svf-lib 1.0.2319 → 1.0.2321

package/SVF-osx/Release-build/include/SVF/WPA/VersionedFlowSensitive.h

@@ -0,0 +1,295 @@
+//===- VersionedFlowSensitive.h -- Versioned flow-sensitive pointer analysis --------//
+
+/*
+ * VersionedFlowSensitiveAnalysis.h
+ *
+ *  Created on: Jun 26, 2020
+ *      Author: Mohamad Barbar
+ *
+ * The implementation is based on
+ * Mohamad Barbar, Yulei Sui and Shiping Chen. "Object Versioning for Flow-Sensitive Pointer Analysis".
+ * International Symposium on Code Generation and Optimization (CGO'21)
+ */
+
+#ifndef VFS_H_
+#define VFS_H_
+
+#include "Graphs/SVFGOPT.h"
+#include "MSSA/SVFGBuilder.h"
+#include "WPA/FlowSensitive.h"
+#include "WPA/WPAFSSolver.h"
+#include "MemoryModel/PointsTo.h"
+
+namespace SVF
+{
+
+class AndersenWaveDiff;
+
+/*!
+ * Versioned flow sensitive whole program pointer analysis
+ */
+class VersionedFlowSensitive : public FlowSensitive
+{
+    friend class VersionedFlowSensitiveStat;
+
+private:
+    typedef CoreBitVector MeldVersion;
+
+public:
+    typedef Map<NodeID, Version> ObjToVersionMap;
+    typedef Map<VersionedVar, const DummyVersionPropSVFGNode *> VarToPropNodeMap;
+
+    typedef std::vector<ObjToVersionMap> LocVersionMap;
+    /// (o -> (v -> versions with rely on o:v).
+    typedef Map<NodeID, Map<Version, std::vector<Version>>> VersionRelianceMap;
+
+    /// If this version appears, there has been an error.
+    static const Version invalidVersion;
+
+    /// Return key into vPtD for address-taken var of a specific version.
+    static VersionedVar atKey(NodeID, Version);
+
+    /// Constructor
+    VersionedFlowSensitive(SVFIR *_pag, PTATY type = VFS_WPA);
+
+    /// Initialize analysis
+    virtual void initialize() override;
+
+    /// Finalize analysis
+    virtual void finalize() override;
+
+    /// Get PTA name
+    virtual const std::string PTAName() const override
+    {
+        return "VersionedFlowSensitive";
+    }
+
+    /// Methods to support type inquiry through isa, cast, and dyn_cast
+    //@{
+    static inline bool classof(const VersionedFlowSensitive *)
+    {
+        return true;
+    }
+    static inline bool classof(const PointerAnalysis *pta)
+    {
+        return pta->getAnalysisTy() == VFS_WPA;
+    }
+    //@}
+
+    /// Create single instance of versioned flow-sensitive points-to analysis.
+    static VersionedFlowSensitive *createVFSWPA(SVFIR *_pag)
+    {
+        if (vfspta == nullptr)
+        {
+            vfspta = new VersionedFlowSensitive(_pag);
+            vfspta->analyze();
+        }
+
+        return vfspta;
+    }
+
+    /// Release flow-sensitive pointer analysis
+    static void releaseVFSWPA()
+    {
+        if (vfspta) delete vfspta;
+        vfspta = nullptr;
+    }
+
+protected:
+    virtual bool processLoad(const LoadSVFGNode* load) override;
+    virtual bool processStore(const StoreSVFGNode* store) override;
+    virtual void processNode(NodeID n) override;
+    virtual void updateConnectedNodes(const SVFGEdgeSetTy& newEdges) override;
+
+    /// Override to do nothing. Instead, we will use propagateVersion when necessary.
+    virtual bool propAlongIndirectEdge(const IndirectSVFGEdge*) override
+    {
+        return false;
+    }
+
+    /// Override since we want to assign different weights based on versioning.
+    virtual void cluster(void) override;
+
+public:
+    /// Returns true if l is a store node.
+    virtual bool isStore(const NodeID l) const;
+
+    /// Returns true if l is a load node.
+    virtual bool isLoad(const NodeID l) const;
+
+    /// Shared code for getConsume and getYield. They wrap this function.
+    Version getVersion(const NodeID l, const NodeID o, const LocVersionMap &lvm) const;
+
+    /// Returns the consumed version of o at l. If no such version exists, returns invalidVersion.
+    Version getConsume(const NodeID l, const NodeID o) const;
+
+    /// Returns the yielded version of o at l. If no such version exists, returns invalidVersion.
+    Version getYield(const NodeID l, const NodeID o) const;
+
+    /// Returns the versions of o which rely on o:v.
+    std::vector<Version> &getReliantVersions(const NodeID o, const Version v);
+
+    /// Returns the statements which rely on o:v.
+    NodeBS &getStmtReliance(const NodeID o, const Version v);
+
+    /// Dumps versionReliance and stmtReliance.
+    void dumpReliances(void) const;
+
+    /// Dumps maps consume and yield.
+    void dumpLocVersionMaps(void) const;
+
+    void solveAndwritePtsToFile(const std::string& filename) override;
+
+    void writeVersionedAnalysisResultToFile(const std::string& filename);
+
+    void readVersionedAnalysisResultFromFile(std::ifstream& F);
+
+    void readPtsFromFile(const std::string& filename) override;
+
+    /// Dumps a MeldVersion to stdout.
+    static void dumpMeldVersion(MeldVersion &v);
+
+private:
+    /// Prelabel the SVFG: set y(o) for stores and c(o) for delta nodes to a new version.
+    void prelabel(void);
+    /// Meld label the prelabeled SVFG.
+    void meldLabel(void);
+    /// Melds v2 into v1 (in place), returns whether a change occurred.
+    static bool meld(MeldVersion &mv1, const MeldVersion &mv2);
+
+    /// Removes all indirect edges in the SVFG.
+    void removeAllIndirectSVFGEdges(void);
+
+    /// Propagates version v of o to any version of o which relies on v when o/v is changed.
+    /// Recursively applies to reliant versions till no new changes are made.
+    /// Adds any statements which rely on any changes made to the worklist.
+    void propagateVersion(NodeID o, Version v);
+
+    /// Propagates version v of o to version vp of o. time indicates whether it should record time
+    /// taken itself.
+    void propagateVersion(const NodeID o, const Version v, const Version vp, bool time=true);
+
+    /// Fills in isStoreMap and isLoadMap.
+    virtual void buildIsStoreLoadMaps(void);
+
+    /// Fills in deltaMap and deltaSourceMap for the SVFG.
+    virtual void buildDeltaMaps(void);
+
+    /// Returns true if l is a delta node, i.e., may get a new incoming indirect
+    /// edge due to on-the-fly callgraph construction.
+    virtual bool delta(const NodeID l) const;
+
+    /// Returns true if l is a delta-source node, i.e., may get a new outgoing indirect
+    /// edge to a delta node due to on-the-fly callgraph construction.
+    virtual bool deltaSource(const NodeID l) const;
+
+    /// Shared code for setConsume and setYield. They wrap this function.
+    void setVersion(const NodeID l, const NodeID o, const Version v, LocVersionMap &lvm);
+
+    /// Sets the consumed version of o at l to v.
+    void setConsume(const NodeID l, const NodeID o, const Version v);
+
+    /// Sets the yielded version of o at l to v.
+    void setYield(const NodeID l, const NodeID o, const Version v);
+
+    /// Maps locations to objects to a version. The object version is what is
+    /// consumed at that location.
+    LocVersionMap consume;
+    /// Actual yield map. Yield analogue to consume.
+    LocVersionMap yield;
+
+    /// o -> (version -> versions which rely on it).
+    VersionRelianceMap versionReliance;
+    /// o x version -> statement nodes which rely on that o/version.
+    Map<NodeID, Map<Version, NodeBS>> stmtReliance;
+
+    /// Maps an <object, version> pair to the SVFG node indicating that pair
+    /// needs to be propagated.
+    VarToPropNodeMap versionedVarToPropNode;
+
+    // Maps an object o to o' if o is equivalent to o' with respect to
+    // versioning. Thus, we don't need to store the versions of o and look
+    // up those for o' instead.
+    Map<NodeID, NodeID> equivalentObject;
+
+    /// Worklist for performing meld labeling, takes SVFG node l.
+    /// Nodes are added when the version they yield is changed.
+    FIFOWorkList<NodeID> vWorklist;
+
+    Set<NodeID> prelabeledObjects;
+
+    /// Points-to DS for working with versions.
+    BVDataPTAImpl::VersionedPTDataTy *vPtD;
+
+    /// deltaMap[l] means SVFG node l is a delta node, i.e., may get new
+    /// incoming edges due to OTF callgraph construction.
+    std::vector<bool> deltaMap;
+
+    /// deltaSourceMap[l] means SVFG node l *may* be a source to a delta node
+    /// through an dge added as a result of on-the-fly callgraph
+    /// construction.
+    std::vector<bool> deltaSourceMap;
+
+    /// isStoreMap[l] means SVFG node l is a store node.
+    std::vector<bool> isStoreMap;
+
+    /// isLoadMap[l] means SVFG node l is a load node.
+    std::vector<bool> isLoadMap;
+
+    /// Additional statistics.
+    //@{
+    u32_t numPrelabeledNodes;  ///< Number of prelabeled nodes.
+    u32_t numPrelabelVersions; ///< Number of versions created during prelabeling.
+
+    double prelabelingTime;  ///< Time to prelabel SVFG.
+    double meldLabelingTime; ///< Time to meld label SVFG.
+    double versionPropTime;  ///< Time to propagate versions to versions which rely on them.
+    //@}
+
+    static VersionedFlowSensitive *vfspta;
+
+    class SCC
+    {
+    private:
+        typedef struct NodeData
+        {
+            int index;
+            int lowlink;
+            bool onStack;
+        } NodeData;
+
+    public:
+        /// Determines the strongly connected components of svfg following only
+        /// edges labelled with object. partOf[n] = scc means nodes n is part of
+        /// SCC scc. startingNodes contains the nodes to begin the search from.
+        /// After completion, footprint will contain all edges which object
+        /// appears on (as reached through the algorithm described above) sorted.
+        ///
+        /// This is not a general SCC detection but specifically for versioning,
+        /// so edges to delta nodes are skipped as they are prelabelled. Edges
+        /// to stores are also skipped to as they yield a new version (they
+        /// cannot be part of an SCC containing more than themselves).
+        /// Skipped edges still form part of the footprint.
+        static unsigned detectSCCs(VersionedFlowSensitive *vfs,
+                                   const SVFG *svfg, const NodeID object,
+                                   const std::vector<const SVFGNode *> &startingNodes,
+                                   std::vector<int> &partOf,
+                                   std::vector<const IndirectSVFGEdge *> &footprint);
+
+    private:
+        /// Called by detectSCCs then called recursively.
+        static void visit(VersionedFlowSensitive *vfs,
+                          const NodeID object,
+                          std::vector<int> &partOf,
+                          std::vector<const IndirectSVFGEdge *> &footprint,
+                          std::vector<NodeData> &nodeData,
+                          std::stack<const SVFGNode *> &stack,
+                          int &index,
+                          int &currentSCC,
+                          const SVFGNode *v);
+    };
+};
+
+} // End namespace SVF
+
+#endif /* VFS_H_ */

package/SVF-osx/Release-build/include/SVF/WPA/WPAFSSolver.h

@@ -0,0 +1,246 @@
+//===- WPAFSSolver.h -- WPA flow-sensitive solver-----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * @file: WPAFSSolver.h
+ * @author: yesen
+ * @date: 14/02/2014
+ * @version: 1.0
+ *
+ * @section LICENSE
+ *
+ * @section DESCRIPTION
+ *
+ */
+
+
+#ifndef WPAFSSOLVER_H_
+#define WPAFSSOLVER_H_
+
+#include "WPA/WPASolver.h"
+
+namespace SVF
+{
+
+/*!
+ * Flow-sensitive Solver
+ */
+template<class GraphType>
+class WPAFSSolver : public WPASolver<GraphType>
+{
+public:
+    /// Constructor
+    WPAFSSolver() : WPASolver<GraphType>()
+    {}
+    /// Destructor
+    virtual ~WPAFSSolver() {}
+
+    /// SCC methods
+    virtual inline NodeID sccRepNode(NodeID id) const
+    {
+        return id;
+    }
+
+protected:
+    NodeStack nodeStack;	///< stack used for processing nodes.
+
+    /// SCC detection
+    virtual NodeStack& SCCDetect()
+    {
+        /// SCC detection
+        this->getSCCDetector()->find();
+
+        assert(nodeStack.empty() && "node stack is not empty, some nodes are not popped properly.");
+
+        /// Both rep and sub nodes need to be processed later.
+        /// Collect sub nodes from SCCDetector.
+        FIFOWorkList<NodeID> revTopoStack = this->getSCCDetector()->revTopoNodeStack();
+        while (!revTopoStack.empty())
+        {
+            NodeID nodeId = revTopoStack.front();
+            revTopoStack.pop();
+            const NodeBS& subNodes = this->getSCCDetector()->subNodes(nodeId);
+            for (NodeBS::iterator it = subNodes.begin(), eit = subNodes.end(); it != eit; ++it)
+            {
+                /// restore the topological order.
+                nodeStack.push(*it);
+            }
+        }
+
+        return nodeStack;
+    }
+};
+
+
+
+/*!
+ * Solver based on SCC cycles.
+ */
+template<class GraphType>
+class WPASCCSolver : public WPAFSSolver<GraphType>
+{
+public:
+    typedef typename WPASolver<GraphType>::GTraits GTraits;
+    typedef typename WPASolver<GraphType>::GNODE GNODE;
+    typedef typename WPASolver<GraphType>::child_iterator child_iterator;
+
+    WPASCCSolver() : WPAFSSolver<GraphType>() {}
+
+    virtual ~WPASCCSolver() {}
+
+protected:
+    virtual void solve()
+    {
+        /// All nodes will be solved afterwards, so the worklist
+        /// can be cleared before each solve iteration.
+        while (!this->isWorklistEmpty())
+            this->popFromWorklist();
+
+        NodeStack& nodeStack = this->SCCDetect();
+
+        while (!nodeStack.empty())
+        {
+            NodeID rep = nodeStack.top();
+            nodeStack.pop();
+
+            setCurrentSCC(rep);
+
+            const NodeBS& sccNodes = this->getSCCDetector()->subNodes(rep);
+            for (NodeBS::iterator it = sccNodes.begin(), eit = sccNodes.end(); it != eit; ++it)
+                this->pushIntoWorklist(*it);
+
+            while (!this->isWorklistEmpty())
+                this->processNode(this->popFromWorklist());
+        }
+    }
+
+    /// Propagation for the solving, to be implemented in the child class
+    virtual void propagate(GNODE* v)
+    {
+        child_iterator EI = GTraits::direct_child_begin(v);
+        child_iterator EE = GTraits::direct_child_end(v);
+        for (; EI != EE; ++EI)
+        {
+            if (this->propFromSrcToDst(*(EI.getCurrent())))
+                addNodeIntoWorkList(this->Node_Index(*EI));
+        }
+    }
+
+    virtual inline void addNodeIntoWorkList(NodeID node)
+    {
+        if (isInCurrentSCC(node))
+            this->pushIntoWorklist(node);
+    }
+
+    inline bool isInCurrentSCC(NodeID node)
+    {
+        return (const_cast<NodeBS&>(this->getSCCDetector()->subNodes(curSCCID))).test(node);
+    }
+    inline void setCurrentSCC(NodeID id)
+    {
+        curSCCID = this->getSCCDetector()->repNode(id);
+    }
+
+    NodeID curSCCID;	///< index of current SCC.
+};
+
+
+
+/*!
+ * Only solve nodes which need to be analyzed.
+ */
+template<class GraphType>
+class WPAMinimumSolver : public WPASCCSolver<GraphType>
+{
+public:
+    typedef typename WPASolver<GraphType>::GTraits GTraits;
+    typedef typename WPASolver<GraphType>::GNODE GNODE;
+    typedef typename WPASolver<GraphType>::child_iterator child_iterator;
+
+    WPAMinimumSolver() : WPASCCSolver<GraphType>() {}
+
+    virtual ~WPAMinimumSolver() {}
+
+protected:
+    virtual void solve()
+    {
+        bool solveAll = true;
+        /// If the worklist is not empty, then only solve these nodes contained in
+        /// worklist. Otherwise all nodes in the graph will be processed.
+        if (!this->isWorklistEmpty())
+        {
+            solveAll = false;
+            while (!this->isWorklistEmpty())
+                addNewCandidate(this->popFromWorklist());
+        }
+
+        NodeStack& nodeStack = this->SCCDetect();
+
+        while (!nodeStack.empty())
+        {
+            NodeID rep = nodeStack.top();
+            nodeStack.pop();
+
+            this->setCurrentSCC(rep);
+
+            NodeBS sccNodes = this->getSCCDetector()->subNodes(rep);
+            if (solveAll == false)
+                sccNodes &= getCandidates();	/// get nodes which need to be processed in this SCC cycle
+
+            for (NodeBS::iterator it = sccNodes.begin(), eit = sccNodes.end(); it != eit; ++it)
+                this->pushIntoWorklist(*it);
+
+            while (!this->isWorklistEmpty())
+                this->processNode(this->popFromWorklist());
+
+            removeCandidates(sccNodes);		/// remove nodes which have been processed from the candidate set
+        }
+    }
+
+    virtual inline void addNodeIntoWorkList(NodeID node)
+    {
+        if (this->isInCurrentSCC(node))
+            this->pushIntoWorklist(node);
+        else
+            addNewCandidate(node);
+    }
+
+private:
+    inline void addNewCandidate(NodeID node)
+    {
+        candidates.set(node);
+    }
+    inline const NodeBS& getCandidates() const
+    {
+        return candidates;
+    }
+    inline void removeCandidates(const NodeBS& nodes)
+    {
+        candidates.intersectWithComplement(nodes);
+    }
+
+    NodeBS candidates;	///< nodes which need to be analyzed in current iteration.
+};
+
+} // End namespace SVF
+
+#endif /* WPAFSSOLVER_H_ */

package/SVF-osx/Release-build/include/SVF/WPA/WPAPass.h

@@ -0,0 +1,115 @@
+//===- WPAPass.h -- Whole program analysis------------------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+
+/*
+ * @file: WPA.h
+ * @author: yesen
+ * @date: 10/06/2014
+ * @version: 1.0
+ *
+ * @section LICENSE
+ *
+ * @section DESCRIPTION
+ *
+ */
+
+
+#ifndef WPA_H_
+#define WPA_H_
+
+#include "MemoryModel/PointerAnalysisImpl.h"
+
+namespace SVF
+{
+
+class SVFG;
+
+/*!
+ * Whole program pointer analysis.
+ * This class performs various pointer analysis on the given module.
+ */
+// excised ", public llvm::AliasAnalysis" as that has a very light interface
+// and I want to see what breaks.
+class WPAPass
+{
+    typedef std::vector<PointerAnalysis*> PTAVector;
+
+public:
+    /// Pass ID
+    static char ID;
+
+    enum AliasCheckRule
+    {
+        Conservative,	///< return MayAlias if any pta says alias
+        Veto,			///< return NoAlias if any pta says no alias
+        Precise			///< return alias result by the most precise pta
+    };
+
+    /// Constructor needs TargetLibraryInfo to be passed to the AliasAnalysis
+    WPAPass()
+    {
+
+    }
+
+    /// Destructor
+    virtual ~WPAPass();
+
+    /// Retrieve points-to set information
+    virtual const PointsTo& getPts(NodeID var);
+
+    /// Print all alias pairs
+    virtual void PrintAliasPairs(PointerAnalysis* pta);
+
+    /// Interface of mod-ref analysis to determine whether a CallSite instruction can mod or ref any memory location
+    virtual ModRefInfo getModRefInfo(const CallICFGNode* callInst);
+
+    /// Interface of mod-ref analysis to determine whether a CallSite instruction can mod or ref a specific memory location, given Location infos
+    // virtual inline ModRefInfo getModRefInfo(const CallSite callInst, const MemoryLocation& Loc)
+    // {
+    //     return getModRefInfo(callInst, Loc.Ptr);
+    // }
+
+    /// Interface of mod-ref analysis between two CallSite instructions
+    virtual ModRefInfo getModRefInfo(const CallICFGNode* callInst1, const CallICFGNode* callInst2);
+
+    /// Run pointer analysis on SVFModule
+    virtual void runOnModule(SVFIR* svfModule);
+
+    /// PTA name
+    virtual inline std::string getPassName() const
+    {
+        return "WPAPass";
+    }
+
+private:
+    /// Create pointer analysis according to specified kind and analyze the module.
+    void runPointerAnalysis(SVFIR* pag, u32_t kind);
+
+    PTAVector ptaVector;	///< all pointer analysis to be executed.
+    PointerAnalysis* _pta;	///<  pointer analysis to be executed.
+    SVFG* _svfg;  ///< svfg generated through -ander pointer analysis
+};
+
+} // End namespace SVF
+
+#endif /* WPA_H_ */