private:
     ProgSlice* _curSlice;		/// current program slice
     SVFGNodeSet sources;		/// source nodes
     SVFGNodeSet sinks;		/// source nodes
-    PathCondAllocator* pathCondAllocator;
+    SaberCondAllocator* saberCondAllocator;
     SVFGNodeToDPItemsMap nodeToDPItemsMap;	///<  record forward visited dpitems
     SVFGNodeSet visitedSet;	///<  record backward visited nodes
 
@@ -76,7 +76,7 @@ public:
     /// Constructor
     SrcSnkDDA() : _curSlice(nullptr), svfg(nullptr), ptaCallGraph(nullptr)
     {
-        pathCondAllocator = new PathCondAllocator();
+        saberCondAllocator = new SaberCondAllocator();
     }
     /// Destructor
     virtual ~SrcSnkDDA()
@@ -232,10 +232,10 @@ public:
     }
     //@}
 
-    /// Get path condition allocator
-    PathCondAllocator* getPathAllocator() const
+    /// Get saber condition allocator
+    SaberCondAllocator* getSaberCondAllocator() const
     {
-        return pathCondAllocator;
+        return saberCondAllocator;
     }
 
 protected:
@@ -307,7 +307,7 @@ protected:
     //@{
     void dumpSlices();
     void annotateSlice(ProgSlice* slice);
-    void printBDDStat();
+    void printZ3Stat();
     //@}
 
 };

package/SVF-osx/include/Util/DPItem.h

@@ -30,7 +30,6 @@
 #ifndef DPITEM_H_
 #define DPITEM_H_
 
-#include "Util/BDDExpr.h"
 #include "MemoryModel/ConditionalPT.h"
 #include <algorithm>    // std::sort
 

package/SVF-osx/include/Util/Options.h

@@ -218,9 +218,9 @@ public:
     static const llvm::cl::opt<bool> SymTabPrint;
 
     // Conditions.cpp
-    static const llvm::cl::opt<unsigned> MaxBddSize;
+    static const llvm::cl::opt<unsigned> MaxZ3Size;
 
-    // PathCondAllocator.cpp
+    // SaberCondAllocator.cpp
     static const llvm::cl::opt<bool> PrintPathCond;
 
     // SVFUtil.cpp

package/SVF-osx/include/Util/Z3Expr.h

@@ -39,6 +39,7 @@ class Z3Expr
 {
 public:
     static z3::context *ctx;
+    static std::unique_ptr<z3::solver> solver;
 
 private:
     z3::expr e;
@@ -80,22 +81,15 @@ public:
         return e;
     }
 
+    /// Get z3 solver, singleton design here to make sure we only have one context
+    static z3::solver &getSolver();
+
     /// Get z3 context, singleton design here to make sure we only have one context
-    static z3::context &getContext()
-    {
-        if (ctx == nullptr)
-        {
-            ctx = new z3::context();
-        }
-        return *ctx;
-    }
+    static z3::context &getContext();
 
     /// release z3 context
-    static void releaseContext()
-    {
-        delete ctx;
-        ctx = nullptr;
-    }
+    static void releaseContext();
+
 
     /// null expression
     static z3::expr nullExpr()
@@ -109,6 +103,12 @@ public:
         return e.id();
     }
 
+    /// get hash id
+    inline u32_t hash() const
+    {
+        return e.hash();
+    }
+
     inline const std::string to_string() const
     {
         return e.to_string();
@@ -245,7 +245,7 @@ public:
         return !lhs.getExpr();
     }
 
-    friend Z3Expr ite(const Z3Expr& cond, const Z3Expr& lhs, const Z3Expr& rhs)
+    friend Z3Expr ite(const Z3Expr &cond, const Z3Expr &lhs, const Z3Expr &rhs)
     {
         return ite(cond.getExpr(), lhs.getExpr(), rhs.getExpr());
     }
@@ -266,6 +266,38 @@ public:
         return getExpr().get_sort();
     }
     //%}
+
+    /// output Z3 expression as a string
+    static std::string dumpStr(const Z3Expr &z3Expr);
+
+
+    /// get the number of subexpression of a Z3 expression
+    static u32_t getExprSize(const Z3Expr &z3Expr);
+
+    /// Return the unique true condition
+    static inline Z3Expr getTrueCond()
+    {
+        return getContext().bool_val(true);
+    }
+
+
+    /// Return the unique false condition
+    static inline Z3Expr getFalseCond()
+    {
+        return getContext().bool_val(false);
+    }
+
+    /// compute NEG
+    static inline Z3Expr NEG(const Z3Expr &z3Expr)
+    {
+        return !z3Expr;
+    }
+
+    /// compute AND, used for branch condition
+    static Z3Expr AND(const Z3Expr &lhs, const Z3Expr &rhs);
+
+    /// compute OR, used for branch condition
+    static Z3Expr OR(const Z3Expr &lhs, const Z3Expr &rhs);
 };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-lib",
-  "version": "1.0.1111",
+  "version": "1.0.1114",
   "description": "SVF's npm support",
   "main": "index.js",
   "scripts": {