svf-lib 1.0.1374 → 1.0.1376

package/SVF-osx/svf/include/AbstractExecution/NumericLiteral.h

@@ -0,0 +1,406 @@
+//===- NumericLiteral.h ----Number wrapper for domains------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2022>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * NumericLiteral.h
+ *
+ *  Created on: Aug 4, 2022
+ *      Author: Xiao Cheng, Jiawei Wang
+ *
+ */
+
+#ifndef Z3_EXAMPLE_Number_H
+#define Z3_EXAMPLE_Number_H
+
+#include "SVFIR/SVFType.h"
+
+namespace SVF
+{
+class NumericLiteral
+{
+private:
+    double _n;
+
+public:
+    /// Default constructor
+    NumericLiteral() = delete;
+
+    /// Create a new NumericLiteral from double
+    NumericLiteral(double n) : _n(n) {}
+
+    /// Create a new NumericLiteral from s32_t
+    NumericLiteral(s32_t n) : _n(n) {}
+
+    /// Create a new NumericLiteral from s64_t
+    NumericLiteral(s64_t n) : _n(n) {}
+
+    /// Create a new NumericLiteral from u32_t
+    NumericLiteral(u32_t n) : _n(n) {}
+
+    /// Create a new NumericLiteral from u64_t
+    NumericLiteral(u64_t n) : _n(n) {}
+
+    virtual ~NumericLiteral() = default;
+
+    /// Copy Constructor
+    NumericLiteral(const NumericLiteral &) noexcept = default;
+
+    /// Move Constructor
+    NumericLiteral(NumericLiteral &&) noexcept = default;
+
+    /// Operator = , another Copy Constructor
+    inline NumericLiteral &operator=(const NumericLiteral &) noexcept = default;
+
+    /// Operator = , another Move Constructor
+    inline NumericLiteral &operator=(NumericLiteral &&) noexcept = default;
+
+    /// Get minus infinity -oo
+    static NumericLiteral minus_infinity()
+    {
+        return NumericLiteral(INT_MIN);
+    }
+
+    /// Get plus infinity +oo
+    static NumericLiteral plus_infinity()
+    {
+        return NumericLiteral(INT_MAX);
+    }
+
+    /// Check if this is minus infinity
+    inline bool is_minus_infinity() const
+    {
+        return _n == INT_MIN;
+    }
+
+    /// Check if this is plus infinity
+    inline bool is_plus_infinity() const
+    {
+        return _n == INT_MAX;
+    }
+
+    /// Check if this is infinity (either of plus/minus)
+    inline bool is_infinity() const
+    {
+        return is_minus_infinity() || is_plus_infinity();
+    }
+
+    /// Check if this is zero
+    inline bool is_zero() const
+    {
+        return _n == 0;
+    }
+
+    /// Return Numeral
+    inline double getNumeral() const
+    {
+        return _n;
+    }
+
+    /// Check two object is equal
+    bool equal(const NumericLiteral &rhs) const
+    {
+        return eq(*this, rhs);
+    }
+
+    /// Less then or equal
+    bool leq(const NumericLiteral &rhs) const
+    {
+        if (is_infinity() ^ rhs.is_infinity())
+        {
+            if (is_infinity())
+            {
+                return is_minus_infinity();
+            }
+            else
+            {
+                return rhs.is_plus_infinity();
+            }
+        }
+        return _n <= rhs._n;
+    }
+
+    // Greater than or equal
+    bool geq(const NumericLiteral &rhs) const
+    {
+        if (is_infinity() ^ rhs.is_infinity())
+        {
+            if (is_infinity())
+            {
+                return is_plus_infinity();
+            }
+            else
+            {
+                return rhs.is_minus_infinity();
+            }
+        }
+        return _n >= rhs._n;
+    }
+
+
+    /// Reload operator
+    //{%
+    friend NumericLiteral operator==(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return eq(lhs, rhs);
+    }
+
+    friend NumericLiteral operator!=(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return !eq(lhs, rhs);
+    }
+
+    friend NumericLiteral operator>(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return !lhs.leq(rhs);
+    }
+
+    friend NumericLiteral operator<(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return !lhs.geq(rhs);
+    }
+
+    friend NumericLiteral operator<=(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return lhs.leq(rhs);
+    }
+
+    friend NumericLiteral operator>=(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return lhs.geq(rhs);
+    }
+
+    friend NumericLiteral operator+(const NumericLiteral& lhs, const NumericLiteral& rhs)
+    {
+        if (!lhs.is_infinity() && !rhs.is_infinity())
+            return lhs.getNumeral() + rhs.getNumeral();
+        else if (!lhs.is_infinity() && rhs.is_infinity())
+            return rhs;
+        else if (lhs.is_infinity() && !rhs.is_infinity())
+            return lhs;
+        else if (eq(lhs, rhs))
+            return lhs;
+        else
+        {
+            assert(false && "undefined operation +oo + -oo");
+            abort();
+        }
+    }
+
+    friend NumericLiteral operator-(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        if (!lhs.is_infinity() && !rhs.is_infinity())
+            return lhs.getNumeral() - rhs.getNumeral();
+        else if (!lhs.is_infinity() && rhs.is_infinity())
+            return -rhs;
+        else if (lhs.is_infinity() && !rhs.is_infinity())
+            return lhs;
+        else if (!eq(lhs, rhs))
+            return lhs;
+        else
+        {
+            assert(false && "undefined operation +oo - +oo");
+            abort();
+        }
+    }
+
+    friend NumericLiteral operator*(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        if (lhs.is_zero() || rhs.is_zero())
+            return 0;
+        else if (lhs.is_infinity() && rhs.is_infinity())
+            return eq(lhs, rhs) ? plus_infinity() : minus_infinity();
+        else if (lhs.is_infinity())
+            return rhs.getNumeral() > 0 ? lhs : -lhs;
+        else if (rhs.is_infinity())
+            return lhs.getNumeral() > 0 ? rhs : -rhs;
+        else
+            return lhs.getNumeral() * rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator/(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        if (rhs.is_zero())
+        {
+
+            assert(false && "divide by zero");
+            abort();
+        }
+        else if (!lhs.is_infinity() && !rhs.is_infinity())
+            return lhs.getNumeral() / rhs.getNumeral();
+        else if (!lhs.is_infinity() && rhs.is_infinity())
+            return 0;
+        else if (lhs.is_infinity() && !rhs.is_infinity())
+            return rhs.getNumeral() > 0 ? lhs : -lhs;
+        else
+            // TODO: +oo/-oo L'Hôpital's rule?
+            return eq(lhs, rhs) ? plus_infinity() : minus_infinity();
+    }
+
+    friend NumericLiteral operator%(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        if (rhs.is_zero())
+        {
+            assert(false && "divide by zero");
+            abort();
+        }
+        else if (!lhs.is_infinity() && !rhs.is_infinity())
+            return (s32_t) lhs.getNumeral() % (s32_t) rhs.getNumeral();
+        else if (!lhs.is_infinity() && rhs.is_infinity())
+            return 0;
+        // TODO: not sure
+        else if (lhs.is_infinity() && !rhs.is_infinity())
+            return rhs.getNumeral() > 0 ? lhs : -lhs;
+        else
+            // TODO: +oo/-oo L'Hôpital's rule?
+            return eq(lhs, rhs) ? plus_infinity() : minus_infinity();
+    }
+
+    // TODO: logic operation for infinity?
+    friend NumericLiteral operator^(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return (s32_t) lhs.getNumeral() ^ (s32_t) rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator&(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return (s32_t) lhs.getNumeral() & (s32_t) rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator|(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return (s32_t) lhs.getNumeral() | (s32_t) rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator>>(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        assert(rhs.geq(0) && "rhs should be greater or equal than 0");
+        if (lhs.is_zero())
+            return lhs;
+        else if (lhs.is_infinity())
+            return lhs;
+        else if (rhs.is_infinity())
+            return lhs._n >= 0 ? 0 : -1;
+        else
+            return (s32_t) lhs.getNumeral() >> (s32_t) rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator<<(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        assert(rhs.geq(0) && "rhs should be greater or equal than 0");
+        if (lhs.is_zero())
+            return lhs;
+        else if (lhs.is_infinity())
+            return lhs;
+        else if (rhs.is_infinity())
+            return lhs._n >= 0 ? plus_infinity() : minus_infinity();
+        else
+            return (s32_t) lhs.getNumeral() << (s32_t) rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator&&(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return lhs.getNumeral() && rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator||(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return lhs.getNumeral() || rhs.getNumeral();
+    }
+
+    friend NumericLiteral operator!(const NumericLiteral &lhs)
+    {
+        return !lhs.getNumeral();
+    }
+
+    friend NumericLiteral operator-(const NumericLiteral &lhs)
+    {
+        return -lhs.getNumeral();
+    }
+
+    /// Return ite? lhs : rhs
+    friend NumericLiteral ite(const NumericLiteral &cond, const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return cond.getNumeral() ? lhs.getNumeral() : rhs.getNumeral();
+    }
+
+    friend std::ostream &operator<<(std::ostream &out, const NumericLiteral &expr)
+    {
+        if (expr.is_plus_infinity())
+            out << "+INF";
+        else if (expr.is_minus_infinity())
+            out << "-INF";
+        else
+            out << std::to_string(expr.getNumeral());
+        return out;
+    }
+
+    friend bool eq(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return lhs._n == rhs._n;
+    }
+
+    friend NumericLiteral min(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return std::min(lhs.getNumeral(), rhs.getNumeral());
+    }
+
+    friend NumericLiteral max(const NumericLiteral &lhs, const NumericLiteral &rhs)
+    {
+        return std::max(lhs.getNumeral(), rhs.getNumeral());
+    }
+
+    // TODO: how to use initializer_list as argument?
+    friend NumericLiteral min(std::initializer_list<NumericLiteral> _l)
+    {
+        NumericLiteral ret(INT_MAX);
+        for (const auto &it: _l)
+        {
+            if (it.is_minus_infinity())
+                return minus_infinity();
+            else if (!it.geq(ret))
+            {
+                ret = it;
+            }
+        }
+        return ret;
+    }
+
+    friend NumericLiteral max(std::initializer_list<NumericLiteral> _l)
+    {
+        NumericLiteral ret(INT_MIN);
+        for (const auto &it: _l)
+        {
+            if (it.is_plus_infinity())
+                return plus_infinity();
+            else if (!it.leq(ret))
+            {
+                ret = it;
+            }
+        }
+        return ret;
+    }
+
+    //%}
+
+
+}; // end class IntervalDouble
+} // end namespace SVF
+#endif //Z3_EXAMPLE_Number_H

package/SVF-osx/svf/include/AbstractExecution/RelExeState.h

@@ -0,0 +1,225 @@
+//===- RelExeState.h ----Relation Execution States for Interval Domains-------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2022>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * RelExeState.h
+ *
+ *  Created on: Aug 15, 2022
+ *      Author: Jiawei Ren, Xiao Cheng
+ *
+ */
+
+#ifndef Z3_EXAMPLE_RELEXESTATE_H
+#define Z3_EXAMPLE_RELEXESTATE_H
+
+#include "Util/Z3Expr.h"
+#include "AbstractExecution/AddressValue.h"
+
+namespace SVF
+{
+
+class RelExeState
+{
+    friend class SVFIR2ItvExeState;
+
+public:
+    typedef Map<u32_t, Z3Expr> VarToValMap;
+    typedef VarToValMap LocToValMap;
+
+protected:
+    VarToValMap _varToVal;
+    LocToValMap _locToVal;
+
+public:
+    RelExeState() = default;
+
+    RelExeState(VarToValMap &varToVal, LocToValMap &locToVal) : _varToVal(varToVal),
+        _locToVal(locToVal) {}
+
+    RelExeState(const RelExeState &rhs) : _varToVal(rhs.getVarToVal()), _locToVal(rhs.getLocToVal())
+    {
+
+    }
+
+    virtual ~RelExeState() = default;
+
+    RelExeState &operator=(const RelExeState &rhs);
+
+    RelExeState(RelExeState &&rhs) noexcept: _varToVal(std::move(rhs._varToVal)),
+        _locToVal(std::move(rhs._locToVal))
+    {
+
+    }
+
+    RelExeState &operator=(RelExeState &&rhs) noexcept
+    {
+        if (&rhs != this)
+        {
+            _varToVal = std::move(rhs._varToVal);
+            _locToVal = std::move(rhs._locToVal);
+        }
+        return *this;
+    }
+
+    /// Overloading Operator==
+    bool operator==(const RelExeState &rhs) const;
+
+    /// Overloading Operator!=
+    inline bool operator!=(const RelExeState &rhs) const
+    {
+        return !(*this == rhs);
+    }
+
+    /// Overloading Operator==
+    bool operator<(const RelExeState &rhs) const;
+
+
+    static z3::context &getContext()
+    {
+        return Z3Expr::getContext();
+    }
+
+    const VarToValMap &getVarToVal() const
+    {
+        return _varToVal;
+    }
+
+    const LocToValMap &getLocToVal() const
+    {
+        return _locToVal;
+    }
+
+    inline Z3Expr &operator[](u32_t varId)
+    {
+        return getZ3Expr(varId);
+    }
+
+    u32_t hash() const
+    {
+        size_t h = getVarToVal().size() * 2;
+        SVF::Hash<SVF::u32_t> hf;
+        for (const auto &t: getVarToVal())
+        {
+            h ^= hf(t.first) + 0x9e3779b9 + (h << 6) + (h >> 2);
+            h ^= hf(t.second.id()) + 0x9e3779b9 + (h << 6) + (h >> 2);
+        }
+
+        size_t h2 = getVarToVal().size() * 2;
+
+        for (const auto &t: getLocToVal())
+        {
+            h2 ^= hf(t.first) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
+            h2 ^= hf(t.second.id()) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
+        }
+        SVF::Hash<std::pair<SVF::u32_t, SVF::u32_t>> pairH;
+
+        return pairH(std::make_pair(h, h2));
+    }
+
+    /// Return true if map has varId
+    inline bool existsVar(u32_t varId) const
+    {
+        return _varToVal.count(varId);
+    }
+
+    /// Return Z3 expression eagerly based on SVFVar ID
+    virtual inline Z3Expr &getZ3Expr(u32_t varId)
+    {
+        return _varToVal[varId];
+    }
+
+    /// Return Z3 expression lazily based on SVFVar ID
+    virtual inline Z3Expr toZ3Expr(u32_t varId) const
+    {
+        return getContext().int_const(std::to_string(varId).c_str());
+    }
+
+    /// Extract sub SVFVar IDs of a Z3Expr
+    void extractSubVars(const Z3Expr &expr, Set<u32_t> &res);
+
+    /// Extract all related SVFVar IDs based on compare expr
+    void extractCmpVars(const Z3Expr &expr, Set<u32_t> &res);
+
+    /// Build relational Z3Expr
+    Z3Expr buildRelZ3Expr(u32_t cmp, s32_t succ, Set<u32_t> &vars, Set<u32_t> &initVars);
+
+    /// Store value to location
+    void store(const Z3Expr &loc, const Z3Expr &value);
+
+    /// Load value at location
+    Z3Expr &load(const Z3Expr &loc);
+
+    /// The physical address starts with 0x7f...... + idx
+    static inline u32_t getVirtualMemAddress(u32_t idx)
+    {
+        return AddressValue::getVirtualMemAddress(idx);
+    }
+
+    /// Check bit value of val start with 0x7F000000, filter by 0xFF000000
+    static inline bool isVirtualMemAddress(u32_t val)
+    {
+        return AddressValue::isVirtualMemAddress(val);
+    }
+
+    /// Return the internal index if idx is an address otherwise return the value of idx
+    static inline u32_t getInternalID(u32_t idx)
+    {
+        return AddressValue::getInternalID(idx);
+    }
+
+    /// Return int value from an expression if it is a numeral, otherwise return an approximate value
+    static inline s32_t z3Expr2NumValue(const Z3Expr &e)
+    {
+        assert(e.is_numeral() && "not numeral?");
+        return e.get_numeral_int64();
+    }
+
+    /// Print values of all expressions
+    void printExprValues();
+
+private:
+    bool eqVarToValMap(const VarToValMap &lhs, const VarToValMap &rhs) const;
+
+    bool lessThanVarToValMap(const VarToValMap &lhs, const VarToValMap &rhs) const;
+
+protected:
+    inline void store(u32_t objId, const Z3Expr &z3Expr)
+    {
+        _locToVal[objId] = z3Expr.simplify();
+    }
+
+    inline Z3Expr &load(u32_t objId)
+    {
+        return _locToVal[objId];
+    }
+}; // end class RelExeState
+} // end namespace SVF
+
+template<>
+struct std::hash<SVF::RelExeState>
+{
+    size_t operator()(const SVF::RelExeState &exeState) const
+    {
+        return exeState.hash();
+    }
+};
+
+#endif //Z3_EXAMPLE_RELEXESTATE_H

package/SVF-osx/svf/include/AbstractExecution/RelationSolver.h

@@ -0,0 +1,68 @@
+//===- RelationSolver.h ----Relation Solver for Interval Domains-----------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2022>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * RelationSolver.h
+ *
+ *  Created on: Aug 4, 2022
+ *      Author: Jiawei Ren
+ *
+ */
+
+#ifndef Z3_EXAMPLE_RELATIONSOLVER_H
+#define Z3_EXAMPLE_RELATIONSOLVER_H
+
+#include "AbstractExecution/IntervalExeState.h"
+#include "Util/Z3Expr.h"
+
+namespace SVF
+{
+class RelationSolver
+{
+public:
+    RelationSolver() = default;
+
+    /* gamma_hat, beta and abstract_consequence works on
+    IntervalExeState (the last element of inputs) for RSY or bilateral solver */
+
+    /// Return Z3Expr according to valToValMap
+    Z3Expr gamma_hat(IntervalExeState &exeState);
+
+    /// Return Z3Expr according to another valToValMap
+    Z3Expr gamma_hat(IntervalExeState &alpha, IntervalExeState &exeState);
+
+    /// Return Z3Expr from a NodeID
+    Z3Expr gamma_hat(u32_t id, IntervalExeState &exeState);
+
+    IntervalExeState abstract_consequence(IntervalExeState &lower, IntervalExeState &upper, IntervalExeState &domain);
+
+    IntervalExeState beta(Map<u32_t, double> &sigma, IntervalExeState &exeState);
+
+    /* two optional solvers: RSY and bilateral */
+
+    IntervalExeState bilateral(IntervalExeState domain, Z3Expr phi, u32_t descend_check = 0);
+
+    IntervalExeState RSY(IntervalExeState domain, const Z3Expr &phi);
+
+};
+}
+
+#endif //Z3_EXAMPLE_RELATIONSOLVER_H