svf-lib 1.0.972 → 1.0.975

package/SVF-linux/include/WPA/TypeBasedHeapCloning.h

@@ -0,0 +1,188 @@
+//===- TypeBasedHeapCloning.h -- Type filter/type-based heap cloning base ------------//
+
+/*
+ * TypeBasedHeapCloning.h
+ *
+ * Contains data structures and functions to extend a pointer analysis
+ * with type-based heap cloning/type filtering.
+ *
+ *  Created on: Feb 08, 2020
+ *      Author: Mohamad Barbar
+ */
+
+#include "SVF-FE/DCHG.h"
+#include "MemoryModel/SVFIR.h"
+#include "MemoryModel/PointerAnalysisImpl.h"
+#include "Util/BasicTypes.h"
+
+namespace SVF
+{
+
+class TypeBasedHeapCloning
+{
+public:
+    /// Returns raw ctir metadata of a Value. Returns null if it doesn't exist.
+    static const MDNode *getRawCTirMetadata(const Value *);
+
+    virtual ~TypeBasedHeapCloning() { };
+
+protected:
+    /// The undefined type (•); void.
+    static const DIType *undefType;
+
+    /// deref function for TBHC alias tests.
+    static const std::string derefFnName;
+    /// deref function (mangled) for TBHC alias tests.
+    static const std::string mangledDerefFnName;
+
+    /// Constructor. pta is the pointer analysis using this object (i.e. that which is extending).
+    TypeBasedHeapCloning(BVDataPTAImpl *pta);
+
+    /// Required by user. Handles back-propagation of newly created clone after all
+    /// metadata has been set. Used by cloneObject.
+    virtual void backPropagate(NodeID clone) = 0;
+
+    /// Class hierarchy graph built from debug information. Required, CHG from
+    /// IR is insufficient.
+    DCHGraph *dchg = nullptr;
+
+    /// DCHG *must* be set by extending class once the DCHG is available.
+    void setDCHG(DCHGraph *dchg);
+    /// SVFIR *must* be set by extending class once the SVFIR is available.
+    void setPAG(SVFIR *pag);
+
+    /// Check if an object is a black hole obj or a constant object. Required since
+    /// other implementations obviously do not account for clones.
+    bool isBlkObjOrConstantObj(NodeID o) const;
+
+    /// Wrapper around DCHGraph::isBase. Purpose is to keep our conditions clean
+    /// by only passing two parameters like the rules.
+    bool isBase(const DIType *a, const DIType *b) const;
+
+    /// Returns true if o is a clone.
+    bool isClone(NodeID o) const;
+
+    /// Sets the type (in objToType) of o.
+    void setType(NodeID o, const DIType *t);
+    /// Returns the type (from objToType) of o. Asserts existence.
+    const DIType *getType(NodeID o) const;
+
+    /// Sets the allocation site (in objToAllocation) of o.
+    void setAllocationSite(NodeID o, NodeID site);
+    /// Returns the allocation site (from objToAllocation) of o. Asserts existence.
+    NodeID getAllocationSite(NodeID o) const;
+
+    /// Returns objects that have clones (any key in objToClones).
+    const NodeBS getObjsWithClones(void);
+    /// Add a clone c to object o.
+    void addClone(NodeID o, NodeID c);
+    /// Returns all the clones of o.
+    const NodeBS &getClones(NodeID o);
+
+    // Set o as the original object of clone c.
+    void setOriginalObj(NodeID c, NodeID o);
+    /// Returns the original object c is cloned from. If c is not a clone, returns itself.
+    NodeID getOriginalObj(NodeID c) const;
+
+    /// Returns the filter set of a location. Not const; could create empty PointsTo.
+    PointsTo &getFilterSet(NodeID loc);
+
+    /// Associates gep with base (through objToGeps and memObjToGeps).
+    void addGepToObj(NodeID gep, NodeID base, unsigned offset);
+    /// Returns all gep objects at a particular offset for memory object.
+    /// Not const; could create empty set.
+    const NodeBS &getGepObjsFromMemObj(const MemObj *memObj, unsigned offset);
+    /// Returns all gep objects under an object.
+    /// Not const; could create empty set.
+    const NodeBS &getGepObjs(NodeID base);
+
+    /// Returns the GEP object node(s) of base for ls. This may include clones.
+    /// If there are no GEP objects, then getGepObjVar is called on the SVFIR
+    /// (through base's getGepObjVar) which will create one.
+    const NodeBS getGepObjClones(NodeID base, unsigned offset);
+
+    /// Initialise the pointees of p at loc (which is type tildet *). reuse indicates
+    /// whether reuse is a possibility for this initialisation. Returns whether p changed.
+    bool init(NodeID loc, NodeID p, const DIType *tildet, bool reuse, bool gep=false);
+
+    /// Returns a clone of o with type type. reuse indicates whether we are cloning
+    /// as a result of reuse.
+    NodeID cloneObject(NodeID o, const DIType *type, bool reuse);
+
+    /// Add clone dummy object node to SVFIR.
+    inline NodeID addCloneDummyObjNode(const MemObj *mem);
+    /// Add clone GEP object node to SVFIR.
+    inline NodeID addCloneGepObjNode(const MemObj *mem, const LocationSet &l);
+    /// Add clone FI object node to SVFIR.
+    inline NodeID addCloneFIObjNode(const MemObj *mem);
+
+    /// Returns the ctir type attached to the value, nullptr if non-existant.
+    /// Not static because it needs the DCHG to return the canonical type.
+    /// Not static because we need dchg's getCanonicalType.
+    const DIType *getTypeFromCTirMetadata(const Value *);
+
+    /// Runs tests on MAYALIAS, NOALIAS, etc. built from TBHC_MAYALIAS,
+    /// TBHC_NOALIAS, etc. macros.
+    /// TBHC_XALIAS macros produce:
+    ///   call XALIAS(...)
+    ///   %1 = load ...
+    ///   ...
+    ///   %n = load %p
+    ///   store ... %n-1, ...* %n !ctir !t1
+    ///   call deref()
+    ///   %n+1 = load ...
+    ///   ...
+    ///   %n+n = load %q
+    ///   store ... %n+n-1, ...* %n+n !ctir !t2
+    ///   call deref()
+    /// We want to test the points-to sets of %n and
+    /// %n+n after filtering with !t1 and !t2 respectively.
+    void validateTBHCTests(SVFModule *svfMod);
+
+    /// Dump some statistics we tracked.
+    void dumpStats(void);
+
+private:
+    /// PTA extending this class.
+    BVDataPTAImpl *pta;
+    /// SVFIR the PTA uses. Just a shortcut for getPAG().
+    SVFIR *ppag = nullptr;
+
+    /// Object -> its type.
+    Map<NodeID, const DIType *> objToType;
+    /// Object -> allocation site.
+    /// The value NodeID depends on the pointer analysis (could be
+    /// an SVFG node or SVFIR node for example).
+    Map<NodeID, NodeID> objToAllocation;
+    /// (Original) object -> set of its clones.
+    Map<NodeID, NodeBS> objToClones;
+    /// (Clone) object -> original object (opposite of objToclones).
+    Map<NodeID, NodeID> cloneToOriginalObj;
+    /// Maps nodes (a location like a SVFIR node or SVFG node) to their filter set.
+    Map<NodeID, PointsTo> locToFilterSet;
+    /// Maps objects to the GEP nodes beneath them.
+    Map<NodeID, NodeBS> objToGeps;
+    /// Maps memory objects to their GEP objects. (memobj -> (fieldidx -> geps))
+    Map<const MemObj *, Map<unsigned, NodeBS>> memObjToGeps;
+
+    /// Test whether object is a GEP object. For convenience.
+    bool isGep(const PAGNode *n) const;
+
+    // Bunch of stats to keep track of.
+    unsigned numInit  = 0;
+    unsigned numTBWU  = 0;
+    unsigned numTBSSU = 0;
+    unsigned numTBSU  = 0;
+    unsigned numReuse = 0;
+    unsigned numAgg   = 0;
+
+    // Previous stats but only upon stack/global objects.
+    unsigned numSGInit  = 0;
+    unsigned numSGTBWU  = 0;
+    unsigned numSGTBSSU = 0;
+    unsigned numSGTBSU  = 0;
+    unsigned numSGReuse = 0;
+    unsigned numSGAgg   = 0;
+};
+
+} // End namespace SVF

package/SVF-osx/include/MSSA/MemSSA.h

@@ -75,7 +75,7 @@ public:
     typedef Map<const StoreStmt*, CHISet> StoreToChiSetMap;
     typedef Map<const CallICFGNode*, MUSet> CallSiteToMUSetMap;
     typedef Map<const CallICFGNode*, CHISet> CallSiteToCHISetMap;
-    typedef Map<const BasicBlock*, PHISet> BBToPhiSetMap;
+    typedef OrderedMap<const BasicBlock*, PHISet> BBToPhiSetMap;
     //@}
 
     /// Map from fun to its entry chi set and return mu set

package/SVF-osx/include/SABER/PathCondAllocator.h

@@ -33,7 +33,7 @@
 #include "Util/SVFModule.h"
 #include "SVF-FE/DataFlowUtil.h"
 #include "SVF-FE/BasicTypes.h"
-#include "Util/Conditions.h"
+#include "Util/BDDExpr.h"
 #include "Util/WorkList.h"
 #include "Graphs/SVFG.h"
 
@@ -49,7 +49,7 @@ class PathCondAllocator
 
 public:
 
-    typedef CondExpr Condition;   /// z3 condition
+    typedef BDDExprManager::BDDExpr Condition;   /// z3 condition
 
     typedef Map<u32_t,Condition*> CondPosMap;		///< map a branch to its Condition
     typedef Map<const BasicBlock*, CondPosMap > BBCondMap;	// map bb to a Condition
@@ -133,7 +133,7 @@ public:
     {
         return condMgr->getCondInst(cond);
     }
-    inline void setCondInst(const CondExpr* cond, const Instruction* inst){
+    inline void setCondInst(const Condition* cond, const Instruction* inst){
         condMgr->setCondInst(cond, inst);
     }
     //@}
@@ -286,7 +286,7 @@ private:
     const SVFGNode* curEvalSVFGNode{};			///< current llvm value to evaluate branch condition when computing guards
 
 protected:
-    CondManager* condMgr;		///< z3 manager
+    BDDExprManager* condMgr;		///< z3 manager
     BBCondMap bbConds;						///< map basic block to its successors/predecessors branch conditions
 
 };

package/SVF-osx/include/SABER/SrcSnkDDA.h

@@ -30,7 +30,7 @@
 #ifndef SRCSNKANALYSIS_H_
 #define SRCSNKANALYSIS_H_
 
-#include "Util/CFLSolver.h"
+#include "SrcSnkSolver.h"
 #include "Graphs/SVFGOPT.h"
 #include "SABER/ProgSlice.h"
 #include "SABER/SaberSVFGBuilder.h"
@@ -38,7 +38,7 @@
 namespace SVF
 {
 
-typedef CFLSolver<SVFG*,CxtDPItem> CFLSrcSnkSolver;
+typedef SrcSnkSolver<SVFG*,CxtDPItem> CFLSrcSnkSolver;
 
 /*!
  * General source-sink analysis, which serves as a base analysis to be extended for various clients

package/SVF-osx/include/SABER/SrcSnkSolver.h

@@ -0,0 +1,186 @@
+//===- SrcSnkSolver.h -- CFL reachability solver---------------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * SrcSnkSolver.h
+ *
+ *  Created on: Apr 1, 2014
+ *      Author: Yulei Sui
+ */
+
+#ifndef CFLSOLVER_H_
+#define CFLSOLVER_H_
+
+#include "Util/WorkList.h"
+#include "Util/DPItem.h"
+
+namespace SVF
+{
+
+/*
+ * Generic CFL solver for demand-driven analysis based on different graphs (e.g. SVFIR, VFG, ThreadVFG)
+ * Extend this class for sophisticated CFL-reachability resolution (e.g. field, flow, path)
+ */
+template<class GraphType, class DPIm = DPItem>
+class SrcSnkSolver
+{
+
+public:
+    ///Define the GTraits and node iterator
+    typedef llvm::GraphTraits<GraphType> GTraits;
+    typedef typename GTraits::NodeType          GNODE;
+    typedef typename GTraits::EdgeType          GEDGE;
+    typedef typename GTraits::nodes_iterator node_iterator;
+    typedef typename GTraits::ChildIteratorType child_iterator;
+
+    /// Define inverse GTraits and note iterator
+    typedef llvm::GraphTraits<llvm::Inverse<GNODE *> > InvGTraits;
+    typedef typename InvGTraits::ChildIteratorType inv_child_iterator;
+
+    /// Define worklist
+    typedef FIFOWorkList<DPIm> WorkList;
+
+protected:
+
+    /// Constructor
+    SrcSnkSolver(): _graph(nullptr)
+    {
+    }
+    /// Destructor
+    virtual ~SrcSnkSolver()
+    {
+    }
+    /// Get/Set graph methods
+    //@{
+    const inline GraphType graph() const
+    {
+        return _graph;
+    }
+    inline void setGraph(GraphType g)
+    {
+        _graph = g;
+    }
+    //@}
+
+    inline GNODE* getNode(NodeID id) const
+    {
+        return _graph->getGNode(id);
+    }
+    virtual inline NodeID getNodeIDFromItem(const DPIm& item) const
+    {
+        return item.getCurNodeID();
+    }
+    /// CFL forward traverse solve
+    virtual void forwardTraverse(DPIm& it)
+    {
+        pushIntoWorklist(it);
+
+        while (!isWorklistEmpty())
+        {
+            DPIm item = popFromWorklist();
+            FWProcessCurNode(item);
+
+            GNODE* v = getNode(getNodeIDFromItem(item));
+            child_iterator EI = GTraits::child_begin(v);
+            child_iterator EE = GTraits::child_end(v);
+            for (; EI != EE; ++EI)
+            {
+                FWProcessOutgoingEdge(item,*(EI.getCurrent()) );
+            }
+        }
+    }
+    /// CFL forward traverse solve
+    virtual void backwardTraverse(DPIm& it)
+    {
+        pushIntoWorklist(it);
+
+        while (!isWorklistEmpty())
+        {
+            DPIm item = popFromWorklist();
+            BWProcessCurNode(item);
+
+            GNODE* v = getNode(getNodeIDFromItem(item));
+            inv_child_iterator EI = InvGTraits::child_begin(v);
+            inv_child_iterator EE = InvGTraits::child_end(v);
+            for (; EI != EE; ++EI)
+            {
+                BWProcessIncomingEdge(item,*(EI.getCurrent()) );
+            }
+        }
+    }
+    /// Process the DP item
+    //@{
+    virtual void FWProcessCurNode(const DPIm&)
+    {
+    }
+    virtual void BWProcessCurNode(const DPIm&)
+    {
+    }
+    //@}
+    /// Propagation for the solving, to be implemented in the child class
+    //@{
+    virtual void FWProcessOutgoingEdge(const DPIm& item, GEDGE* edge)
+    {
+        DPIm newItem(item);
+        newItem.setCurNodeID(edge->getDstID());
+        pushIntoWorklist(newItem);
+    }
+    virtual void BWProcessIncomingEdge(const DPIm& item, GEDGE* edge)
+    {
+        DPIm newItem(item);
+        newItem.setCurNodeID(edge->getSrcID());
+        pushIntoWorklist(newItem);
+    }
+    //@}
+    /// Worklist operations
+    //@{
+    inline DPIm popFromWorklist()
+    {
+        return worklist.pop();
+    }
+    inline bool pushIntoWorklist(DPIm& item)
+    {
+        return worklist.push(item);
+    }
+    inline bool isWorklistEmpty()
+    {
+        return worklist.empty();
+    }
+    inline bool isInWorklist(DPIm& item)
+    {
+        return worklist.find(item);
+    }
+    //@}
+
+private:
+
+    /// Graph
+    GraphType _graph;
+
+    /// Worklist for resolution
+    WorkList worklist;
+
+};
+
+} // End namespace SVF
+
+#endif /* CFLSOLVER_H_ */