svf-lib 1.0.2680 → 1.0.2682

package/SVF-linux-aarch64/include/MTA/MTA.h

@@ -29,10 +29,6 @@
  * The base data race detector is based on
  * Yulei Sui, Peng Di, and Jingling Xue. "Sparse Flow-Sensitive Pointer Analysis for Multithreaded Programs".
  * 2016 International Symposium on Code Generation and Optimization (CGO'16)
- *
- * This file also declares SlicedMTA, the multi-stage on-demand program slicing
- * pipeline (MSli) introduced in "Multi-Stage On-Demand Program Slicing for
- * Modular Analysis of Multi-Threaded Programs" (ISSTA 2026).
  */
 
 #ifndef MTA_H_
@@ -41,7 +37,6 @@
 #include <set>
 #include <string>
 #include <vector>
-#include <functional>
 #include <memory>
 #include <utility>
 #include "SVFIR/SVFIR.h"
@@ -51,6 +46,7 @@
 #include "MemoryModel/PointsTo.h"
 #include "MTA/MHP.h"
 #include "MTA/LockAnalysis.h"
+#include "MTA/MTASVFGBuilder.h"
 #include "WPA/Andersen.h"
 #include "Graphs/CallGraph.h"
 
@@ -70,7 +66,6 @@ class SVFStmt;
 class SVFIR;
 class ICFGNode;
 // Forward declarations for the SlicedMTA slicing pipeline (see SlicedMTA impl).
-class MTASVFGBuilder;
 class SVFG;
 class FlowSensitive;
 class SlicedSVFGView;
@@ -102,9 +97,6 @@ public:
     /// Run the shared detector and print a race report
     virtual void reportRaces();
 
-    // Not implemented for now
-    // void dump(Module &module, MHP *mhp, LockAnalysis *lsa);
-
     MHP* getMHP()
     {
         return mhp;
@@ -120,22 +112,33 @@ public:
     {
         const SVFStmt* stmt1;
         const SVFStmt* stmt2;
-        RacePair(const SVFStmt* s1, const SVFStmt* s2) : stmt1(s1), stmt2(s2) {}
+        RacePair(const SVFStmt* s1, const SVFStmt* s2)
+            : stmt1(statementLess(s2, s1) ? s2 : s1),
+              stmt2(statementLess(s2, s1) ? s1 : s2)
+        {
+        }
+
+        static bool statementLess(const SVFStmt* lhs, const SVFStmt* rhs)
+        {
+            return lhs->getEdgeID() < rhs->getEdgeID();
+        }
+
         bool operator<(const RacePair& other) const
         {
-            if (stmt1 != other.stmt1) return stmt1 < other.stmt1;
-            return stmt2 < other.stmt2;
+            if (stmt1->getEdgeID() != other.stmt1->getEdgeID())
+                return stmt1->getEdgeID() < other.stmt1->getEdgeID();
+            return stmt2->getEdgeID() < other.stmt2->getEdgeID();
         }
     };
 
     /// Shared equivalence-class race detector (used by both MTA::reportRaces and
     /// the SlicedMTA pipeline). Returns the racy statements and fills outRacePairs.
     static std::set<const SVFStmt*> detectRace(
-        SVFIR* svfIr, AndersenBase* pta, MHP* mhp, LockAnalysis* lockAnalysis,
+        SVFIR* svfir, AndersenBase* pta, MHP* mhp, LockAnalysis* lockAnalysis,
         CallGraph* callGraph, std::set<RacePair>& outRacePairs);
 
     /// Escape/points-to helpers for the shared detector.
-    static PointsTo getGlobalObjectVariables(SVFIR* svfIr);
+    static PointsTo getGlobalObjectVariables(SVFIR* svfir);
     static PointsTo getPointsToClosure(AndersenBase* pta, const PointsTo& pts);
 
     /// Whether the program has any thread (fork-target) function reachable via a
@@ -150,12 +153,47 @@ private:
         const ICFGNode* node;
         bool isStore;
         NodeID tid;
-        NodeBS interleav;
+        const NodeBS* interleaving;
+        bool locked;
+    };
+
+    struct RaceClass
+    {
+        bool isStore;
+        bool locked;
+        size_t representative;
+        std::vector<size_t> members;
+    };
+
+    struct RaceClassKey
+    {
+        NodeID tid;
+        bool isStore;
+        const NodeBS* interleaving;
         bool locked;
+        NodeID lockNodeId;
+
+        bool operator<(const RaceClassKey& other) const;
     };
 
+    using ObjectToRaceOccurrences = Map<NodeID, std::vector<size_t>>;
+
     /// Helpers for the equivalence-class race detector.
     //@{
+    static void collectRaceOccurrences(
+        SVFIR* svfir, AndersenBase* pta, MHP* mhp,
+        LockAnalysis* lockAnalysis, CallGraph* callGraph,
+        const PointsTo& escapedObjects,
+        std::vector<RaceOccurrence>& occurrences,
+        ObjectToRaceOccurrences& objectToOccurrences);
+    static std::vector<RaceClass> buildRaceClasses(
+        const std::vector<RaceOccurrence>& occurrences,
+        const std::vector<size_t>& occurrenceIndices);
+    static void emitRacePairs(
+        MHP* mhp, LockAnalysis* lockAnalysis,
+        const std::vector<RaceOccurrence>& occurrences,
+        const std::vector<RaceClass>& classes,
+        std::set<RacePair>& outRacePairs);
     static bool occurrencesRace(MHP* mhp, const RaceOccurrence& first, const RaceOccurrence& second);
     static void commitRacePair(std::set<RacePair>& out,
                                const RaceOccurrence& first, const RaceOccurrence& second);
@@ -178,21 +216,16 @@ private:
  *   4. PTA slicing + main flow-sensitive FSAM (FSMPTA) on the slice
  *   5. final race detection on the sliced graph using FSAM points-to
  *
- * It operates entirely on the SVFIR (LLVM-free). The single LLVM-dependent step --
- * materialising resolved indirect calls into the PAG -- is injected by the caller
- * as a callback (see runOnModule).
+ * It operates entirely on the SVFIR (LLVM-free). The LLVM-aware caller runs the
+ * Andersen pre-analysis and materialises its resolved indirect calls into the
+ * PAG before invoking runOnModule.
  *
- * Behaviour is controlled by Options (MTFlowSensitive, EnableSlicing,
- * SlicingSingle, SlicedDumpDot).
+ * Behaviour is controlled by Options (MTFlowSensitive, MTAEnableSlicing,
+ * MTASingleStageSlicing, DumpMTAGraphs).
  */
 class SlicedMTA
 {
 public:
-    /// The one LLVM-dependent step of the pipeline: resolve the indirect-call
-    /// edges discovered by Andersen into PAG copy/call edges. The caller (the
-    /// LLVM-aware tool) supplies it via SVFIRBuilder::updateCallGraph.
-    using ResolveIndirectCalls = std::function<void(CallGraph*)>;
-
     /// The shared race detector lives in MTA; reuse its race-pair type.
     using RacePair = MTA::RacePair;
 
@@ -204,20 +237,37 @@ public:
     SlicedMTA(const SlicedMTA&) = delete;
     SlicedMTA& operator=(const SlicedMTA&) = delete;
 
-    /// Run the slicing pipeline on a pre-built SVFIR.
-    void runOnModule(SVFIR* pag, const ResolveIndirectCalls& resolveIndirectCalls);
+    /// Run the slicing pipeline with its prepared Andersen pre-analysis.
+    bool runOnModule(SVFIR* pag, AndersenWaveDiff& preAnalysis);
 
 private:
     // --- pipeline stages ---
-    bool runPreAnalysis(const ResolveIndirectCalls& resolveIndirectCalls);
+    bool runPreAnalysis();
     bool runMTASlicingAndAnalysis();
     bool runPTASlicingAndAnalysis();
     bool runFinalRaceDetection();
-    void buildVFGPre();
+    void buildPreAnalysisSVFG();
+
+    /// Pipeline utilities shared by the sliced and whole-program paths.
+    //@{
+    static void reportOriginalStatistics(SVFIR* svfir);
+    static std::set<const ICFGNode*> collectICFGNodes(
+        SVFG* svfg, const NodeBS& svfgNodeIds);
+    static void reportPTASliceStatistics(
+        const std::set<const ICFGNode*>& icfgNodes);
+    struct RaceDigests
+    {
+        u64_t alarm;
+        u64_t pair;
+    };
+    static std::string raceStatementKey(const SVFStmt* statement);
+    static void updateDigest(u64_t& digest, const std::string& value);
+    static RaceDigests computeRaceDigests(const std::set<RacePair>& pairs);
+    //@}
 
     /// No-slice A/B baseline: run the FSAM detection on the whole program (no
     /// slicing), so its time and race set can be compared against the sliced run.
-    void runWholeProgramDetection();
+    bool runWholeProgramDetection();
 
     /// Main pointer-analysis instance feeding final race detection (the
     /// flow-sensitive FSAM, a BVDataPTAImpl queried polymorphically).
@@ -227,47 +277,45 @@ private:
     std::set<const SVFStmt*> getVulnerableStmts() const;
 
     // --- race detection ---
-    /// Re-check the candidate race pairs on the sliced graph using FSAM points-to.
+    /// Refine the pre-analysis candidate pairs with main-phase ILA and FSAM.
     std::set<RacePair> detectRacePairsOnSlicedGraph(
-        BVDataPTAImpl* slicedPTA, MHP* slicedMHP, LockAnalysis* slicedLockAnalysis);
-
-    // Lock analysis over the WHOLE ICFG (real control flow, no bridging) for the
-    // final detection's lock signature. The sliced lock analysis walks bridged
-    // edges, which fabricate lock-carrying paths the whole program lacks (a
-    // query-preservation break); lock-span is control-flow-sensitive, so it must
-    // see real edges. Built lazily, cheap (no FSAM/MHP) next to the slicing win.
-    LockAnalysis* buildFullLockAnalysis();
+        const std::set<RacePair>& preAnalysisRacePairs,
+        BVDataPTAImpl* slicedPTA, MHP* slicedMHP,
+        LockAnalysis* slicedLockAnalysis);
 
     // --- pipeline state (owned unless noted) ---
-    SVFIR* svfIr = nullptr;
+    SVFIR* svfir = nullptr;
     // Main-phase context depth, set by runOnModule; the pre-analysis uses it
     // to reconcile context-truncation-merged thread instances.
-    u32_t mainCxtDepth = 2;
+    u32_t mainContextDepth;
     std::unique_ptr<TCT> tct;
     std::unique_ptr<MHP> mhp;
     std::unique_ptr<LockAnalysis> lockAnalysis;
     // Inclusion-based Andersen's pre-analysis (a shared singleton, not owned
-    // here -- released once in the destructor). Feeds the TCT / MHP / lock /
+    // here; the tool releases it after this object is destroyed). Feeds TCT/MHP/lock/
     // race pre-analysis, the thread-aware VFG_pre, and the main FSMPTA.
-    AndersenWaveDiff* preAnder = nullptr;
-    std::unique_ptr<MTASVFGBuilder> vfgPreBuilder; // owns vfgPre
-    SVFG* vfgPre = nullptr;
+    AndersenWaveDiff* preAndersen = nullptr;
+    ThreadCallGraph* threadCallGraph = nullptr;
+    std::unique_ptr<MTASVFGBuilder> preSVFGBuilder; // owns preSVFG
+    SVFG* preSVFG = nullptr;
     std::unique_ptr<MultiStageSlicer> multiStageSlicer;
+    NodeBS preCandidateSolveNodeIds;
     std::unique_ptr<SingleSlicer> singleSlicer;
+    /// VFG'_pre endpoint-filtered, context-insensitive pre-MHP candidates.
+    /// This is only a conservative worklist for rebuilding Main-TVF; the main
+    /// phase independently re-decides every edge with main MHP and lock facts.
+    MTASVFGBuilder::ThreadVFCandidateList selectedThreadVFCandidates;
     // -mta-slicing-single: the one unified slice, computed in MTA slicing and reused
     // (not recomputed) for PTA slicing so both stages share V_Single.
     std::set<const ICFGNode*> singleSlicedNodes;
+    NodeBS singleSlicedSVFGNodeIds;
     std::unique_ptr<SlicedSVFIRView> mtaSlicedView;
     std::unique_ptr<SlicedSVFIRView> ptaSlicedView;
     std::unique_ptr<SlicedSVFGView> slicedSVFGView;
-    std::unique_ptr<FlowSensitive> mtaFSMPTA;
+    std::unique_ptr<FlowSensitive> mainFSMPTA;
     std::unique_ptr<SlicedTCT> slicedTCT;
-    std::unique_ptr<MHP> slicedMhp;
+    std::unique_ptr<MHP> slicedMHP;
     std::unique_ptr<LockAnalysis> slicedLockAnalysis;
-    // Whole-ICFG lock analysis for the final detection (see buildFullLockAnalysis).
-    std::unique_ptr<SlicedSVFIRView> fullLockView;
-    std::unique_ptr<SlicedTCT> fullLockTCT;
-    std::unique_ptr<LockAnalysis> fullLockAnalysis;
     bool hasThreadFunctions = false;
     std::set<RacePair> racePairs;
 };

package/SVF-linux-aarch64/include/MTA/MTASVFGBuilder.h

@@ -24,15 +24,6 @@
  * MTASVFGBuilder.h
  *
  *      Author: Jiawei Yang
- *
- * Builds a *thread-aware* Sparse Value-Flow Graph (SVFG) for the FSAM
- * flow-sensitive multithreaded pointer analysis (Sui, Di, Xue, CGO'16).
- *
- * On top of the stock thread-oblivious SVFG, it adds inter-thread (interference)
- * indirect value-flow edges between store/load and store/store statements that
- *   (1) may-happen-in-parallel (MHP), and
- *   (2) may-alias on the address-taken object, and
- *   (3) are not excluded by a common lock (non-interference lock-pair pruning).
  */
 
 #ifndef INCLUDE_MTA_MTASVFGBUILDER_H_
@@ -44,14 +35,13 @@
 #include "MTA/MHP.h"
 #include "MTA/LockAnalysis.h"
 #include "MemoryModel/PointsTo.h"
-#include <map>
-#include <set>
 #include <utility>
+#include <vector>
 
 namespace SVF
 {
 
-class SlicedICFGView;
+class SlicedSVFGView;
 
 class MTASVFGBuilder : public SVFGBuilder
 {
@@ -59,25 +49,21 @@ public:
     typedef Set<const StmtSVFGNode*> SVFGNodeSet;
     typedef NodeBS SVFGNodeIDSet;
 
-    /// Constructor: driven by the interleaving (MHP) and lock analyses.
-    MTASVFGBuilder(MHP* m, LockAnalysis* la) : SVFGBuilder(), mhp(m), lockana(la) {}
-    ~MTASVFGBuilder() override = default;
+    enum class InterferenceEdgeMode
+    {
+        Analysis,   ///< Build labelled edges for FSMPTA.
+        SlicingOnly ///< Build unlabelled connectivity for VFG_pre slicing.
+    };
 
-    /// Number of thread-aware (interference) SVFG edges added.
-    static u32_t numOfNewSVFGEdges;
-
-    /// Configure the builder for the main (post-slicing) FSAM solve rather than
-    /// the pre-analysis VFG_pre:
-    ///  - slice != null restricts the interference-edge construction to kept
-    ///    store/load nodes (a sliced-out endpoint's edge is inert in the gated
-    ///    solve, so it need not be built);
-    ///  - the [THREAD-VF] query map is skipped, as only VFG_pre slicing reads it.
-    /// The pre-analysis build leaves this unset (whole program, query map built).
-    void configureForMainSolve(const SlicedICFGView* slice)
+    /// Constructor: driven by the interleaving (MHP) and lock analyses.
+    MTASVFGBuilder(MHP* mhp, LockAnalysis* lockAnalysis,
+                   InterferenceEdgeMode edgeMode = InterferenceEdgeMode::Analysis)
+        : SVFGBuilder(),
+          labelInterferenceEdges(edgeMode == InterferenceEdgeMode::Analysis),
+          mhp(mhp), lockAnalysis(lockAnalysis)
     {
-        icfgSlice = slice;
-        recordThreadVF = false;
     }
+    ~MTASVFGBuilder() override = default;
 
     /// A candidate thread-aware value-flow edge s --o--> s' (src store, dst
     /// load/store), keyed by its endpoint SVFG nodes.
@@ -98,11 +84,81 @@ public:
     ///
     /// The value stores only the additional lock-span witnesses; the endpoint
     /// ICFG nodes are implicit in the key and consumers must add them back.
-    const std::map<ThreadVFEdge, std::set<const ICFGNode*>>& getThreadVFQueryMap() const
+    using ThreadVFQueryMap = Map<ThreadVFEdge, Set<const ICFGNode*>>;
+    const ThreadVFQueryMap& getThreadVFQueryMap() const
     {
         return threadVFQueryMap;
     }
 
+    struct ThreadVFCandidate
+    {
+        ThreadVFCandidate(NodeID sourceNodeId, NodeID destinationNodeId)
+            : sourceNodeId(sourceNodeId), destinationNodeId(destinationNodeId)
+        {
+        }
+
+        bool operator<(const ThreadVFCandidate& other) const
+        {
+            return sourceNodeId < other.sourceNodeId ||
+                   (sourceNodeId == other.sourceNodeId &&
+                    destinationNodeId < other.destinationNodeId);
+        }
+
+        bool operator==(const ThreadVFCandidate& other) const
+        {
+            return sourceNodeId == other.sourceNodeId &&
+                   destinationNodeId == other.destinationNodeId;
+        }
+
+        NodeID sourceNodeId;
+        NodeID destinationNodeId;
+    };
+    using ThreadVFCandidateList = std::vector<ThreadVFCandidate>;
+
+    class ThreadVFBuildConfig
+    {
+    public:
+        static ThreadVFBuildConfig mainPhase(
+            const SlicedSVFGView& scope,
+            const ThreadVFCandidateList* candidates = nullptr)
+        {
+            return ThreadVFBuildConfig(&scope, candidates);
+        }
+
+        static ThreadVFBuildConfig wholeProgram()
+        {
+            return ThreadVFBuildConfig(nullptr, nullptr);
+        }
+
+    private:
+        friend class MTASVFGBuilder;
+        ThreadVFBuildConfig(const SlicedSVFGView* scope,
+                            const ThreadVFCandidateList* candidates)
+            : scope(scope), candidates(candidates)
+        {
+        }
+
+        const SlicedSVFGView* scope = nullptr; ///< null means the whole base SVFG
+        /// Optional conservative candidate universe selected from VFG_pre.
+        /// Main MHP/lock facts still decide every emitted edge; this only avoids
+        /// re-querying alias pairs that context-insensitive pre MHP rejected or
+        /// whose endpoints do not survive VFG'_pre.
+        const ThreadVFCandidateList* candidates = nullptr;
+    };
+
+    /// Replace only the ILA-dependent thread-aware overlay. The underlying
+    /// MemorySSA, stock SVFG, and fork/join value flow remain unchanged.
+    void replaceThreadAwareOverlay(MHP* mhp, LockAnalysis* lockAnalysis,
+                                   const ThreadVFBuildConfig& config);
+
+    /// Remove all currently attached thread-aware interference edges.
+    void clearThreadAwareOverlay();
+
+    size_t getThreadAwareEdgeCount() const
+    {
+        return threadAwareEdges.size();
+    }
+
 protected:
     /// Rewrite the SVFG build hook: build the stock SVFG, then add MHP edges.
     void buildSVFG() override;
@@ -112,13 +168,16 @@ protected:
     std::unique_ptr<MRGenerator> createMRGenerator(BVDataPTAImpl* pta, bool ptrOnlyMSSA) override;
 
 private:
-    /// Main-solve configuration (see configureForMainSolve); defaults suit VFG_pre.
-    const SlicedICFGView* icfgSlice = nullptr; ///< null = whole program
-    bool recordThreadVF = true;                ///< false = skip [THREAD-VF] recording
+    /// Active overlay configuration; defaults suit VFG_pre.
+    const SlicedSVFGView* overlayScope = nullptr; ///< null = whole base SVFG
+    const ThreadVFCandidateList* overlayCandidates = nullptr;
+    bool recordThreadVFQueries = true;         ///< false = skip [THREAD-VF] recording
+    bool labelInterferenceEdges = true;        ///< false = VFG_pre (sliced-only): omit edge points-to labels
 
     /// Collect the store/load SVFG nodes to pair for interference edges (all of
     /// them, or -- when a slice is set -- only the kept ones).
     void collectLoadStoreSVFGNodes();
+    bool isInOverlayScope(const SVFGNode* node) const;
 
     /// FSAM join-related thread-oblivious value flow (the "return" half of
     /// treating a join as a call without a forward): connect each start
@@ -131,44 +190,50 @@ private:
     /// join, mirroring SVFG::addInterIndirectVFRetEdge using the public SVFG API
     /// (points-to intersection + dedup via hasInterVFGEdge + addSVFGEdge).
     void addJoinRetEdge(const FormalOUTSVFGNode* formalOut,
-                        const ActualOUTSVFGNode* actualOut, CallSiteID csId);
+                        const ActualOUTSVFGNode* actualOut,
+                        CallSiteID callSiteId);
 
     /// Connect inter-thread (interference) value-flow edges for MHP pairs.
     void connectMHPEdges(PointerAnalysis* pta);
 
-    void handleStoreLoad(const StmtSVFGNode* n1, const StmtSVFGNode* n2, PointerAnalysis* pta);
-    void handleStoreStore(const StmtSVFGNode* n1, const StmtSVFGNode* n2, PointerAnalysis* pta);
+    void handleStoreLoad(const StmtSVFGNode* store,
+                         const StmtSVFGNode* load, PointerAnalysis* pta);
+    void handleStoreStore(const StmtSVFGNode* firstStore,
+                          const StmtSVFGNode* secondStore,
+                          PointerAnalysis* pta);
 
     /// Record the [THREAD-VF] slicing sources for one candidate pair s --o--> s'
-    /// (s = src store, sp = dst load/store). Adds the endpoints, and — when the
+    /// (source = store, destination = load/store). Adds the endpoints, and — when the
     /// pair is protected by a common lock — the in-span successor/predecessor
     /// witnesses needed to re-decide the non-interference (tail/head) test.
-    void recordThreadVFSource(const StmtSVFGNode* s, const StmtSVFGNode* sp, bool commonLock);
+    void recordThreadVFSource(const StmtSVFGNode* source,
+                              const StmtSVFGNode* destination,
+                              bool commonLock);
 
     /// Add a thread-MHP indirect value-flow edge srcId -> dstId carrying pts.
     SVFGEdge* addTDEdge(NodeID srcId, NodeID dstId, const PointsTo& pts);
 
     /// Lock-span head/tail tests (non-interference lock-pair pruning).
     //@{
-    SVFGNodeIDSet getPrevNodes(const StmtSVFGNode* n);
-    SVFGNodeIDSet getSuccNodes(const StmtSVFGNode* n);
-    bool isHeadOfSpan(const StmtSVFGNode* n);
-    bool isTailOfSpan(const StmtSVFGNode* n);
+    SVFGNodeIDSet getPredecessorNodes(const StmtSVFGNode* node);
+    SVFGNodeIDSet getSuccessorNodes(const StmtSVFGNode* node);
+    bool isHeadOfSpan(const StmtSVFGNode* node);
+    bool isTailOfSpan(const StmtSVFGNode* node);
     //@}
 
-    SVFGNodeSet stnodeSet;  ///< all store SVFG nodes
-    SVFGNodeSet ldnodeSet;  ///< all load SVFG nodes
+    SVFGNodeSet storeNodes;
+    SVFGNodeSet loadNodes;
 
     /// [THREAD-VF] per-edge query map (see getThreadVFQueryMap).
-    std::map<ThreadVFEdge, std::set<const ICFGNode*>> threadVFQueryMap;
-
+    ThreadVFQueryMap threadVFQueryMap;
     MHP* mhp;
-    LockAnalysis* lockana;
+    LockAnalysis* lockAnalysis;
 
-    Map<const StmtSVFGNode*, SVFGNodeIDSet> prevset;
-    Map<const StmtSVFGNode*, SVFGNodeIDSet> succset;
-    Map<const StmtSVFGNode*, bool> headmap;
-    Map<const StmtSVFGNode*, bool> tailmap;
+    Map<const StmtSVFGNode*, SVFGNodeIDSet> predecessorCache;
+    Map<const StmtSVFGNode*, SVFGNodeIDSet> successorCache;
+    Map<const StmtSVFGNode*, bool> spanHeadCache;
+    Map<const StmtSVFGNode*, bool> spanTailCache;
+    SVFGEdgeSet threadAwareEdges;
 };
 
 } // End namespace SVF