svf-lib 1.0.2319 → 1.0.2321

package/SVF-osx/Release-build/include/SVF/DDA/ContextDDA.h

@@ -0,0 +1,230 @@
+//===- ContextDDA.h -- Context-sensitive demand-driven analysis-------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * ContextDDA.h
+ *
+ *  Created on: Aug 17, 2014
+ *      Author: Yulei Sui
+ *
+ * The implementation is based on
+ * (1) Yulei Sui and Jingling Xue. "On-Demand Strong Update Analysis via Value-Flow Refinement".
+ * ACM SIGSOFT International Symposium on the Foundation of Software Engineering (FSE'16)
+ *
+ * (2) Yulei Sui and Jingling Xue. "Value-Flow-Based Demand-Driven Pointer Analysis for C and C++".
+ * IEEE Transactions on Software Engineering (TSE'18)
+ */
+
+#ifndef ContextDDA_H_
+#define ContextDDA_H_
+
+#include "MemoryModel/PointerAnalysisImpl.h"
+#include "DDA/DDAVFSolver.h"
+#include "Util/DPItem.h"
+
+namespace SVF
+{
+
+class FlowDDA;
+class DDAClient;
+typedef CxtStmtDPItem<SVFGNode> CxtLocDPItem;
+
+/*!
+ * Context-, Flow- Sensitive Demand-driven Analysis
+ */
+class ContextDDA : public CondPTAImpl<ContextCond>, public DDAVFSolver<CxtVar,CxtPtSet,CxtLocDPItem>
+{
+
+public:
+    /// Constructor
+    ContextDDA(SVFIR* _pag, DDAClient* client);
+
+    /// Destructor
+    virtual ~ContextDDA();
+
+    /// Initialization of the analysis
+    virtual void initialize() override;
+
+    /// Finalize analysis
+    virtual inline void finalize() override
+    {
+        CondPTAImpl<ContextCond>::finalize();
+    }
+
+    /// dummy analyze method
+    virtual void analyze() override {}
+
+    /// Compute points-to set for an unconditional pointer
+    virtual void computeDDAPts(NodeID id) override;
+
+    /// Compute points-to set for a context-sensitive pointer
+    virtual const CxtPtSet& computeDDAPts(const CxtVar& cxtVar);
+
+    /// Handle out-of-budget dpm
+    void handleOutOfBudgetDpm(const CxtLocDPItem& dpm);
+
+    /// Override parent method
+    virtual CxtPtSet getConservativeCPts(const CxtLocDPItem& dpm) override
+    {
+        const PointsTo& pts =  getAndersenAnalysis()->getPts(dpm.getCurNodeID());
+        CxtPtSet tmpCPts;
+        ContextCond cxt;
+        for (PointsTo::iterator piter = pts.begin(); piter != pts.end(); ++piter)
+        {
+            CxtVar var(cxt,*piter);
+            tmpCPts.set(var);
+        }
+        return tmpCPts;
+    }
+
+    /// Override parent method
+    virtual inline NodeID getPtrNodeID(const CxtVar& var) const override
+    {
+        return var.get_id();
+    }
+    /// Handle condition for context or path analysis (backward analysis)
+    virtual bool handleBKCondition(CxtLocDPItem& dpm, const SVFGEdge* edge) override;
+
+    /// we exclude concrete heap given the following conditions:
+    /// (1) concrete calling context (not involved in recursion and not exceed the maximum context limit)
+    /// (2) not inside loop
+    virtual bool isHeapCondMemObj(const CxtVar& var, const StoreSVFGNode* store) override;
+
+    /// refine indirect call edge
+    bool testIndCallReachability(CxtLocDPItem& dpm, const FunObjVar* callee, const CallICFGNode* cs);
+
+    /// get callsite id from call, return 0 if it is a spurious call edge
+    CallSiteID getCSIDAtCall(CxtLocDPItem& dpm, const SVFGEdge* edge);
+
+    /// get callsite id from return, return 0 if it is a spurious return edge
+    CallSiteID getCSIDAtRet(CxtLocDPItem& dpm, const SVFGEdge* edge);
+
+
+    /// Pop recursive callsites
+    inline virtual void popRecursiveCallSites(CxtLocDPItem& dpm)
+    {
+        ContextCond& cxtCond = dpm.getCond();
+        cxtCond.setNonConcreteCxt();
+        CallStrCxt& cxt = cxtCond.getContexts();
+        while(!cxt.empty() && isEdgeInRecursion(cxt.back()))
+        {
+            cxt.pop_back();
+        }
+    }
+    /// Whether call/return inside recursion
+    inline virtual bool isEdgeInRecursion(CallSiteID csId)
+    {
+        const FunObjVar* caller = getCallGraph()->getCallerOfCallSite(csId);
+        const FunObjVar* callee = getCallGraph()->getCalleeOfCallSite(csId);
+        return inSameCallGraphSCC(caller, callee);
+    }
+    /// Update call graph.
+    //@{
+    virtual void updateCallGraphAndSVFG(const CxtLocDPItem& dpm,const CallICFGNode* cs,SVFGEdgeSet& svfgEdges) override
+    {
+        CallEdgeMap newEdges;
+        resolveIndCalls(cs, getBVPointsTo(getCachedPointsTo(dpm)), newEdges);
+        for (CallEdgeMap::const_iterator iter = newEdges.begin(),eiter = newEdges.end(); iter != eiter; iter++)
+        {
+            const CallICFGNode* newcs = iter->first;
+            const FunctionSet & functions = iter->second;
+            for (FunctionSet::const_iterator func_iter = functions.begin(); func_iter != functions.end(); func_iter++)
+            {
+                const FunObjVar*  func = *func_iter;
+                getSVFG()->connectCallerAndCallee(newcs, func, svfgEdges);
+            }
+        }
+    }
+    //@}
+
+    /// Return TRUE if this edge is inside a SVFG SCC, i.e., src node and dst node are in the same SCC on the SVFG.
+    inline bool edgeInCallGraphSCC(const SVFGEdge* edge)
+    {
+        const FunObjVar* srcfun = edge->getSrcNode()->getFun();
+        const FunObjVar* dstfun = edge->getDstNode()->getFun();
+
+        if(srcfun && dstfun)
+            return inSameCallGraphSCC(srcfun,dstfun);
+
+        assert(edge->isRetVFGEdge() == false && "should not be an inter-procedural return edge" );
+
+        return false;
+    }
+
+    /// processGep node
+    virtual CxtPtSet processGepPts(const GepSVFGNode* gep, const CxtPtSet& srcPts) override;
+
+    /// Handle Address SVFGNode to add proper conditional points-to
+    virtual void handleAddr(CxtPtSet& pts,const CxtLocDPItem& dpm,const AddrSVFGNode* addr) override
+    {
+        NodeID srcID = addr->getPAGSrcNodeID();
+        /// whether this object is set field-insensitive during pre-analysis
+        if (isFieldInsensitive(srcID))
+            srcID = getFIObjVar(srcID);
+
+        CxtVar var(dpm.getCond(),srcID);
+        addDDAPts(pts,var);
+        DBOUT(DDDA, SVFUtil::outs() << "\t add points-to target " << var << " to dpm ");
+        DBOUT(DDDA, dpm.dump());
+    }
+
+    /// Propagate along indirect value-flow if two objects of load and store are same
+    virtual inline bool propagateViaObj(const CxtVar& storeObj, const CxtVar& loadObj) override
+    {
+        return isSameVar(storeObj,loadObj);
+    }
+
+    /// Whether two call string contexts are compatible which may represent the same memory object
+    /// compare with call strings from last few callsite ids (most recent ids to objects):
+    /// compatible : (e.g., 123 == 123, 123 == 23). not compatible (e.g., 123 != 423)
+    virtual inline bool isCondCompatible(const ContextCond& cxt1, const ContextCond& cxt2, bool singleton) const override;
+
+    /// Whether this edge is treated context-insensitively
+    bool isInsensitiveCallRet(const SVFGEdge* edge)
+    {
+        return insensitveEdges.find(edge) != insensitveEdges.end();
+    }
+    /// Return insensitive edge set
+    inline ConstSVFGEdgeSet& getInsensitiveEdgeSet()
+    {
+        return insensitveEdges;
+    }
+    /// dump context call strings
+    virtual inline void dumpContexts(const ContextCond& cxts)
+    {
+        SVFUtil::outs() << cxts.toString() << "\n";
+    }
+
+    virtual const std::string PTAName() const override
+    {
+        return "Context Sensitive DDA";
+    }
+
+private:
+    ConstSVFGEdgeSet insensitveEdges;///< insensitive call-return edges
+    FlowDDA* flowDDA;			///< downgrade to flowDDA if out-of-budget
+    DDAClient* _client;			///< DDA client
+};
+
+} // End namespace SVF
+
+#endif /* ContextDDA_H_ */

package/SVF-osx/Release-build/include/SVF/DDA/DDAClient.h

@@ -0,0 +1,163 @@
+//===- DDAClient.h -- Clients of demand-driven analysis-------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+
+/*
+ * @file: DDAClient.h
+ * @author: yesen
+ * @date: 4 Feb 2015
+ *
+ * LICENSE
+ *
+ */
+
+
+#ifndef DDACLIENT_H_
+#define DDACLIENT_H_
+
+#include "SVFIR/SVFIR.h"
+#include "MemoryModel/PointerAnalysisImpl.h"
+#include "Graphs/SVFG.h"
+#include "SVFIR/SVFValue.h"
+
+namespace SVF
+{
+
+/**
+ * General DDAClient which queries all top level pointers by default.
+ */
+class DDAClient
+{
+public:
+    DDAClient() : pag(nullptr), curPtr(0), solveAll(true) {}
+
+    virtual ~DDAClient() {}
+
+    virtual inline void initialise() {}
+
+    /// Collect candidate pointers for query.
+    virtual inline OrderedNodeSet& collectCandidateQueries(SVFIR* p)
+    {
+        setPAG(p);
+        if (solveAll)
+            candidateQueries = pag->getAllValidPtrs();
+        else
+        {
+            for (OrderedNodeSet::iterator it = userInput.begin(), eit = userInput.end(); it != eit; ++it)
+                addCandidate(*it);
+        }
+        return candidateQueries;
+    }
+    /// Get candidate queries
+    inline const OrderedNodeSet& getCandidateQueries() const
+    {
+        return candidateQueries;
+    }
+
+    /// Call back used by DDAVFSolver.
+    virtual inline void handleStatement(const SVFGNode*, NodeID) {}
+    /// Set SVFIR graph.
+    inline void setPAG(SVFIR* g)
+    {
+        pag = g;
+    }
+    /// Set the pointer being queried.
+    void setCurrentQueryPtr(NodeID ptr)
+    {
+        curPtr = ptr;
+    }
+    /// Set pointer to be queried by DDA analysis.
+    void setQuery(NodeID ptr)
+    {
+        userInput.insert(ptr);
+        solveAll = false;
+    }
+
+    virtual void answerQueries(PointerAnalysis* pta);
+
+    virtual inline void performStat(PointerAnalysis*) {}
+
+    virtual inline void collectWPANum() {}
+protected:
+    void addCandidate(NodeID id)
+    {
+        if (pag->isValidTopLevelPtr(pag->getGNode(id)))
+            candidateQueries.insert(id);
+    }
+
+    SVFIR*   pag;					///< SVFIR graph used by current DDA analysis
+    NodeID curPtr;				///< current pointer being queried
+    OrderedNodeSet candidateQueries;	///< store all candidate pointers to be queried
+
+private:
+    OrderedNodeSet userInput;           ///< User input queries
+    bool solveAll;				///< TRUE if all top level pointers are being queried
+};
+
+
+/**
+ * DDA client with function pointers as query candidates.
+ */
+class FunptrDDAClient : public DDAClient
+{
+private:
+    typedef OrderedMap<NodeID,const CallICFGNode*> VTablePtrToCallSiteMap;
+    VTablePtrToCallSiteMap vtableToCallSiteMap;
+public:
+    FunptrDDAClient() : DDAClient() {}
+    ~FunptrDDAClient() {}
+
+    /// Only collect function pointers as query candidates.
+    virtual OrderedNodeSet& collectCandidateQueries(SVFIR* p);
+    virtual void performStat(PointerAnalysis* pta);
+};
+
+
+
+/**
+ * DDA client with function pointers as query candidates.
+ */
+class AliasDDAClient : public DDAClient
+{
+
+public:
+    typedef OrderedSet<const PAGNode*> PAGNodeSet;
+
+    AliasDDAClient() : DDAClient() {}
+    ~AliasDDAClient() {}
+
+    /// Only collect function pointers as query candidates.
+    virtual OrderedNodeSet& collectCandidateQueries(SVFIR* pag);
+
+    virtual void performStat(PointerAnalysis* pta);
+
+private:
+    typedef OrderedMap<NodeID,const CallICFGNode*> VTablePtrToCallSiteMap;
+    VTablePtrToCallSiteMap vtableToCallSiteMap;
+    PAGNodeSet loadSrcNodes;
+    PAGNodeSet storeDstNodes;
+    PAGNodeSet gepSrcNodes;
+};
+
+} // End namespace SVF
+
+#endif /* DDACLIENT_H_ */

package/SVF-osx/Release-build/include/SVF/DDA/DDAPass.h

@@ -0,0 +1,102 @@
+//===- DDAPass.h -- Demand-driven analysis driver pass-------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * @file: DDAPass.h
+ * @author: Yulei Sui
+ * @date: 01/07/2014
+ * @version: 1.0
+ *
+ */
+
+
+#ifndef DDAPASS_H_
+#define DDAPASS_H_
+
+#include "DDA/DDAClient.h"
+#include "Graphs/SCC.h"
+#include "MemoryModel/PointerAnalysisImpl.h"
+
+namespace SVF
+{
+
+/*!
+ * Demand-Driven Pointer Analysis.
+ * This class performs various pointer analysis on the given module.
+ */
+class DDAPass
+{
+
+public:
+    /// Pass ID
+    static char ID;
+    typedef SCCDetection<SVFG*> SVFGSCC;
+    typedef OrderedSet<const SVFGEdge*> SVFGEdgeSet;
+    typedef std::vector<PointerAnalysis*> PTAVector;
+
+    DDAPass() : _pta(nullptr), _client(nullptr) {}
+    ~DDAPass();
+
+    /// Interface expose to users of our pointer analysis, given Value infos
+    virtual AliasResult alias(const SVFVar* V1,	const SVFVar* V2)
+    {
+        return alias(V1->getId(), V2->getId());
+    }
+
+    /// Interface expose to users of our pointer analysis, given PAGNodes
+    virtual AliasResult alias(NodeID V1, NodeID V2);
+
+    /// We start from here
+    virtual void runOnModule(SVFIR* module);
+
+    /// Select a client
+    virtual void selectClient();
+
+    /// Pass name
+    virtual inline std::string getPassName() const
+    {
+        return "DDAPass";
+    }
+
+private:
+    /// Print queries' pts
+    void printQueryPTS();
+    /// Create pointer analysis according to specified kind and analyze the module.
+    void runPointerAnalysis(SVFIR* module, u32_t kind);
+    /// Context insensitive Edge for DDA
+    void initCxtInsensitiveEdges(PointerAnalysis* pta, const SVFG* svfg,const SVFGSCC* svfgSCC, SVFGEdgeSet& insensitveEdges);
+    /// Return TRUE if this edge is inside a SVFG SCC, i.e., src node and dst node are in the same SCC on the SVFG.
+    bool edgeInSVFGSCC(const SVFGSCC* svfgSCC,const SVFGEdge* edge);
+    /// Return TRUE if this edge is inside a SVFG SCC, i.e., src node and dst node are in the same SCC on the SVFG.
+    bool edgeInCallGraphSCC(PointerAnalysis* pta,const SVFGEdge* edge);
+
+    void collectCxtInsenEdgeForRecur(PointerAnalysis* pta, const SVFG* svfg,SVFGEdgeSet& insensitveEdges);
+    void collectCxtInsenEdgeForVFCycle(PointerAnalysis* pta, const SVFG* svfg,const SVFGSCC* svfgSCC, SVFGEdgeSet& insensitveEdges);
+
+    std::unique_ptr<PointerAnalysis> _pta;	///<  pointer analysis to be executed.
+    DDAClient* _client;		///<  DDA client used
+
+};
+
+} // End namespace SVF
+
+#endif /* WPA_H_ */

package/SVF-osx/Release-build/include/SVF/DDA/DDAStat.h

@@ -0,0 +1,121 @@
+//===- DDAStat.h -- Statistics for demand-driven pass-------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * DDAStat.h
+ *
+ *  Created on: Sep 15, 2014
+ *      Author: Yulei Sui
+ */
+
+#ifndef DDASTAT_H_
+#define DDASTAT_H_
+
+#include "Util/PTAStat.h"
+#include "MemoryModel/PointsTo.h"
+
+namespace SVF
+{
+
+class FlowDDA;
+class ContextDDA;
+class SVFG;
+class PointerAnalysis;
+
+/*!
+ * Statistics of demand-driven analysis
+ */
+class DDAStat : public PTAStat
+{
+
+public:
+    DDAStat(FlowDDA* pta);
+    DDAStat(ContextDDA* pta);
+
+    u32_t _NumOfDPM;
+    u32_t _NumOfStrongUpdates;
+    u32_t _NumOfMustAliases;
+    u32_t _NumOfInfeasiblePath;
+
+    u64_t _NumOfStep;
+    u64_t _NumOfStepInCycle;
+    double _AnaTimePerQuery;
+    double _AnaTimeCyclePerQuery;
+    double _TotalTimeOfQueries;
+    double _TotalTimeOfBKCondition;
+
+    NodeBS _StrongUpdateStores;
+
+    void performStatPerQuery(NodeID ptr) override;
+
+    void performStat() override;
+
+    void printStat(std::string str = "") override;
+
+    void printStatPerQuery(NodeID ptr, const PointsTo& pts) override;
+
+    void getNumOfOOBQuery();
+
+private:
+    FlowDDA* flowDDA;
+    ContextDDA* contextDDA;
+
+    u32_t _TotalNumOfQuery;
+    u32_t _TotalNumOfOutOfBudgetQuery;
+    u32_t _TotalNumOfDPM;
+    u32_t _TotalNumOfStrongUpdates;
+    u32_t _TotalNumOfMustAliases;
+    u32_t _TotalNumOfInfeasiblePath;
+
+    u32_t _TotalNumOfStep;
+    u32_t _TotalNumOfStepInCycle;
+
+    u32_t _NumOfIndCallEdgeSolved;
+    u32_t _MaxCPtsSize;
+    u32_t _MaxPtsSize;
+    u32_t _TotalCPtsSize;
+    u32_t _TotalPtsSize;
+    u32_t _NumOfNullPtr;
+    u32_t _NumOfConstantPtr;
+    u32_t _NumOfBlackholePtr;
+
+    double _AvgNumOfDPMAtSVFGNode;
+    u32_t _MaxNumOfDPMAtSVFGNode;
+
+    NUMStatMap NumPerQueryStatMap;
+
+    void initDefault();
+
+public:
+    SVFG* getSVFG() const;
+
+    PointerAnalysis* getPTA() const;
+
+    inline NodeBS& getStrongUpdateStores()
+    {
+        return _StrongUpdateStores;
+    }
+};
+
+} // End namespace SVF
+
+#endif /* DDASTAT_H_ */