svf-lib 1.0.973 → 1.0.976

package/SVF-osx/include/Util/Z3Expr.h

@@ -0,0 +1,235 @@
+//===- Z3Expr.h -- Z3 conditions----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * Z3Expr.h
+ *
+ *  Created on: April 29, 2022
+ *      Author: Xiao
+ */
+
+#ifndef Z3_EXAMPLE_Z3EXPR_H
+#define Z3_EXAMPLE_Z3EXPR_H
+
+#include "z3++.h"
+#include "Util/SVFBasicTypes.h"
+
+namespace SVF {
+
+    class Z3Expr {
+    public:
+        static z3::context *ctx;
+
+    private:
+        z3::expr e;
+
+        Z3Expr(float f); // placeholder don't support floating point expression
+        Z3Expr(double f); // placeholder don't support floating point expression
+
+    public:
+
+        Z3Expr() : e(nullExpr()) {
+        }
+
+        Z3Expr(const z3::expr &_e) : e(_e) {
+        }
+
+        Z3Expr(int i) : e(getContext().int_val(i)) {
+        }
+
+        Z3Expr(const Z3Expr &z3Expr) : e(z3Expr.getExpr()) {
+        }
+
+        virtual ~Z3Expr() = default;
+
+        inline Z3Expr &operator=(const Z3Expr &rhs) {
+            if (this->id() != rhs.id()) {
+                e = rhs.getExpr();
+            }
+            return *this;
+        }
+
+        const z3::expr &getExpr() const {
+            return e;
+        }
+
+        /// Get z3 context, singleton design here to make sure we only have one context
+        static z3::context &getContext() {
+            if (ctx == nullptr) {
+                ctx = new z3::context();
+            }
+            return *ctx;
+        }
+
+        /// release z3 context
+        static void releaseContext() {
+            delete ctx;
+            ctx = nullptr;
+        }
+
+        /// null expression
+        static z3::expr nullExpr() {
+            return getContext().int_const("null");
+        }
+
+        /// get id
+        inline u32_t id() const {
+            return e.id();
+        }
+
+        inline const std::string to_string() const {
+            return e.to_string();
+        }
+
+        inline bool is_numeral() const {
+            return e.is_numeral();
+        }
+
+        inline bool is_bool() const {
+            return e.is_bool();
+        }
+
+        inline Z3Expr simplify() const {
+            return e.simplify();
+        }
+
+        inline int64_t get_numeral_int64() const {
+            return e.get_numeral_int64();
+        }
+
+        inline int get_numeral_int() const {
+            return e.get_numeral_int();
+        }
+
+        //{% reload operator
+        friend Z3Expr operator==(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() == rhs.getExpr();
+        }
+
+        friend Z3Expr operator!=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() != rhs.getExpr();
+        }
+
+        friend Z3Expr operator>(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() > rhs.getExpr();
+        }
+
+        friend Z3Expr operator<(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() < rhs.getExpr();
+        }
+
+        friend Z3Expr operator<=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() <= rhs.getExpr();
+        }
+
+        friend Z3Expr operator>=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() >= rhs.getExpr();
+        }
+
+        friend Z3Expr operator+(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() + rhs.getExpr();
+        }
+
+        friend Z3Expr operator-(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() - rhs.getExpr();
+        }
+
+        friend Z3Expr operator*(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() * rhs.getExpr();
+        }
+
+        friend Z3Expr operator/(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() / rhs.getExpr();
+        }
+
+        friend Z3Expr operator%(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() % rhs.getExpr();
+        }
+
+        friend Z3Expr operator^(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() ^ rhs.getExpr();
+        }
+
+        friend Z3Expr operator&(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() & rhs.getExpr();
+        }
+
+        friend Z3Expr operator|(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() | rhs.getExpr();
+        }
+
+        friend Z3Expr ashr(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return ashr(lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend Z3Expr shl(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return shl(lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend Z3Expr int2bv(u32_t n, const Z3Expr &e) {
+            return int2bv(n, e.getExpr());
+        }
+
+        friend Z3Expr bv2int(const Z3Expr &e, bool isSigned) {
+            return z3::bv2int(e.getExpr(), isSigned);
+        }
+
+        friend Z3Expr operator&&(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() && rhs.getExpr();
+        }
+
+        friend Z3Expr operator||(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() || rhs.getExpr();
+        }
+
+        friend Z3Expr operator!(const Z3Expr &lhs) {
+            return !lhs.getExpr();
+        }
+
+        friend Z3Expr ite(const Z3Expr& cond, const Z3Expr& lhs, const Z3Expr& rhs) {
+            return ite(cond.getExpr(), lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend std::ostream &operator<<(std::ostream &out, const Z3Expr &expr) {
+            out << expr.getExpr();
+            return out;
+        }
+
+        friend bool eq(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return eq(lhs.getExpr(), rhs.getExpr());
+        }
+
+        z3::sort get_sort() const {
+            return getExpr().get_sort();
+        }
+        //%}
+    };
+}
+
+/// Specialise hash for AbsCxtDPItem.
+template<>
+struct std::hash<SVF::Z3Expr> {
+    size_t operator()(const SVF::Z3Expr &z3Expr) const {
+        return z3Expr.id();
+    }
+};
+
+#endif //Z3_EXAMPLE_Z3EXPR_H

package/SVF-osx/include/WPA/FlowSensitiveTBHC.h

@@ -13,7 +13,7 @@
 #include "SVF-FE/DCHG.h"
 #include "Graphs/SVFGOPT.h"
 #include "MSSA/SVFGBuilder.h"
-#include "Util/TypeBasedHeapCloning.h"
+#include "TypeBasedHeapCloning.h"
 #include "WPA/FlowSensitive.h"
 #include "MemoryModel/PointsTo.h"
 

package/SVF-osx/include/WPA/TypeBasedHeapCloning.h

@@ -0,0 +1,188 @@
+//===- TypeBasedHeapCloning.h -- Type filter/type-based heap cloning base ------------//
+
+/*
+ * TypeBasedHeapCloning.h
+ *
+ * Contains data structures and functions to extend a pointer analysis
+ * with type-based heap cloning/type filtering.
+ *
+ *  Created on: Feb 08, 2020
+ *      Author: Mohamad Barbar
+ */
+
+#include "SVF-FE/DCHG.h"
+#include "MemoryModel/SVFIR.h"
+#include "MemoryModel/PointerAnalysisImpl.h"
+#include "Util/BasicTypes.h"
+
+namespace SVF
+{
+
+class TypeBasedHeapCloning
+{
+public:
+    /// Returns raw ctir metadata of a Value. Returns null if it doesn't exist.
+    static const MDNode *getRawCTirMetadata(const Value *);
+
+    virtual ~TypeBasedHeapCloning() { };
+
+protected:
+    /// The undefined type (•); void.
+    static const DIType *undefType;
+
+    /// deref function for TBHC alias tests.
+    static const std::string derefFnName;
+    /// deref function (mangled) for TBHC alias tests.
+    static const std::string mangledDerefFnName;
+
+    /// Constructor. pta is the pointer analysis using this object (i.e. that which is extending).
+    TypeBasedHeapCloning(BVDataPTAImpl *pta);
+
+    /// Required by user. Handles back-propagation of newly created clone after all
+    /// metadata has been set. Used by cloneObject.
+    virtual void backPropagate(NodeID clone) = 0;
+
+    /// Class hierarchy graph built from debug information. Required, CHG from
+    /// IR is insufficient.
+    DCHGraph *dchg = nullptr;
+
+    /// DCHG *must* be set by extending class once the DCHG is available.
+    void setDCHG(DCHGraph *dchg);
+    /// SVFIR *must* be set by extending class once the SVFIR is available.
+    void setPAG(SVFIR *pag);
+
+    /// Check if an object is a black hole obj or a constant object. Required since
+    /// other implementations obviously do not account for clones.
+    bool isBlkObjOrConstantObj(NodeID o) const;
+
+    /// Wrapper around DCHGraph::isBase. Purpose is to keep our conditions clean
+    /// by only passing two parameters like the rules.
+    bool isBase(const DIType *a, const DIType *b) const;
+
+    /// Returns true if o is a clone.
+    bool isClone(NodeID o) const;
+
+    /// Sets the type (in objToType) of o.
+    void setType(NodeID o, const DIType *t);
+    /// Returns the type (from objToType) of o. Asserts existence.
+    const DIType *getType(NodeID o) const;
+
+    /// Sets the allocation site (in objToAllocation) of o.
+    void setAllocationSite(NodeID o, NodeID site);
+    /// Returns the allocation site (from objToAllocation) of o. Asserts existence.
+    NodeID getAllocationSite(NodeID o) const;
+
+    /// Returns objects that have clones (any key in objToClones).
+    const NodeBS getObjsWithClones(void);
+    /// Add a clone c to object o.
+    void addClone(NodeID o, NodeID c);
+    /// Returns all the clones of o.
+    const NodeBS &getClones(NodeID o);
+
+    // Set o as the original object of clone c.
+    void setOriginalObj(NodeID c, NodeID o);
+    /// Returns the original object c is cloned from. If c is not a clone, returns itself.
+    NodeID getOriginalObj(NodeID c) const;
+
+    /// Returns the filter set of a location. Not const; could create empty PointsTo.
+    PointsTo &getFilterSet(NodeID loc);
+
+    /// Associates gep with base (through objToGeps and memObjToGeps).
+    void addGepToObj(NodeID gep, NodeID base, unsigned offset);
+    /// Returns all gep objects at a particular offset for memory object.
+    /// Not const; could create empty set.
+    const NodeBS &getGepObjsFromMemObj(const MemObj *memObj, unsigned offset);
+    /// Returns all gep objects under an object.
+    /// Not const; could create empty set.
+    const NodeBS &getGepObjs(NodeID base);
+
+    /// Returns the GEP object node(s) of base for ls. This may include clones.
+    /// If there are no GEP objects, then getGepObjVar is called on the SVFIR
+    /// (through base's getGepObjVar) which will create one.
+    const NodeBS getGepObjClones(NodeID base, unsigned offset);
+
+    /// Initialise the pointees of p at loc (which is type tildet *). reuse indicates
+    /// whether reuse is a possibility for this initialisation. Returns whether p changed.
+    bool init(NodeID loc, NodeID p, const DIType *tildet, bool reuse, bool gep=false);
+
+    /// Returns a clone of o with type type. reuse indicates whether we are cloning
+    /// as a result of reuse.
+    NodeID cloneObject(NodeID o, const DIType *type, bool reuse);
+
+    /// Add clone dummy object node to SVFIR.
+    inline NodeID addCloneDummyObjNode(const MemObj *mem);
+    /// Add clone GEP object node to SVFIR.
+    inline NodeID addCloneGepObjNode(const MemObj *mem, const LocationSet &l);
+    /// Add clone FI object node to SVFIR.
+    inline NodeID addCloneFIObjNode(const MemObj *mem);
+
+    /// Returns the ctir type attached to the value, nullptr if non-existant.
+    /// Not static because it needs the DCHG to return the canonical type.
+    /// Not static because we need dchg's getCanonicalType.
+    const DIType *getTypeFromCTirMetadata(const Value *);
+
+    /// Runs tests on MAYALIAS, NOALIAS, etc. built from TBHC_MAYALIAS,
+    /// TBHC_NOALIAS, etc. macros.
+    /// TBHC_XALIAS macros produce:
+    ///   call XALIAS(...)
+    ///   %1 = load ...
+    ///   ...
+    ///   %n = load %p
+    ///   store ... %n-1, ...* %n !ctir !t1
+    ///   call deref()
+    ///   %n+1 = load ...
+    ///   ...
+    ///   %n+n = load %q
+    ///   store ... %n+n-1, ...* %n+n !ctir !t2
+    ///   call deref()
+    /// We want to test the points-to sets of %n and
+    /// %n+n after filtering with !t1 and !t2 respectively.
+    void validateTBHCTests(SVFModule *svfMod);
+
+    /// Dump some statistics we tracked.
+    void dumpStats(void);
+
+private:
+    /// PTA extending this class.
+    BVDataPTAImpl *pta;
+    /// SVFIR the PTA uses. Just a shortcut for getPAG().
+    SVFIR *ppag = nullptr;
+
+    /// Object -> its type.
+    Map<NodeID, const DIType *> objToType;
+    /// Object -> allocation site.
+    /// The value NodeID depends on the pointer analysis (could be
+    /// an SVFG node or SVFIR node for example).
+    Map<NodeID, NodeID> objToAllocation;
+    /// (Original) object -> set of its clones.
+    Map<NodeID, NodeBS> objToClones;
+    /// (Clone) object -> original object (opposite of objToclones).
+    Map<NodeID, NodeID> cloneToOriginalObj;
+    /// Maps nodes (a location like a SVFIR node or SVFG node) to their filter set.
+    Map<NodeID, PointsTo> locToFilterSet;
+    /// Maps objects to the GEP nodes beneath them.
+    Map<NodeID, NodeBS> objToGeps;
+    /// Maps memory objects to their GEP objects. (memobj -> (fieldidx -> geps))
+    Map<const MemObj *, Map<unsigned, NodeBS>> memObjToGeps;
+
+    /// Test whether object is a GEP object. For convenience.
+    bool isGep(const PAGNode *n) const;
+
+    // Bunch of stats to keep track of.
+    unsigned numInit  = 0;
+    unsigned numTBWU  = 0;
+    unsigned numTBSSU = 0;
+    unsigned numTBSU  = 0;
+    unsigned numReuse = 0;
+    unsigned numAgg   = 0;
+
+    // Previous stats but only upon stack/global objects.
+    unsigned numSGInit  = 0;
+    unsigned numSGTBWU  = 0;
+    unsigned numSGTBSSU = 0;
+    unsigned numSGTBSU  = 0;
+    unsigned numSGReuse = 0;
+    unsigned numSGAgg   = 0;
+};
+
+} // End namespace SVF

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-lib",
-  "version": "1.0.973",
+  "version": "1.0.976",
   "description": "SVF's npm support",
   "main": "index.js",
   "scripts": {