svf-lib 1.0.2676 → 1.0.2678

package/SVF-linux-x86_64/include/Graphs/ThreadCallGraph.h

@@ -142,7 +142,18 @@ class ThreadCallGraph: public CallGraph
 {
 
 public:
-    typedef Set<const CallICFGNode*> InstSet;
+    /// Order fork/join callsites by ICFG node id, never by pointer value:
+    /// thread ids are assigned in discovery order over these sets (TCT), and
+    /// the MHP/lock fixed points seed from them, so their iteration order must
+    /// be identical across runs (a pointer-hashed set varies with ASLR).
+    struct CallSiteIdCmp
+    {
+        bool operator()(const CallICFGNode* lhs, const CallICFGNode* rhs) const
+        {
+            return lhs->getId() < rhs->getId();
+        }
+    };
+    typedef OrderedSet<const CallICFGNode*, CallSiteIdCmp> InstSet;
     typedef InstSet CallSiteSet;
     typedef Set<CallSiteSet*> CtxSet;
     typedef ThreadForkEdge::ForkEdgeSet ForkEdgeSet;
@@ -158,9 +169,7 @@ public:
     ThreadCallGraph(ThreadCallGraph& cg) = delete;
 
     /// Destructor
-    virtual ~ThreadCallGraph()
-    {
-    }
+    virtual ~ThreadCallGraph();
 
     /// ClassOf
     //@{

package/SVF-linux-x86_64/include/MSSA/MemRegion.h

@@ -337,6 +337,14 @@ protected:
     /// Get Mod-Ref of a callee function
     virtual bool handleCallsiteModRef(NodeBS& mod, NodeBS& ref, const CallICFGNode* cs, const FunObjVar* fun);
 
+    /// Extension hooks for specialised MRGenerators: no-op in the base. They
+    /// run during the mod/ref fixpoint, before MemorySSA creates callsite
+    /// MU/CHI nodes; subclasses use them when a call boundary needs non-standard
+    /// mod/ref effects to expose the right ActualIN/ActualOUT nodes.
+    virtual void refineCallsiteModRef(NodeBS& /*mod*/, NodeBS& /*ref*/,
+                                      const CallICFGNode* /*cs*/, const FunObjVar* /*callee*/) {}
+    virtual void propagateAdditionalModRef(CallGraphNode* /*callGraphNode*/, WorkList& /*worklist*/) {}
+
 
     /// Add cpts to store/load
     //@{
@@ -385,6 +393,15 @@ protected:
     bool addRefSideEffectOfCallSite(const CallICFGNode* cs, const NodeBS& refs);
     /// Add indirect def an memory object in the function
     bool addModSideEffectOfCallSite(const CallICFGNode* cs, const NodeBS& mods);
+    /// Add indirect def to a callsite without applying call-argument filtering.
+    bool addUnfilteredModSideEffectOfCallSite(const CallICFGNode* cs, const NodeBS& mods);
+
+    /// The call graph this generator works on (for subclasses, e.g. the
+    /// thread-aware MTA MRGenerator that inspects fork/join edges).
+    CallGraph* getCallGraph() const
+    {
+        return callGraph;
+    }
 
     /// Get indirect refs of a function
     inline const NodeBS& getRefSideEffectOfFunction(const FunObjVar* fun)

package/SVF-linux-x86_64/include/MSSA/MemSSA.h

@@ -119,7 +119,7 @@ public:
 
 protected:
     BVDataPTAImpl* pta;
-    MRGenerator* mrGen;
+    std::unique_ptr<MRGenerator> mrGen;
     MemSSAStat* stat;
 
     /// Create mu chi for candidate regions in a function
@@ -294,8 +294,10 @@ private:
     //@}
 
 public:
-    /// Constructor
-    MemSSA(BVDataPTAImpl* p, bool ptrOnlyMSSA);
+    /// Constructor. The builder (SVFGBuilder::createMRGenerator) supplies the
+    /// MRGenerator and decides the partition strategy / thread-awareness; MemSSA
+    /// takes ownership of it via unique_ptr. mrGenerator must not be null.
+    MemSSA(BVDataPTAImpl* p, std::unique_ptr<MRGenerator> mrGenerator);
 
     /// Destructor
     virtual ~MemSSA()
@@ -309,10 +311,10 @@ public:
     {
         return pta;
     }
-    /// Return MRGenerator
+    /// Return MRGenerator (non-owning; MemSSA retains ownership)
     inline MRGenerator* getMRGenerator()
     {
-        return mrGen;
+        return mrGen.get();
     }
     /// We start from here
     virtual void buildMemSSA(const FunObjVar& fun);

package/SVF-linux-x86_64/include/MSSA/SVFGBuilder.h

@@ -83,6 +83,12 @@ public:
     virtual std::unique_ptr<MemSSA> buildMSSA(BVDataPTAImpl* pta, bool ptrOnlyMSSA);
 
 protected:
+    /// Hook supplying the MRGenerator for the MemSSA built above. The default
+    /// builds the stock generator selected by Options::MemPar(); MTASVFGBuilder
+    /// overrides this to inject a thread-aware (ThreadMRG) generator. Ownership
+    /// transfers to the MemSSA constructed in buildMSSA.
+    virtual std::unique_ptr<MRGenerator> createMRGenerator(BVDataPTAImpl* pta, bool ptrOnlyMSSA);
+
     /// Create a DDA SVFG. By default actualOut and FormalIN are removed, unless withAOFI is set true.
     SVFG* build(BVDataPTAImpl* pta, VFG::VFGK kind);
     /// Can be rewritten by subclasses

package/SVF-linux-x86_64/include/MTA/FSMPTA.h

@@ -0,0 +1,91 @@
+//===- FSMPTA.h -- Flow-sensitive multithreaded pointer analysis (FSAM) -===//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * FSMPTA.h
+ *
+ *      Author: Jiawei Yang
+ *
+ * Sparse flow-sensitive pointer analysis for multithreaded programs (FSAM,
+ * Sui/Di/Xue CGO'16). It runs the sparse flow-sensitive solver
+ * (`FlowSensitive`) over a *thread-aware* SVFG built by `MTASVFGBuilder`,
+ * i.e. the stock thread-oblivious value flow augmented with inter-thread
+ * (interference) edges derived from the MHP and lock analyses.
+ */
+
+#ifndef INCLUDE_MTA_FSMPTA_H_
+#define INCLUDE_MTA_FSMPTA_H_
+
+#include "WPA/FlowSensitive.h"
+#include "MTA/MHP.h"
+#include "MTA/LockAnalysis.h"
+#include "MTA/MTASVFGBuilder.h"
+#include "MTA/MTASlicer.h"
+#include <unordered_set>
+
+namespace SVF
+{
+
+/// One solver for the whole and the sliced SVFG: SVFGGraph is SVFG* (whole;
+/// every node processed) or const SlicedSVFGView* (sliced; nodes outside the
+/// view are propagation barriers). Restriction is answered by
+/// GenericGraphTraits<SVFGGraph>::containsNode, resolved at compile time; the
+/// stock FlowSensitive transfer semantics are untouched.
+template<class SVFGGraph>
+class FSMPTA : public FlowSensitive
+{
+public:
+    /// Constructor.
+    ///  - graph: gates the per-node transfer (the solver runs over the whole
+    ///    thread-aware SVFG). For SVFGGraph == SVFG* it may be null (every node
+    ///    is processed). A SlicedSVFGView needs only its ICFG view for membership,
+    ///    so it can be created before the SVFG itself is built here.
+    FSMPTA(MHP* m, LockAnalysis* la, SVFGGraph graph)
+        : FlowSensitive(m->getTCT()->getPTA()->getPAG()),
+          mhp(m), mtaSVFGBuilder(m, la), graph(graph)
+    {
+    }
+
+    ~FSMPTA() override = default;
+
+    /// Initialise: build the thread-aware SVFG, then solve sparsely on it.
+    void initialize() override;
+
+    /// Restrict the solve to the graph's nodes (whole: no restriction).
+    void processNode(NodeID nodeId) override;
+
+    inline MHP* getMHP() const
+    {
+        return mhp;
+    }
+
+private:
+    MHP* mhp;
+    /// Owns the thread-aware SVFG used by the FS solver (must outlive `svfg`).
+    MTASVFGBuilder mtaSVFGBuilder;
+    /// The graph the solve is restricted to (see the constructor).
+    SVFGGraph graph;
+};
+
+} // End namespace SVF
+
+#endif /* INCLUDE_MTA_FSMPTA_H_ */

package/SVF-linux-x86_64/include/MTA/LockAnalysis.h

@@ -25,6 +25,11 @@
  *
  *  Created on: 26 Aug 2015
  *      Author: pengd
+ *
+ * Lock analysis. One implementation runs on the whole program or a slice:
+ * analyze() is templated on the graph handle (SVFIR* or const SlicedSVFIRView*),
+ * as used by "Multi-Stage On-Demand Program Slicing for Modular Analysis of
+ * Multi-Threaded Programs" (ISSTA 2026).
  */
 
 #ifndef INCLUDE_MTA_LockAnalysis_H_
@@ -35,9 +40,15 @@
  */
 #include "MTA/TCT.h"
 
+#include <memory>
+#include <vector>
+
 namespace SVF
 {
 
+// Forward declaration for the sliced-graph handle analyze() can run on.
+class SlicedSVFIRView;
+
 /*!
  * Lock analysis
  */
@@ -81,18 +92,23 @@ public:
     {
     }
 
+    ~LockAnalysis() = default;
+
     /// context-sensitive forward traversal from each lock site. Generate following results
     /// (1) context-sensitive lock site,
     /// (2) maps a context-sensitive lock site to its corresponding lock span.
-    void analyze();
-    void analyzeIntraProcedualLock();
-    bool intraForwardTraverse(const ICFGNode* lock, InstSet& unlockset, InstSet& forwardInsts);
-    bool intraBackwardTraverse(const InstSet& unlockset, InstSet& backwardInsts);
-
-    void collectCxtLock();
-    void analyzeLockSpanCxtStmt();
-
-    void collectLockUnlocksites();
+    /// One implementation for the whole program and a slice: GraphT is SVFIR*
+    /// (whole) or const SlicedSVFIRView* (sliced). Per-graph queries resolve at
+    /// compile time via the graph* overloads in Graphs/SlicedGraphs.h.
+    template<class ICFGGraph, class CGGraph> void analyze(ICFGGraph icfg, CGGraph cg);
+    template<class ICFGGraph, class CGGraph> void analyzeIntraProcedualLock(ICFGGraph icfg, CGGraph cg);
+    template<class ICFGGraph, class CGGraph> bool intraForwardTraverse(ICFGGraph icfg, CGGraph cg, const ICFGNode* lock, InstSet& unlockset, InstSet& forwardInsts);
+    template<class ICFGGraph, class CGGraph> bool intraBackwardTraverse(ICFGGraph icfg, CGGraph cg, const InstSet& unlockset, InstSet& backwardInsts);
+
+    template<class ICFGGraph, class CGGraph> void collectCxtLock(ICFGGraph icfg, CGGraph cg);
+    template<class ICFGGraph, class CGGraph> void analyzeLockSpanCxtStmt(ICFGGraph icfg, CGGraph cg);
+
+    template<class ICFGGraph, class CGGraph> void collectLockUnlocksites(ICFGGraph icfg, CGGraph cg);
     void buildCandidateFuncSetforLock();
 
     /// Intraprocedural locks
@@ -135,6 +151,14 @@ public:
         return instTocondCILocksMap.find(stmt)!=instTocondCILocksMap.end();
     }
 
+    /// Whether a statement has an (unconditional) intra-procedural lock set, i.e.
+    /// getIntraLockSet is valid for it. A statement can be locked (isInsideIntraLock)
+    /// via a *conditional* intra lock or a *context* lock without being here.
+    inline bool hasIntraLockSet(const ICFGNode* stmt) const
+    {
+        return instCILocksMap.find(stmt)!=instCILocksMap.end();
+    }
+
     inline const InstSet& getIntraLockSet(const ICFGNode* stmt) const
     {
         InstToInstSetMap::const_iterator it = instCILocksMap.find(stmt);
@@ -264,8 +288,6 @@ public:
     }
     //@}
 
-
-
     /// Check if one instruction's context stmt is in a lock span
     inline bool hasOneCxtInLockSpan(const ICFGNode *I, LockSpan lspan) const
     {
@@ -297,7 +319,6 @@ public:
         return true;
     }
 
-
     /// Check if two Instructions are protected by common locks
     /// echo inst may have multiple cxt stmt
     /// we check whether every cxt stmt of instructions is protected by a common lock.
@@ -323,32 +344,28 @@ public:
     {
         return tct;
     }
-private:
+protected:
     /// Handle fork
-    void handleFork(const CxtStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleFork(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
     /// Handle call
-    void handleCall(const CxtStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleCall(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
     /// Handle return
-    void handleRet(const CxtStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleRet(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
     /// Handle intra
-    void handleIntra(const CxtStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleIntra(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
     /// Handle call relations
-    void handleCallRelation(CxtLockProc& clp, const CallGraphEdge* cgEdge, const CallICFGNode* call);
+    template<class ICFGGraph, class CGGraph> void handleCallRelation(ICFGGraph icfg, CGGraph cg, CxtLockProc& clp, const CallGraphEdge* cgEdge, const CallICFGNode* call);
 
     /// Return true it a lock matches an unlock
     bool isAliasedLocks(const CxtLock& cl1, const CxtLock& cl2)
     {
         return isAliasedLocks(cl1.getStmt(), cl2.getStmt());
     }
-    bool isAliasedLocks(const ICFGNode* i1, const ICFGNode* i2)
-    {
-        /// todo: must alias
-        return tct->getPTA()->alias(getLockVal(i1)->getId(), getLockVal(i2)->getId());
-    }
+    bool isAliasedLocks(const ICFGNode* i1, const ICFGNode* i2);
 
     /// Mark thread flags for cxtStmt
     //@{
@@ -488,7 +505,6 @@ private:
     /// Map a statement to all its context-sensitive statements
     InstToCxtStmtSet instToCxtStmtSet;
 
-
     /// Context-sensitive locks
     CxtLockSet cxtLockset;
 
@@ -523,7 +539,6 @@ private:
     InstToInstSetMap instTocondCILocksMap;
     //@}
 
-
 public:
     double lockTime;
     u32_t numOfTotalQueries;

package/SVF-linux-x86_64/include/MTA/MHP.h

@@ -25,6 +25,11 @@
  *
  *  Created on: Jan 21, 2014
  *      Author: Yulei Sui, Peng Di
+ *
+ * May-happen-in-parallel analysis. One implementation runs on the whole program
+ * or a slice: analyze() is templated on the ICFG and CallGraph it traverses
+ * (whole graphs or their sliced views), as used by "Multi-Stage On-Demand Program Slicing for
+ * Modular Analysis of Multi-Threaded Programs" (ISSTA 2026).
  */
 
 #ifndef MHP_H_
@@ -33,11 +38,16 @@
 #include "MTA/TCT.h"
 #include "Util/SVFUtil.h"
 
+#include <memory>
+#include <vector>
+
 namespace SVF
 {
 
 class ForkJoinAnalysis;
 class LockAnalysis;
+// Forward declaration for the sliced-graph handle analyze() can run on.
+class SlicedSVFIRView;
 
 /*!
  * This class serves as a base may-happen in parallel analysis for multithreaded program
@@ -65,11 +75,15 @@ public:
     /// Destructor
     virtual ~MHP();
 
-    /// Start analysis here
-    void analyze();
+    /// Start analysis here. One implementation for the whole program and a
+    /// slice: the compute is templated on the two graphs it traverses -- the ICFG
+    /// (ICFG* whole / const SlicedICFGView* sliced) and the CallGraph (CallGraph*
+    /// whole / const SlicedThreadCallGraphView* sliced) -- and calls their
+    /// GenericGraphTraits specialisations directly (no wrapper layer).
+    template<class ICFGGraph, class CGGraph> void analyze(ICFGGraph icfg, CGGraph cg);
 
     /// Analyze thread interleaving
-    void analyzeInterleaving();
+    template<class ICFGGraph, class CGGraph> void analyzeInterleaving(ICFGGraph icfg, CGGraph cg);
 
     /// Get ThreadCallGraph
     inline ThreadCallGraph* getThreadCallGraph() const
@@ -122,7 +136,7 @@ public:
     /// Print interleaving results
     void printInterleaving();
 
-private:
+protected:
 
     inline const CallGraph::FunctionSet& getCallee(const CallICFGNode* inst, CallGraph::FunctionSet& callees)
     {
@@ -131,25 +145,34 @@ private:
     }
     /// Update non-candidate functions' interleaving.
     /// Copy interleaving threads of the entry inst to other insts.
-    void updateNonCandidateFunInterleaving();
+    template<class ICFGGraph, class CGGraph> void updateNonCandidateFunInterleaving(ICFGGraph icfg, CGGraph cg);
 
     /// Handle non-candidate function
-    void handleNonCandidateFun(const CxtThreadStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleNonCandidateFun(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts);
 
     /// Handle fork
-    void handleFork(const CxtThreadStmt& cts, NodeID rootTid);
+    template<class ICFGGraph, class CGGraph> void handleFork(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts, NodeID rootTid);
 
     /// Handle join
-    void handleJoin(const CxtThreadStmt& cts, NodeID rootTid);
+    template<class ICFGGraph, class CGGraph> void handleJoin(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts, NodeID rootTid);
 
     /// Handle call
-    void handleCall(const CxtThreadStmt& cts, NodeID rootTid);
+    template<class ICFGGraph, class CGGraph> void handleCall(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts, NodeID rootTid);
 
     /// Handle return
-    void handleRet(const CxtThreadStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleRet(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts);
 
     /// Handle intra
-    void handleIntra(const CxtThreadStmt& cts);
+    template<class ICFGGraph, class CGGraph> void handleIntra(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts);
+
+    /// Symmetric-join loop-exit kills, applied to EDGE flows (node states stay
+    /// pure unions, so paths bypassing the join keep their interleavings).
+    //@{
+    typedef Map<const SVFBasicBlock*, std::vector<CxtStmt>> BBToSymJoinsMap;
+    typedef Map<CxtStmt, Set<const SVFBasicBlock*>> SymJoinToLoopMap;
+    void buildSymJoinKillTables();
+    NodeBS edgeFlow(const CxtThreadStmt& cts, const ICFGNode* dst);
+    //@}
 
     /// Add/Remove interleaving thread for statement inst
     //@{
@@ -170,6 +193,15 @@ private:
             pushToCTSWorkList(tgr);
         }
     }
+    inline void addInterleavingBits(const CxtThreadStmt& tgr, const NodeBS& bits)
+    {
+        bool changed = threadStmtToThreadInterLeav[tgr] |= bits;
+        if(changed)
+        {
+            instToTSMap[tgr.getStmt()].insert(tgr);
+            pushToCTSWorkList(tgr);
+        }
+    }
     inline void rmInterleavingThread(const CxtThreadStmt& tgr, const NodeBS& tids, const ICFGNode* joinsite)
     {
         NodeBS joinedTids;
@@ -187,8 +219,8 @@ private:
 
     /// Update Ancestor and sibling threads
     //@{
-    void updateAncestorThreads(NodeID tid);
-    void updateSiblingThreads(NodeID tid);
+    template<class ICFGGraph, class CGGraph> void updateAncestorThreads(ICFGGraph icfg, CGGraph cg, NodeID tid);
+    template<class ICFGGraph, class CGGraph> void updateSiblingThreads(ICFGGraph icfg, CGGraph cg, NodeID tid);
     //@}
 
     /// Thread curTid can be fully joined by parentTid recursively
@@ -267,10 +299,11 @@ private:
     ForkJoinAnalysis* fja;				///< ForJoin Analysis
     CxtThreadStmtWorkList cxtStmtList;	///< CxtThreadStmt worklist
     ThreadStmtToThreadInterleav threadStmtToThreadInterLeav; /// Map a statement to its thread interleavings
+    BBToSymJoinsMap bbToSymJoins;   ///< loop block -> symmetric in-loop joins of that loop
+    SymJoinToLoopMap symJoinLoop;   ///< symmetric in-loop join -> its loop's blocks
     InstToThreadStmtSetMap instToTSMap; ///< Map an instruction to its ThreadStmtSet
     FuncPairToBool nonCandidateFuncMHPRelMap;
 
-
 public:
     u32_t numOfTotalQueries;		///< Total number of queries
     u32_t numOfMHPQueries;			///< Number of queries are answered as may-happen-in-parallel
@@ -278,8 +311,6 @@ public:
     double interleavingQueriesTime;
 };
 
-
-
 /*!
  *
  */
@@ -306,7 +337,6 @@ public:
     typedef Set<CxtStmt> CxtStmtSet;
     typedef Map<const ICFGNode*, CxtStmtSet> InstToCxtStmt;
 
-
     ForkJoinAnalysis(TCT* t) : tct(t)
     {
         collectSCEVInfo();
@@ -363,6 +393,11 @@ public:
     {
         return tct->hasJoinLoop(inst);
     }
+    /// All SCEV-symmetric in-loop joins and their loop blocks.
+    inline const CxtStmtToLoopMap& getSymmetricLoopJoins() const
+    {
+        return cxtJoinInLoop;
+    }
 private:
 
     /// Handle fork
@@ -387,10 +422,8 @@ private:
     bool sameLoopTripCount(const ICFGNode* forkSite, const ICFGNode* joinSite);
 
     /// Whether it is a matched fork join pair
-    bool isAliasedForkJoin(const CallICFGNode* forkSite, const CallICFGNode* joinSite)
-    {
-        return tct->getPTA()->alias(getForkedThread(forkSite)->getId(), getJoinedThread(joinSite)->getId());
-    }
+    bool isAliasedForkJoin(const CallICFGNode* forkSite, const CallICFGNode* joinSite);
+    ThreadAPI::ForkJoinAliasCache forkJoinAliasCache;
     /// Mark thread flags for cxtStmt
     //@{
     /// Get the flag for a cxtStmt