svf-lib 1.0.699 → 1.0.703
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SVF-linux/Release-build/lib/libSvf.a +0 -0
- package/SVF-linux/include/SABER/PathCondAllocator.h +286 -0
- package/SVF-linux/include/SABER/ProgSlice.h +1 -1
- package/SVF-linux/include/Util/Options.h +1 -1
- package/SVF-osx/Release-build/lib/CUDD/libCudd.a +0 -0
- package/SVF-osx/Release-build/lib/libSvf.a +0 -0
- package/SVF-osx/include/Util/Options.h +1 -1
- package/package.json +1 -1
|
Binary file
|
|
@@ -0,0 +1,286 @@
|
|
|
1
|
+
//===- PathCondAllocator.h -- Path condition manipulation---------------------//
|
|
2
|
+
//
|
|
3
|
+
// SVF: Static Value-Flow Analysis
|
|
4
|
+
//
|
|
5
|
+
// Copyright (C) <2013-2017> <Yulei Sui>
|
|
6
|
+
//
|
|
7
|
+
|
|
8
|
+
// This program is free software: you can redistribute it and/or modify
|
|
9
|
+
// it under the terms of the GNU General Public License as published by
|
|
10
|
+
// the Free Software Foundation, either version 3 of the License, or
|
|
11
|
+
// (at your option) any later version.
|
|
12
|
+
|
|
13
|
+
// This program is distributed in the hope that it will be useful,
|
|
14
|
+
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
15
|
+
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
16
|
+
// GNU General Public License for more details.
|
|
17
|
+
|
|
18
|
+
// You should have received a copy of the GNU General Public License
|
|
19
|
+
// along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
20
|
+
//
|
|
21
|
+
//===----------------------------------------------------------------------===//
|
|
22
|
+
|
|
23
|
+
/*
|
|
24
|
+
* PathAllocator.h
|
|
25
|
+
*
|
|
26
|
+
* Created on: Apr 3, 2014
|
|
27
|
+
* Author: Yulei Sui
|
|
28
|
+
*/
|
|
29
|
+
|
|
30
|
+
#ifndef PATHALLOCATOR_H_
|
|
31
|
+
#define PATHALLOCATOR_H_
|
|
32
|
+
|
|
33
|
+
#include "Util/SVFModule.h"
|
|
34
|
+
#include "SVF-FE/DataFlowUtil.h"
|
|
35
|
+
#include "Util/Conditions.h"
|
|
36
|
+
#include "Util/WorkList.h"
|
|
37
|
+
#include "Graphs/SVFG.h"
|
|
38
|
+
|
|
39
|
+
|
|
40
|
+
namespace SVF
|
|
41
|
+
{
|
|
42
|
+
|
|
43
|
+
/**
|
|
44
|
+
* PathCondAllocator allocates conditions for each basic block of a certain CFG.
|
|
45
|
+
*/
|
|
46
|
+
class PathCondAllocator
|
|
47
|
+
{
|
|
48
|
+
|
|
49
|
+
public:
|
|
50
|
+
|
|
51
|
+
typedef CondExpr Condition; /// z3 condition
|
|
52
|
+
|
|
53
|
+
typedef Map<u32_t,Condition*> CondPosMap; ///< map a branch to its Condition
|
|
54
|
+
typedef Map<const BasicBlock*, CondPosMap > BBCondMap; // map bb to a Condition
|
|
55
|
+
typedef Set<const BasicBlock*> BasicBlockSet;
|
|
56
|
+
typedef Map<const Function*, BasicBlockSet> FunToExitBBsMap; ///< map a function to all its basic blocks calling program exit
|
|
57
|
+
typedef Map<const BasicBlock*, Condition*> BBToCondMap; ///< map a basic block to its condition during control-flow guard computation
|
|
58
|
+
typedef FIFOWorkList<const BasicBlock*> CFWorkList; ///< worklist for control-flow guard computation
|
|
59
|
+
|
|
60
|
+
|
|
61
|
+
/// Constructor
|
|
62
|
+
PathCondAllocator(): condMgr(CondManager::getCondMgr())
|
|
63
|
+
{
|
|
64
|
+
}
|
|
65
|
+
/// Destructor
|
|
66
|
+
virtual ~PathCondAllocator()
|
|
67
|
+
{
|
|
68
|
+
}
|
|
69
|
+
/// Statistics
|
|
70
|
+
//@{
|
|
71
|
+
inline std::string getMemUsage()
|
|
72
|
+
{
|
|
73
|
+
return condMgr->getMemUsage();
|
|
74
|
+
}
|
|
75
|
+
inline u32_t getCondNum()
|
|
76
|
+
{
|
|
77
|
+
return condMgr->getCondNumber();
|
|
78
|
+
}
|
|
79
|
+
//@}
|
|
80
|
+
|
|
81
|
+
/// Condition operations
|
|
82
|
+
//@{
|
|
83
|
+
inline Condition* condAnd(Condition* lhs, Condition* rhs)
|
|
84
|
+
{
|
|
85
|
+
return condMgr->AND(lhs,rhs);
|
|
86
|
+
}
|
|
87
|
+
inline Condition* condOr(Condition* lhs, Condition* rhs)
|
|
88
|
+
{
|
|
89
|
+
return condMgr->OR(lhs,rhs);
|
|
90
|
+
}
|
|
91
|
+
inline Condition* condNeg(Condition* cond)
|
|
92
|
+
{
|
|
93
|
+
return condMgr->NEG(cond);
|
|
94
|
+
}
|
|
95
|
+
inline Condition* getTrueCond() const
|
|
96
|
+
{
|
|
97
|
+
return condMgr->getTrueCond();
|
|
98
|
+
}
|
|
99
|
+
inline Condition* getFalseCond() const
|
|
100
|
+
{
|
|
101
|
+
return condMgr->getFalseCond();
|
|
102
|
+
}
|
|
103
|
+
/// Iterator every element of the condition
|
|
104
|
+
inline NodeBS exactCondElem(Condition* cond)
|
|
105
|
+
{
|
|
106
|
+
NodeBS elems;
|
|
107
|
+
condMgr->extractSubConds(cond,elems);
|
|
108
|
+
return elems;
|
|
109
|
+
}
|
|
110
|
+
|
|
111
|
+
inline std::string dumpCond(Condition* cond) const
|
|
112
|
+
{
|
|
113
|
+
return condMgr->dumpStr(cond);
|
|
114
|
+
}
|
|
115
|
+
/// Given an z3 expr id, get its condition
|
|
116
|
+
inline Condition* getCond(u32_t i) const
|
|
117
|
+
{
|
|
118
|
+
return condMgr->getCond(i);
|
|
119
|
+
}
|
|
120
|
+
/// Allocate a new condition
|
|
121
|
+
inline Condition* newCond(const Instruction* inst)
|
|
122
|
+
{
|
|
123
|
+
return condMgr->createFreshBranchCond(inst);
|
|
124
|
+
}
|
|
125
|
+
//@}
|
|
126
|
+
|
|
127
|
+
/// Perform path allocation
|
|
128
|
+
void allocate(const SVFModule* module);
|
|
129
|
+
|
|
130
|
+
/// Get/Set llvm conditional expression
|
|
131
|
+
//{@
|
|
132
|
+
inline const Instruction* getCondInst(const Condition* cond) const
|
|
133
|
+
{
|
|
134
|
+
return condMgr->getCondInst(cond);
|
|
135
|
+
}
|
|
136
|
+
inline void setCondInst(const CondExpr* cond, const Instruction* inst){
|
|
137
|
+
condMgr->setCondInst(cond, inst);
|
|
138
|
+
}
|
|
139
|
+
//@}
|
|
140
|
+
|
|
141
|
+
/// Get dominators
|
|
142
|
+
inline DominatorTree* getDT(const Function* fun)
|
|
143
|
+
{
|
|
144
|
+
return cfInfoBuilder.getDT(fun);
|
|
145
|
+
}
|
|
146
|
+
/// Get Postdominators
|
|
147
|
+
inline PostDominatorTree* getPostDT(const Function* fun)
|
|
148
|
+
{
|
|
149
|
+
return cfInfoBuilder.getPostDT(fun);
|
|
150
|
+
}
|
|
151
|
+
/// Get LoopInfo
|
|
152
|
+
inline LoopInfo* getLoopInfo(const Function* f)
|
|
153
|
+
{
|
|
154
|
+
return cfInfoBuilder.getLoopInfo(f);
|
|
155
|
+
}
|
|
156
|
+
|
|
157
|
+
|
|
158
|
+
/// Guard Computation for a value-flow (between two basic blocks)
|
|
159
|
+
//@{
|
|
160
|
+
virtual Condition* ComputeIntraVFGGuard(const BasicBlock* src, const BasicBlock* dst);
|
|
161
|
+
virtual Condition* ComputeInterCallVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* callBB);
|
|
162
|
+
virtual Condition* ComputeInterRetVFGGuard(const BasicBlock* src, const BasicBlock* dst, const BasicBlock* retBB);
|
|
163
|
+
|
|
164
|
+
/// Get complement condition (from B1 to B0) according to a complementBB (BB2) at a phi
|
|
165
|
+
/// e.g., B0: dstBB; B1:incomingBB; B2:complementBB
|
|
166
|
+
virtual Condition* getPHIComplementCond(const BasicBlock* BB1, const BasicBlock* BB2, const BasicBlock* BB0);
|
|
167
|
+
|
|
168
|
+
inline void clearCFCond()
|
|
169
|
+
{
|
|
170
|
+
bbToCondMap.clear();
|
|
171
|
+
}
|
|
172
|
+
/// Set current value for branch condition evaluation
|
|
173
|
+
inline void setCurEvalSVFGNode(const SVFGNode* node)
|
|
174
|
+
{
|
|
175
|
+
curEvalSVFGNode = node;
|
|
176
|
+
}
|
|
177
|
+
/// Get current value for branch condition evaluation
|
|
178
|
+
inline const SVFGNode* getCurEvalSVFGNode() const
|
|
179
|
+
{
|
|
180
|
+
return curEvalSVFGNode;
|
|
181
|
+
}
|
|
182
|
+
//@}
|
|
183
|
+
|
|
184
|
+
/// Print out the path condition information
|
|
185
|
+
void printPathCond();
|
|
186
|
+
|
|
187
|
+
/// whether condition is satisfiable
|
|
188
|
+
inline bool isSatisfiable(Condition* condition){
|
|
189
|
+
return condMgr->isSatisfiable(condition);
|
|
190
|
+
}
|
|
191
|
+
|
|
192
|
+
/// whether condition is satisfiable for all possible boolean guards
|
|
193
|
+
inline bool isAllPathReachable(Condition* condition){
|
|
194
|
+
return condMgr->isAllPathReachable(condition);
|
|
195
|
+
}
|
|
196
|
+
|
|
197
|
+
bool isEquivalentBranchCond(const Condition *lhs, const Condition *rhs) const{
|
|
198
|
+
return condMgr->isEquivalentBranchCond(lhs, rhs);
|
|
199
|
+
}
|
|
200
|
+
|
|
201
|
+
private:
|
|
202
|
+
|
|
203
|
+
/// Allocate path condition for every basic block
|
|
204
|
+
virtual void allocateForBB(const BasicBlock& bb);
|
|
205
|
+
|
|
206
|
+
/// Get/Set a branch condition, and its terminator instruction
|
|
207
|
+
//@{
|
|
208
|
+
/// Set branch condition
|
|
209
|
+
void setBranchCond(const BasicBlock *bb, const BasicBlock *succ, Condition* cond);
|
|
210
|
+
/// Get branch condition
|
|
211
|
+
Condition* getBranchCond(const BasicBlock * bb, const BasicBlock *succ) const;
|
|
212
|
+
///Get a condition, evaluate the value for conditions if necessary (e.g., testNull like express)
|
|
213
|
+
Condition* getEvalBrCond(const BasicBlock * bb, const BasicBlock *succ);
|
|
214
|
+
//@}
|
|
215
|
+
/// Evaluate branch conditions
|
|
216
|
+
//@{
|
|
217
|
+
/// Evaluate the branch condtion
|
|
218
|
+
Condition* evaluateBranchCond(const BasicBlock * bb, const BasicBlock *succ) ;
|
|
219
|
+
/// Evaluate loop exit branch
|
|
220
|
+
Condition* evaluateLoopExitBranch(const BasicBlock * bb, const BasicBlock *succ);
|
|
221
|
+
/// Return branch condition after evaluating test null like expression
|
|
222
|
+
Condition* evaluateTestNullLikeExpr(const BranchInst* brInst, const BasicBlock *succ);
|
|
223
|
+
/// Return condition when there is a branch calls program exit
|
|
224
|
+
Condition* evaluateProgExit(const BranchInst* brInst, const BasicBlock *succ);
|
|
225
|
+
/// Collect basic block contains program exit function call
|
|
226
|
+
void collectBBCallingProgExit(const BasicBlock& bb);
|
|
227
|
+
bool isBBCallsProgExit(const BasicBlock* bb);
|
|
228
|
+
//@}
|
|
229
|
+
|
|
230
|
+
/// Evaluate test null/not null like expressions
|
|
231
|
+
//@{
|
|
232
|
+
/// Return true if the predicate of this compare instruction is equal
|
|
233
|
+
bool isEQCmp(const CmpInst* cmp) const;
|
|
234
|
+
/// Return true if the predicate of this compare instruction is not equal
|
|
235
|
+
bool isNECmp(const CmpInst* cmp) const;
|
|
236
|
+
/// Return true if this is a test null expression
|
|
237
|
+
bool isTestNullExpr(const Value* test) const;
|
|
238
|
+
/// Return true if this is a test not null expression
|
|
239
|
+
bool isTestNotNullExpr(const Value* test) const;
|
|
240
|
+
/// Return true if two values on the predicate are what we want
|
|
241
|
+
bool isTestContainsNullAndTheValue(const CmpInst* cmp) const;
|
|
242
|
+
//@}
|
|
243
|
+
|
|
244
|
+
|
|
245
|
+
/// Get/Set control-flow conditions
|
|
246
|
+
//@{
|
|
247
|
+
inline bool setCFCond(const BasicBlock* bb, Condition* cond)
|
|
248
|
+
{
|
|
249
|
+
BBToCondMap::iterator it = bbToCondMap.find(bb);
|
|
250
|
+
// until a fixed-point is reached (condition is not changed)
|
|
251
|
+
if(it!=bbToCondMap.end() && isEquivalentBranchCond(it->second, cond))
|
|
252
|
+
return false;
|
|
253
|
+
|
|
254
|
+
bbToCondMap[bb] = cond;
|
|
255
|
+
return true;
|
|
256
|
+
}
|
|
257
|
+
inline Condition* getCFCond(const BasicBlock* bb) const
|
|
258
|
+
{
|
|
259
|
+
BBToCondMap::const_iterator it = bbToCondMap.find(bb);
|
|
260
|
+
if(it==bbToCondMap.end())
|
|
261
|
+
{
|
|
262
|
+
return getFalseCond();
|
|
263
|
+
}
|
|
264
|
+
return it->second;
|
|
265
|
+
}
|
|
266
|
+
//@}
|
|
267
|
+
|
|
268
|
+
/// Release memory
|
|
269
|
+
void destroy(){
|
|
270
|
+
|
|
271
|
+
}
|
|
272
|
+
|
|
273
|
+
PTACFInfoBuilder cfInfoBuilder; ///< map a function to its loop info
|
|
274
|
+
FunToExitBBsMap funToExitBBsMap; ///< map a function to all its basic blocks calling program exit
|
|
275
|
+
BBToCondMap bbToCondMap; ///< map a basic block to its path condition starting from root
|
|
276
|
+
const SVFGNode* curEvalSVFGNode{}; ///< current llvm value to evaluate branch condition when computing guards
|
|
277
|
+
|
|
278
|
+
protected:
|
|
279
|
+
CondManager* condMgr; ///< z3 manager
|
|
280
|
+
BBCondMap bbConds; ///< map basic block to its successors/predecessors branch conditions
|
|
281
|
+
|
|
282
|
+
};
|
|
283
|
+
|
|
284
|
+
} // End namespace SVF
|
|
285
|
+
|
|
286
|
+
#endif /* PATHALLOCATOR_H_ */
|
|
@@ -239,7 +239,7 @@ public:
|
|
|
239
239
|
|
|
240
240
|
//WPAPass.cpp
|
|
241
241
|
static const llvm::cl::opt<bool> AnderSVFG;
|
|
242
|
-
static const llvm::cl::opt<bool>
|
|
242
|
+
static const llvm::cl::opt<bool> SABERFULLSVFG;
|
|
243
243
|
static const llvm::cl::opt<bool> PrintAliases;
|
|
244
244
|
static llvm::cl::bits<PointerAnalysis::PTATY> PASelected;
|
|
245
245
|
static llvm::cl::bits<WPAPass::AliasCheckRule> AliasRule;
|
|
Binary file
|
|
Binary file
|
|
@@ -239,7 +239,7 @@ public:
|
|
|
239
239
|
|
|
240
240
|
//WPAPass.cpp
|
|
241
241
|
static const llvm::cl::opt<bool> AnderSVFG;
|
|
242
|
-
static const llvm::cl::opt<bool>
|
|
242
|
+
static const llvm::cl::opt<bool> SABERFULLSVFG;
|
|
243
243
|
static const llvm::cl::opt<bool> PrintAliases;
|
|
244
244
|
static llvm::cl::bits<PointerAnalysis::PTATY> PASelected;
|
|
245
245
|
static llvm::cl::bits<WPAPass::AliasCheckRule> AliasRule;
|