svf-lib 1.0.973 → 1.0.976

package/SVF-linux/include/Util/BDDExpr.h

@@ -0,0 +1,182 @@
+//===- BDDExpr.h -- Context/Path BDD conditions----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * Condition.h
+ *
+ *  Created on: Oct 19, 2021
+ *      Author: Yulei and Xiao
+ */
+
+#ifndef BITVECTORCOND_H_
+#define BITVECTORCOND_H_
+
+#include "Util/BasicTypes.h"
+#include <cstdio>
+
+#include "CUDD/cuddInt.h"
+#include "z3++.h"
+
+namespace SVF {
+
+class BDDExprManager {
+public:
+    typedef DdNode BDDExpr;
+    typedef Map<u32_t, BDDExpr *> IndexToBDDExpr;
+private:
+    static BDDExprManager *bddExprMgr;
+    IndexToBDDExpr indexToBddCondMap;
+    DdManager *m_bdd_mgr;
+
+    inline BDDExpr *BddOne() const {
+        return Cudd_ReadOne(m_bdd_mgr);
+    }
+
+    inline BDDExpr *BddZero() const {
+        return Cudd_ReadLogicZero(m_bdd_mgr);
+    }
+
+    /// Constructor
+    BDDExprManager();
+
+public:
+    typedef Map<const BDDExpr *, const Instruction *> CondToTermInstMap;    // map a condition to its branch instruction
+    static u32_t totalCondNum; // a counter for fresh condition
+    /// Singleton design here to make sure we only have one instance during any analysis
+    //@{
+    static BDDExprManager *getBDDExprMgr();
+
+    static void releaseBDDExprMgr() {
+        delete bddExprMgr;
+        bddExprMgr = nullptr;
+    }
+    //@}
+
+    /// Destructor
+    virtual ~BDDExprManager();
+
+    BDDExpr *createCond(u32_t i) {
+        assert(indexToBddCondMap.find(i) == indexToBddCondMap.end() &&
+               "This should be fresh index to create new BDD");
+        BDDExpr *bddCond = Cudd_bddIthVar(m_bdd_mgr, i);
+        return indexToBddCondMap.emplace(i, bddCond).first->second;
+    }
+
+    /// Create a fresh condition to encode each program branch
+    virtual BDDExpr *createFreshBranchCond(const Instruction *inst);
+
+    /// Return the number of condition expressions
+    virtual inline u32_t getCondNumber() {
+        return Cudd_ReadNodeCount(m_bdd_mgr);
+    }
+
+
+    /// Return the unique true condition
+    inline BDDExpr *getTrueCond() const {
+        return trueCond;
+    }
+
+    /// Return the unique false condition
+    inline BDDExpr *getFalseCond() const {
+        return falseCond;
+    }
+
+    /// Operations on conditions.
+    //@{
+    virtual BDDExpr *AND(BDDExpr *lhs, BDDExpr *rhs);
+
+    virtual BDDExpr *OR(BDDExpr *lhs, BDDExpr *rhs);
+
+    virtual BDDExpr *NEG(BDDExpr *lhs);
+    //@}
+
+    virtual bool isNegCond(const BDDExpr *cond) {
+        return false;
+    }
+
+    /// Whether the condition is satisfiable
+    virtual bool isSatisfiable(const BDDExpr *cond) {
+        return cond != getFalseCond();
+    }
+
+    /// Whether lhs and rhs are equivalent branch conditions
+    virtual bool isEquivalentBranchCond(const BDDExpr *lhs, const BDDExpr *rhs){
+        return lhs == rhs;
+    }
+
+    /// Whether **All Paths** are reachable
+    bool isAllPathReachable(const BDDExpr *e);
+
+    /// Get condition using condition id (z3 ast id)
+    virtual BDDExpr *getCond(u32_t id) {
+        auto it = indexToBddCondMap.find(id);
+        assert(it != indexToBddCondMap.end() && "condition not found!");
+        return it->second;
+    }
+
+    /// Get/Set llvm conditional expression
+    //{@
+    inline const Instruction *getCondInst(const BDDExpr *cond) const {
+        CondToTermInstMap::const_iterator it = condToInstMap.find(cond);
+        assert(it != condToInstMap.end() && "this should be a fresh condition");
+        return it->second;
+    }
+
+    inline void setCondInst(const BDDExpr *cond, const Instruction *inst) {
+        assert(condToInstMap.find(cond) == condToInstMap.end() && "this should be a fresh condition");
+        condToInstMap[cond] = inst;
+    }
+    //@}
+
+    /**
+     * Utilities for dumping conditions. These methods use global functions from CUDD
+     * package and they can be removed outside this class scope to be used by others.
+     */
+    void ddClearFlag(BDDExpr *f) const;
+
+    void BddSupportStep(BDDExpr *f, NodeBS &support) const;
+
+    void extractSubConds(const BDDExpr *f, NodeBS &support) const;
+
+    void dump(const BDDExpr *lhs, OutStream &O);
+
+    std::string dumpStr(const BDDExpr *e) const;
+
+    inline std::string getMemUsage() {
+        return std::to_string(Cudd_ReadMemoryInUse(m_bdd_mgr));
+    }
+
+protected:
+    static BDDExpr *trueCond;
+    static BDDExpr *falseCond;
+
+private:
+
+    CondToTermInstMap condToInstMap; ///< map condition to llvm instruction
+
+};
+
+
+
+} // End namespace SVF
+
+#endif /* BITVECTORCOND_H_ */

package/SVF-linux/include/Util/DPItem.h

@@ -30,7 +30,7 @@
 #ifndef DPITEM_H_
 #define DPITEM_H_
 
-#include "Util/Conditions.h"
+#include "Util/BDDExpr.h"
 #include "MemoryModel/ConditionalPT.h"
 #include <algorithm>    // std::sort
 

package/SVF-linux/include/Util/ExeState.h

@@ -0,0 +1,172 @@
+//===- ExeState.h -- Execution State ----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * ExeState.h
+ *
+ *  Created on: April 29, 2022
+ *      Author: Xiao
+ */
+
+#ifndef SVF_EXESTATE_H
+#define SVF_EXESTATE_H
+#include "Util/Z3Expr.h"
+#include "MemoryModel/SVFVariables.h"
+
+namespace SVF {
+
+#define AddressMask 0x7f000000
+#define FlippedAddressMask (AddressMask^0xffffffff)
+
+class ExeState {
+public:
+    typedef Map<u32_t, Z3Expr> VarToValMap;
+    typedef Map<u32_t, Z3Expr> LocToValMap;
+
+protected:
+    VarToValMap varToVal;
+    LocToValMap locToVal;
+    Z3Expr pathConstraint;
+
+public:
+    ExeState() : pathConstraint(getContext().bool_val(true)) {}
+
+    ExeState(const Z3Expr &_pc, VarToValMap &_varToValMap, LocToValMap &_locToValMap) : varToVal(_varToValMap),
+                                                                                        locToVal(_locToValMap),
+                                                                                        pathConstraint(_pc) {}
+
+    ExeState(const ExeState &rhs) : varToVal(rhs.getVarToVal()), locToVal(rhs.getLocToVal()),
+                                    pathConstraint(rhs.getPathConstraint()) {
+
+    }
+
+    virtual ~ExeState() = default;
+
+    ExeState &operator=(const ExeState &rhs);
+
+    /// Overloading Operator==
+    bool operator==(const ExeState &rhs) const;
+
+    /// Overloading Operator!=
+    inline bool operator!=(const ExeState &rhs) const {
+        return !(*this == rhs);
+    }
+
+    /// Overloading Operator==
+    bool operator<(const ExeState &rhs) const;
+
+    z3::context &getContext() {
+        return Z3Expr::getContext();
+    }
+
+    const VarToValMap &getVarToVal() const {
+        return varToVal;
+    }
+
+    const LocToValMap &getLocToVal() const {
+        return locToVal;
+    }
+
+    const Z3Expr &getPathConstraint() const {
+        return pathConstraint;
+    }
+
+    void setPathConstraint(const Z3Expr &pc) {
+        pathConstraint = pc.simplify();
+    }
+
+    inline Z3Expr &operator[](u32_t varId) {
+        return getZ3Expr(varId);
+    }
+
+    /// Init Z3Expr for ValVar
+    void initValVar(const ValVar *valVar, Z3Expr &e);
+
+    /// Init Z3Expr for ObjVar
+    void initObjVar(const ObjVar *objVar, Z3Expr &e);
+
+    /// Return Z3 expression based on SVFVar ID
+    Z3Expr &getZ3Expr(u32_t varId);
+
+    /// Store value to location
+    void store(const Z3Expr &loc, const Z3Expr &value);
+
+    /// Load value at location
+    Z3Expr &load(const Z3Expr &loc);
+
+    /// The physical address starts with 0x7f...... + idx
+    inline u32_t getVirtualMemAddress(u32_t idx) const {
+        return AddressMask + idx;
+    }
+
+    /// Check bit value of val start with 0x7F000000, filter by 0xFF000000
+    inline bool isVirtualMemAddress(u32_t val) {
+        return (val & 0xff000000) == AddressMask;
+    }
+
+    /// Return the internal index if idx is an address otherwise return the value of idx
+    inline u32_t getInternalID(u32_t idx) const {
+        return (idx & FlippedAddressMask);
+    }
+
+    /// Return int value from an expression if it is a numeral, otherwise return an approximate value
+    inline s32_t z3Expr2NumValue(const Z3Expr &e) {
+        assert(e.is_numeral() && "not numeral?");
+        return e.get_numeral_int64();
+    }
+
+    /// Print values of all expressions
+    void printExprValues();
+
+protected:
+    inline void store(u32_t objId, const Z3Expr &z3Expr) {
+        locToVal[objId] = z3Expr.simplify();
+    }
+
+    inline Z3Expr &load(u32_t objId) {
+        return locToVal[objId];
+    }
+};
+}
+
+template<>
+struct std::hash<SVF::ExeState> {
+    size_t operator()(const SVF::ExeState &exeState) const {
+
+        size_t h = exeState.getVarToVal().size() * 2;
+        SVF::Hash<SVF::u32_t> hf;
+        for (const auto &t: exeState.getVarToVal()) {
+            h ^= hf(t.first) + 0x9e3779b9 + (h << 6) + (h >> 2);
+            h ^= hf(t.second.id()) + 0x9e3779b9 + (h << 6) + (h >> 2);
+        }
+
+        size_t h2 = exeState.getVarToVal().size() * 2;
+
+        for (const auto &t: exeState.getLocToVal()) {
+            h2 ^= hf(t.first) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
+            h2 ^= hf(t.second.id()) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
+        }
+        SVF::Hash<std::pair<SVF::u32_t, SVF::u32_t>> pairH;
+
+        return pairH(make_pair(pairH(make_pair(h, h2)), exeState.getPathConstraint().id()));
+    }
+};
+#endif //SVF_EXESTATE_H

package/SVF-linux/include/Util/Options.h

@@ -10,7 +10,6 @@
 #include "Util/NodeIDAllocator.h"
 #include "MSSA/MemSSA.h"
 #include "WPA/WPAPass.h"
-#include "Util/Conditions.h"
 
 namespace SVF
 {
@@ -255,8 +254,6 @@ public:
     // DOTGraphTraits
     static const llvm::cl::opt<bool> ShowHiddenNode;
 
-    // Conditions
-    static const llvm::cl::opt<CondManager::CondMgrKind> ConditionType;
 };
 }  // namespace SVF
 

package/SVF-linux/include/Util/Z3Expr.h

@@ -0,0 +1,235 @@
+//===- Z3Expr.h -- Z3 conditions----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * Z3Expr.h
+ *
+ *  Created on: April 29, 2022
+ *      Author: Xiao
+ */
+
+#ifndef Z3_EXAMPLE_Z3EXPR_H
+#define Z3_EXAMPLE_Z3EXPR_H
+
+#include "z3++.h"
+#include "Util/SVFBasicTypes.h"
+
+namespace SVF {
+
+    class Z3Expr {
+    public:
+        static z3::context *ctx;
+
+    private:
+        z3::expr e;
+
+        Z3Expr(float f); // placeholder don't support floating point expression
+        Z3Expr(double f); // placeholder don't support floating point expression
+
+    public:
+
+        Z3Expr() : e(nullExpr()) {
+        }
+
+        Z3Expr(const z3::expr &_e) : e(_e) {
+        }
+
+        Z3Expr(int i) : e(getContext().int_val(i)) {
+        }
+
+        Z3Expr(const Z3Expr &z3Expr) : e(z3Expr.getExpr()) {
+        }
+
+        virtual ~Z3Expr() = default;
+
+        inline Z3Expr &operator=(const Z3Expr &rhs) {
+            if (this->id() != rhs.id()) {
+                e = rhs.getExpr();
+            }
+            return *this;
+        }
+
+        const z3::expr &getExpr() const {
+            return e;
+        }
+
+        /// Get z3 context, singleton design here to make sure we only have one context
+        static z3::context &getContext() {
+            if (ctx == nullptr) {
+                ctx = new z3::context();
+            }
+            return *ctx;
+        }
+
+        /// release z3 context
+        static void releaseContext() {
+            delete ctx;
+            ctx = nullptr;
+        }
+
+        /// null expression
+        static z3::expr nullExpr() {
+            return getContext().int_const("null");
+        }
+
+        /// get id
+        inline u32_t id() const {
+            return e.id();
+        }
+
+        inline const std::string to_string() const {
+            return e.to_string();
+        }
+
+        inline bool is_numeral() const {
+            return e.is_numeral();
+        }
+
+        inline bool is_bool() const {
+            return e.is_bool();
+        }
+
+        inline Z3Expr simplify() const {
+            return e.simplify();
+        }
+
+        inline int64_t get_numeral_int64() const {
+            return e.get_numeral_int64();
+        }
+
+        inline int get_numeral_int() const {
+            return e.get_numeral_int();
+        }
+
+        //{% reload operator
+        friend Z3Expr operator==(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() == rhs.getExpr();
+        }
+
+        friend Z3Expr operator!=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() != rhs.getExpr();
+        }
+
+        friend Z3Expr operator>(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() > rhs.getExpr();
+        }
+
+        friend Z3Expr operator<(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() < rhs.getExpr();
+        }
+
+        friend Z3Expr operator<=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() <= rhs.getExpr();
+        }
+
+        friend Z3Expr operator>=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() >= rhs.getExpr();
+        }
+
+        friend Z3Expr operator+(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() + rhs.getExpr();
+        }
+
+        friend Z3Expr operator-(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() - rhs.getExpr();
+        }
+
+        friend Z3Expr operator*(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() * rhs.getExpr();
+        }
+
+        friend Z3Expr operator/(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() / rhs.getExpr();
+        }
+
+        friend Z3Expr operator%(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() % rhs.getExpr();
+        }
+
+        friend Z3Expr operator^(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() ^ rhs.getExpr();
+        }
+
+        friend Z3Expr operator&(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() & rhs.getExpr();
+        }
+
+        friend Z3Expr operator|(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() | rhs.getExpr();
+        }
+
+        friend Z3Expr ashr(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return ashr(lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend Z3Expr shl(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return shl(lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend Z3Expr int2bv(u32_t n, const Z3Expr &e) {
+            return int2bv(n, e.getExpr());
+        }
+
+        friend Z3Expr bv2int(const Z3Expr &e, bool isSigned) {
+            return z3::bv2int(e.getExpr(), isSigned);
+        }
+
+        friend Z3Expr operator&&(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() && rhs.getExpr();
+        }
+
+        friend Z3Expr operator||(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() || rhs.getExpr();
+        }
+
+        friend Z3Expr operator!(const Z3Expr &lhs) {
+            return !lhs.getExpr();
+        }
+
+        friend Z3Expr ite(const Z3Expr& cond, const Z3Expr& lhs, const Z3Expr& rhs) {
+            return ite(cond.getExpr(), lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend std::ostream &operator<<(std::ostream &out, const Z3Expr &expr) {
+            out << expr.getExpr();
+            return out;
+        }
+
+        friend bool eq(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return eq(lhs.getExpr(), rhs.getExpr());
+        }
+
+        z3::sort get_sort() const {
+            return getExpr().get_sort();
+        }
+        //%}
+    };
+}
+
+/// Specialise hash for AbsCxtDPItem.
+template<>
+struct std::hash<SVF::Z3Expr> {
+    size_t operator()(const SVF::Z3Expr &z3Expr) const {
+        return z3Expr.id();
+    }
+};
+
+#endif //Z3_EXAMPLE_Z3EXPR_H

package/SVF-linux/include/WPA/FlowSensitiveTBHC.h

@@ -13,7 +13,7 @@
 #include "SVF-FE/DCHG.h"
 #include "Graphs/SVFGOPT.h"
 #include "MSSA/SVFGBuilder.h"
-#include "Util/TypeBasedHeapCloning.h"
+#include "TypeBasedHeapCloning.h"
 #include "WPA/FlowSensitive.h"
 #include "MemoryModel/PointsTo.h"