svf-tools 1.0.1171 → 1.0.1173

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.1171",
+  "version": "1.0.1173",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/MTA/LockAnalysis.h

@@ -72,13 +72,11 @@ public:
     typedef Map<CxtLock, LockSpan> CxtLockToSpan;
     typedef Map<CxtLock, NodeBS> CxtLockToLockSet;
     typedef Map<const ICFGNode*, NodeBS> LockSiteToLockSet;
-    typedef Map<const ICFGNode*, LockSpan> InstToCxtStmtSet;
+    typedef Map<const ICFGNode*, CxtStmtSet> InstToCxtStmtSet;
     typedef Map<CxtStmt, CxtLockSet> CxtStmtToCxtLockSet;
     typedef FIFOWorkList<CxtLockProc> CxtLockProcVec;
     typedef Set<CxtLockProc> CxtLockProcSet;
 
-    typedef Map<const ICFGNode*, CxtStmtSet> InstToCxtStmt;
-
     LockAnalysis(TCT* t) : tct(t), lockTime(0),numOfTotalQueries(0), numOfLockedQueries(0), lockQueriesTime(0)
     {
     }
@@ -200,12 +198,12 @@ public:
     /// Context-sensitive statement and lock spans
     //@{
     /// Get LockSet and LockSpan
-    inline bool hasCxtStmtfromInst(const ICFGNode* inst) const
+    inline bool hasCxtStmtFromInst(const ICFGNode* inst) const
     {
         InstToCxtStmtSet::const_iterator it = instToCxtStmtSet.find(inst);
         return (it != instToCxtStmtSet.end());
     }
-    inline const CxtStmtSet& getCxtStmtfromInst(const ICFGNode* inst) const
+    inline const CxtStmtSet& getCxtStmtsFromInst(const ICFGNode* inst) const
     {
         InstToCxtStmtSet::const_iterator it = instToCxtStmtSet.find(inst);
         assert(it != instToCxtStmtSet.end());
@@ -271,9 +269,9 @@ public:
     /// Check if one instruction's context stmt is in a lock span
     inline bool hasOneCxtInLockSpan(const ICFGNode *I, LockSpan lspan) const
     {
-        if(!hasCxtStmtfromInst(I))
+        if(!hasCxtStmtFromInst(I))
             return false;
-        const LockSpan ctsset = getCxtStmtfromInst(I);
+        const LockSpan ctsset = getCxtStmtsFromInst(I);
         for (LockSpan::const_iterator cts = ctsset.begin(), ects = ctsset.end(); cts != ects; cts++)
         {
             if(lspan.find(*cts) != lspan.end())
@@ -286,9 +284,9 @@ public:
 
     inline bool hasAllCxtInLockSpan(const ICFGNode *I, LockSpan lspan) const
     {
-        if(!hasCxtStmtfromInst(I))
+        if(!hasCxtStmtFromInst(I))
             return false;
-        const LockSpan ctsset = getCxtStmtfromInst(I);
+        const LockSpan ctsset = getCxtStmtsFromInst(I);
         for (LockSpan::const_iterator cts = ctsset.begin(), ects = ctsset.end(); cts != ects; cts++)
         {
             if (lspan.find(*cts) == lspan.end())
@@ -429,10 +427,15 @@ private:
     }
     //@}
 
+    /// Context helper functions
+    //@{
     /// Push calling context
     void pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee);
     /// Match context
     bool matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee);
+    /// If lhs is a suffix of rhs, including equal
+    bool isContextSuffix(const CallStrCxt& lhs, const CallStrCxt& call);
+    //@}
 
     /// Whether it is a lock site
     inline bool isTDFork(const ICFGNode* call)

package/svf/include/MTA/MHP.h

@@ -96,11 +96,11 @@ public:
     //@{
     inline const NodeBS& getInterleavingThreads(const CxtThreadStmt& cts)
     {
-        return threadStmtToTheadInterLeav[cts];
+        return threadStmtToThreadInterLeav[cts];
     }
     inline bool hasInterleavingThreads(const CxtThreadStmt& cts) const
     {
-        return threadStmtToTheadInterLeav.find(cts)!=threadStmtToTheadInterLeav.end();
+        return threadStmtToThreadInterLeav.find(cts)!=threadStmtToThreadInterLeav.end();
     }
     //@}
 
@@ -154,7 +154,7 @@ private:
     //@{
     inline void addInterleavingThread(const CxtThreadStmt& tgr, NodeID tid)
     {
-        if(threadStmtToTheadInterLeav[tgr].test_and_set(tid))
+        if(threadStmtToThreadInterLeav[tgr].test_and_set(tid))
         {
             instToTSMap[tgr.getStmt()].insert(tgr);
             pushToCTSWorkList(tgr);
@@ -162,7 +162,7 @@ private:
     }
     inline void addInterleavingThread(const CxtThreadStmt& tgr, const CxtThreadStmt& src)
     {
-        bool changed = threadStmtToTheadInterLeav[tgr] |= threadStmtToTheadInterLeav[src];
+        bool changed = threadStmtToThreadInterLeav[tgr] |= threadStmtToThreadInterLeav[src];
         if(changed)
         {
             instToTSMap[tgr.getStmt()].insert(tgr);
@@ -177,7 +177,7 @@ private:
             if(isMustJoin(tgr.getTid(),joinsite))
                 joinedTids.set(*it);
         }
-        if(threadStmtToTheadInterLeav[tgr].intersectWithComplement(joinedTids))
+        if(threadStmtToThreadInterLeav[tgr].intersectWithComplement(joinedTids))
         {
             pushToCTSWorkList(tgr);
         }
@@ -201,16 +201,28 @@ private:
     {
         return tct->getTCTNode(curTid)->isMultiforked();
     }
+
+    /// Context helper functions
+    //@{
     /// Push calling context
     inline void pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
     {
+        /// handle calling context for candidate functions only
+        if(tct->isCandidateFun(call->getFun()) == false)
+            return;
         tct->pushCxt(cxt,call,callee);
     }
     /// Match context
-    inline bool matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
+    inline bool matchAndPopCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
+    {
+        return tct->matchAndPopCxt(cxt,call,callee);
+    }
+    /// If lhs is a suffix of rhs, including equal
+    inline bool isContextSuffix(const CallStrCxt& lhs, const CallStrCxt call)
     {
-        return tct->matchCxt(cxt,call,callee);
+        return tct->isContextSuffix(lhs,call);
     }
+    //@}
 
     /// WorkList helper functions
     //@{
@@ -253,7 +265,7 @@ private:
     TCT* tct;							///< TCT
     ForkJoinAnalysis* fja;				///< ForJoin Analysis
     CxtThreadStmtWorkList cxtStmtList;	///< CxtThreadStmt worklist
-    ThreadStmtToThreadInterleav threadStmtToTheadInterLeav; /// Map a statement to its thread interleavings
+    ThreadStmtToThreadInterleav threadStmtToThreadInterLeav; /// Map a statement to its thread interleavings
     InstToThreadStmtSetMap instToTSMap; ///< Map an instruction to its ThreadStmtSet
     FuncPairToBool nonCandidateFuncMHPRelMap;
 
@@ -290,6 +302,10 @@ public:
     typedef Map<CxtStmt, LoopBBs> CxtStmtToLoopMap;
     typedef FIFOWorkList<CxtStmt> CxtStmtWorkList;
 
+    typedef Set<CxtStmt> CxtStmtSet;
+    typedef Map<const ICFGNode*, CxtStmtSet> InstToCxtStmt;
+
+
     ForkJoinAnalysis(TCT* t) : tct(t)
     {
         collectSCEVInfo();
@@ -337,15 +353,6 @@ public:
         return full && !partial;
     }
 
-    /// Get exit instruction of the start routine function of tid's parent thread
-    inline const ICFGNode* getExitInstOfParentRoutineFun(NodeID tid) const
-    {
-        NodeID parentTid = tct->getParentThread(tid);
-        const CxtThread& parentct = tct->getTCTNode(parentTid)->getCxtThread();
-        const FunObjVar* parentRoutine = tct->getStartRoutineOfCxtThread(parentct);
-        return parentRoutine->getExitBB()->back();
-    }
-
     /// Get loop for join site
     inline LoopBBs& getJoinLoop(const CallICFGNode* inst)
     {
@@ -381,7 +388,7 @@ private:
     /// Whether it is a matched fork join pair
     bool isAliasedForkJoin(const CallICFGNode* forkSite, const CallICFGNode* joinSite)
     {
-        return tct->getPTA()->alias(getForkedThread(forkSite)->getId(), getJoinedThread(joinSite)->getId()) && isSameSCEV(forkSite,joinSite);
+        return tct->getPTA()->alias(getForkedThread(forkSite)->getId(), getJoinedThread(joinSite)->getId());
     }
     /// Mark thread flags for cxtStmt
     //@{
@@ -403,7 +410,11 @@ private:
         ValDomain flag_tgr = getMarkedFlag(tgr);
         cxtStmtToAliveFlagMap[tgr] = flag;
         if(flag_tgr!=getMarkedFlag(tgr))
+        {
+            instToCxtStmt[tgr.getStmt()].insert(tgr);
             pushToCTSWorkList(tgr);
+        }
+
     }
     /// Transfer function for marking context-sensitive statement
     void markCxtStmtFlag(const CxtStmt& tgr, const CxtStmt& src)
@@ -425,6 +436,7 @@ private:
         }
         if(flag_tgr!=getMarkedFlag(tgr))
         {
+            instToCxtStmt[tgr.getStmt()].insert(tgr);
             pushToCTSWorkList(tgr);
         }
     }
@@ -449,16 +461,27 @@ private:
     }
     //@}
 
+    /// Context helper functions
+    //@{
     /// Push calling context
     inline void pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
     {
+        /// handle calling context for candidate functions only
+        if(tct->isCandidateFun(call->getFun()) == false)
+            return;
         tct->pushCxt(cxt,call,callee);
     }
     /// Match context
-    inline bool matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
+    inline bool matchAndPopCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
+    {
+        return tct->matchAndPopCxt(cxt,call,callee);
+    }
+    /// If lhs is a suffix of rhs, including equal
+    inline bool isContextSuffix(const CallStrCxt& lhs, const CallStrCxt call)
     {
-        return tct->matchCxt(cxt,call,callee);
+        return tct->isContextSuffix(lhs,call);
     }
+    //@}
 
     /// Whether it is a fork site
     inline bool isTDFork(const ICFGNode* call)
@@ -524,6 +547,18 @@ private:
     }
     //@}
 
+    /// Get CxtStmtSet for an instruction
+    inline const CxtStmtSet& getCxtStmtsFromInst(const ICFGNode* inst) const
+    {
+        InstToCxtStmt::const_iterator it = instToCxtStmt.find(inst);
+        assert(it!=instToCxtStmt.end() && "no CxtStmt for the instruction?");
+        return it->second;
+    }
+    inline bool hasCxtStmtsFromInst(const ICFGNode* inst) const
+    {
+        return instToCxtStmt.find(inst)!=instToCxtStmt.end();
+    }
+
     /// Add inloop join
     inline void addSymmetricLoopJoin(const CxtStmt& cs, LoopBBs& lp)
     {
@@ -539,6 +574,7 @@ private:
     ThreadPairSet HPPair;		///< threads happen-in-parallel
     ThreadPairSet fullJoin;		///< t1 fully joins t2 along all program path
     ThreadPairSet partialJoin;		///< t1 partially joins t2 along some program path(s)
+    InstToCxtStmt instToCxtStmt;    ///<Map a statement to all its context-sensitive statements
 };
 
 } // End namespace SVF

package/svf/include/MTA/MTA.h

@@ -66,7 +66,7 @@ public:
     /// We start the pass here
     virtual bool runOnModule(SVFIR* module);
     /// Compute MHP
-    virtual MHP* computeMHP();
+    virtual MHP* computeMHP(TCT* tct);
     /// Compute locksets
     virtual LockAnalysis* computeLocksets(TCT* tct);
     /// Perform detection

package/svf/include/MTA/TCT.h

@@ -97,7 +97,7 @@ public:
         SVFUtil::outs() << "---\ntid: " << this->getId() << "  inloop:" << ctx.isInloop() << "  incycle:" << ctx.isIncycle() << " multiforked:"<< isMultiforked();
     }
 
-    /// Get CxtThread
+    /// Get thread creation context, <fork site, call string context>
     inline const CxtThread& getCxtThread() const
     {
         return ctx;
@@ -142,7 +142,7 @@ public:
 
 
 private:
-    const CxtThread ctx;
+    const CxtThread ctx;  /// Thread creation context, <fork site, call string context>
     bool multiforked;
 };
 
@@ -162,7 +162,8 @@ public:
     typedef Set<const ICFGNode*> InstSet;
     typedef Set<const CallGraphNode*> PTACGNodeSet;
     typedef Map<CxtThread,TCTNode*> CxtThreadToNodeMap;
-    typedef Map<CxtThread,CallStrCxt> CxtThreadToForkCxt;
+    typedef Set<std::pair<NodeID, CallStrCxt>> CallStrCxtSet;
+    typedef Map<CxtThread,CallStrCxtSet> CxtThreadToForkCxtSet;
     typedef Map<CxtThread,const FunObjVar*> CxtThreadToFun;
     typedef Map<const ICFGNode*, LoopBBs> InstToLoopMap;
     typedef FIFOWorkList<CxtThreadProc> CxtThreadProcVec;
@@ -172,7 +173,8 @@ public:
     /// Constructor
     TCT(PointerAnalysis* p) :pta(p),TCTNodeNum(0),TCTEdgeNum(0),MaxCxtSize(0)
     {
-        tcg = SVFUtil::cast<ThreadCallGraph>(pta->getCallGraph());
+        tcg = SVFUtil::dyn_cast<ThreadCallGraph>(pta->getCallGraph());
+        assert(tcg != nullptr && "TCT::TCT: call graph is not a ThreadCallGraph!");
         tcg->updateCallGraph(pta);
         //tcg->updateJoinEdge(pta);
         tcgSCC = pta->getCallGraphSCC();
@@ -182,9 +184,7 @@ public:
 
     /// Destructor
     virtual ~TCT()
-    {
-        destroy();
-    }
+    {  }
 
     /// Get TCG
     inline ThreadCallGraph* getThreadCallGraph() const
@@ -310,24 +310,29 @@ public:
         const TCTNode* node = getTCTNode(tid);
         return node->getInEdges().size()==1;
     }
-    /// Get parent thread
-    inline NodeID getParentThread(NodeID tid) const
+    /// Get parent threads
+    inline NodeBS getParentThreads(NodeID tid) const
     {
+        NodeBS parentTds;
         const TCTNode* node = getTCTNode(tid);
-        assert(node->getInEdges().size()<=1 && "should have at most one parent thread");
-        assert(node->getInEdges().size()==1 && "does not have a parent thread");
-        const TCTEdge* edge = *(node->getInEdges().begin());
-        return edge->getSrcID();
+        assert(node->getInEdges().size()>=1 && "does not have a parent thread");
+
+        for (const TCTEdge* edge : node->getInEdges())
+        {
+            parentTds.set(edge->getSrcID());
+        }
+        return parentTds;
     }
     /// Get all ancestor threads
-    const NodeBS getAncestorThread(NodeID tid) const
+    const NodeBS getAncestorThreads(NodeID tid) const
     {
         NodeBS tds;
         if(hasParentThread(tid) == false)
             return tds;
 
         FIFOWorkList<NodeID> worklist;
-        worklist.push(getParentThread(tid));
+        for(NodeID parentTid : getParentThreads(tid))
+            worklist.push(parentTid);
 
         while(!worklist.empty())
         {
@@ -335,7 +340,8 @@ public:
             if(tds.test_and_set(t))
             {
                 if(hasParentThread(t))
-                    worklist.push(getParentThread(t));
+                    for(NodeID parentTid : getParentThreads(t))
+                        worklist.push(parentTid);
             }
         }
         return tds;
@@ -346,24 +352,26 @@ public:
         NodeBS tds;
         if(hasParentThread(tid) == false)
             return tds;
-
-        const TCTNode* node = getTCTNode(getParentThread(tid));
-        for(ThreadCreateEdgeSet::const_iterator it = getChildrenBegin(node), eit = getChildrenEnd(node); it!=eit; ++it)
+        for (NodeID parentTid : getParentThreads(tid))
         {
-            NodeID child = (*it)->getDstNode()->getId();
-            if(child!=tid)
-                tds.set(child);
+            const TCTNode* parentNode = getTCTNode(parentTid);
+            for(ThreadCreateEdgeSet::const_iterator it = getChildrenBegin(parentNode),
+                    eit = getChildrenEnd(parentNode); it!=eit; ++it)
+            {
+                NodeID child = (*it)->getDstNode()->getId();
+                if(child!=tid)
+                    tds.set(child);
+            }
         }
-
         return tds;
     }
     //@}
 
-    /// get the context of a thread at its spawning site (fork site)
-    const CallStrCxt& getCxtOfCxtThread(const CxtThread& ct) const
+    /// get the contexts of a thread at its spawning sites (fork sites)
+    const CallStrCxtSet& getCxtOfCxtThread(const CxtThread& ct) const
     {
-        CxtThreadToForkCxt::const_iterator it = ctToForkCxtMap.find(ct);
-        assert(it!=ctToForkCxtMap.end() && "Cxt Thread not found!!");
+        CxtThreadToForkCxtSet::const_iterator it = ctToForkCxtsMap.find(ct);
+        assert(it!=ctToForkCxtsMap.end() && "Cxt Thread not found!!");
         return it->second;
     }
 
@@ -407,17 +415,16 @@ public:
     /// Get loop for fork/join site
     const LoopBBs& getLoop(const SVFBasicBlock* bb);
 
+    /// Context helper functions
+    //@{
     /// Push calling context
     void pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee);
     /// Match context
-    bool matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee);
+    bool matchAndPopCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee);
+    /// If lhs is a suffix of rhs, including equal
+    bool isContextSuffix(const CallStrCxt& lhs, const CallStrCxt& call);
+    //@}
 
-    inline void pushCxt(CallStrCxt& cxt, CallSiteID csId)
-    {
-        cxt.push_back(csId);
-        if (cxt.size() > MaxCxtSize)
-            MaxCxtSize = cxt.size();
-    }
     /// Whether a join site is in recursion
     inline bool isJoinSiteInRecursion(const CallICFGNode* join) const
     {
@@ -504,7 +511,7 @@ private:
 
     /// Get or create a tct node based on CxtThread
     //@{
-    inline TCTNode* getOrCreateTCTNode(const CallStrCxt& cxt, const ICFGNode* fork,const CallStrCxt& oldCxt, const FunObjVar* routine)
+    inline TCTNode* getOrCreateTCTNode(const CallStrCxt& cxt, const ICFGNode* fork, const CxtThreadProc& forkSiteCtp, const FunObjVar* routine)
     {
         CxtThread ct(cxt,fork);
         CxtThreadToNodeMap::const_iterator it = ctpToNodeMap.find(ct);
@@ -513,7 +520,7 @@ private:
             return it->second;
         }
 
-        addCxtOfCxtThread(oldCxt,ct);
+        addCxtOfCxtThread(forkSiteCtp.getTid(), forkSiteCtp.getContext(), ct);
         addStartRoutineOfCxtThread(routine,ct);
 
         setMultiForkedAttrs(ct);
@@ -540,10 +547,11 @@ private:
     }
 
     /// Add context for a thread at its spawning site (fork site)
-    void addCxtOfCxtThread(const CallStrCxt& cxt, const CxtThread& ct)
+    void addCxtOfCxtThread(NodeID pTid, const CallStrCxt& cxt, const CxtThread& ct)
     {
-        ctToForkCxtMap[ct] = cxt;
+        ctToForkCxtsMap[ct].insert(std::make_pair(pTid, cxt));
     }
+
     /// Add start routine function of a cxt thread
     void addStartRoutineOfCxtThread(const FunObjVar* fun, const CxtThread& ct)
     {
@@ -571,13 +579,6 @@ private:
         return visitedCTPs.find(ctp)!=visitedCTPs.end();
     }
     //@}
-    /// Clean up memory
-    inline void destroy()
-    {
-        if(tcgSCC)
-            delete tcgSCC;
-        tcgSCC=nullptr;
-    }
 
     FunSet entryFuncSet; /// Procedures that are neither called by other functions nor extern functions
     FunSet candidateFuncSet; /// Procedures we care about during call graph traversing when creating TCT
@@ -585,7 +586,7 @@ private:
     CxtThreadProcVec ctpList;	/// CxtThreadProc List
     CxtThreadProcSet visitedCTPs; /// Record all visited ctps
     CxtThreadToNodeMap ctpToNodeMap; /// Map a ctp to its graph node
-    CxtThreadToForkCxt ctToForkCxtMap; /// Map a CxtThread to the context at its spawning site (fork site).
+    CxtThreadToForkCxtSet ctToForkCxtsMap; /// Map a CxtThread to the context at its spawning site (fork site).
     CxtThreadToFun ctToRoutineFunMap; /// Map a CxtThread to its start routine function.
     InstToLoopMap joinSiteToLoopMap; ///< map an inloop join to its loop class
     Set<const ICFGNode*>  inRecurJoinSites;	///< Fork or Join sites in recursions

package/svf/lib/MTA/LockAnalysis.cpp

@@ -376,7 +376,7 @@ void LockAnalysis::analyzeLockSpanCxtStmt()
         {
             handleCall(cts);
         }
-        else if (isRetInstNode(curInst))
+        else if (SVFUtil::dyn_cast<FunExitICFGNode>(curInst))
         {
             handleRet(cts);
         }
@@ -472,10 +472,21 @@ void LockAnalysis::handleRet(const CxtStmt& cts)
             {
                 for(const ICFGEdge* outEdge : curInst->getOutEdges())
                 {
-                    if(outEdge->getDstNode()->getFun() == curInst->getFun())
+                    if(outEdge->getDstNode()->getFun() == inst->getFun())
                     {
-                        CxtStmt newCts(newCxt, outEdge->getDstNode());
-                        markCxtStmtFlag(newCts, cts);
+                        // Iterate over callSite's call string context and use as the successor's context
+                        if (!hasCxtStmtFromInst(*cit))
+                            continue;
+                        for (const CxtStmt& cxtStmt: getCxtStmtsFromInst(*cit))
+                        {
+                            CallStrCxt callSiteCxt = cxtStmt.getContext();
+                            // If new context is a suffix of the call site context
+                            if (isContextSuffix(newCxt, callSiteCxt))
+                            {
+                                CxtStmt newCts(callSiteCxt, outEdge->getDstNode());
+                                markCxtStmtFlag(newCts, cts);
+                            }
+                        }
                     }
                 }
             }
@@ -489,10 +500,21 @@ void LockAnalysis::handleRet(const CxtStmt& cts)
             {
                 for(const ICFGEdge* outEdge : curInst->getOutEdges())
                 {
-                    if(outEdge->getDstNode()->getFun() == curInst->getFun())
+                    if(outEdge->getDstNode()->getFun() == inst->getFun())
                     {
-                        CxtStmt newCts(newCxt, outEdge->getDstNode());
-                        markCxtStmtFlag(newCts, cts);
+                        // Iterate over callSite's call string context and use as the successor's context
+                        if (!hasCxtStmtFromInst(*cit))
+                            continue;
+                        for (const CxtStmt& cxtStmt: getCxtStmtsFromInst(*cit))
+                        {
+                            CallStrCxt callSiteCxt = cxtStmt.getContext();
+                            // If new context is a suffix of the call site context
+                            if (isContextSuffix(newCxt, callSiteCxt))
+                            {
+                                CxtStmt newCts(callSiteCxt, outEdge->getDstNode());
+                                markCxtStmtFlag(newCts, cts);
+                            }
+                        }
                     }
                 }
             }
@@ -517,21 +539,9 @@ void LockAnalysis::handleIntra(const CxtStmt& cts)
     }
 }
 
-
 void LockAnalysis::pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
 {
-    const FunObjVar* svfcaller = call->getFun();
-    CallSiteID csId = getTCG()->getCallSiteID(call, callee);
-
-//    /// handle calling context for candidate functions only
-//    if (isLockCandidateFun(caller) == false)
-//        return;
-
-    if (tct->inSameCallGraphSCC(getTCG()->getCallGraphNode(svfcaller), getTCG()->getCallGraphNode(callee)) == false)
-    {
-        tct->pushCxt(cxt,csId);
-        DBOUT(DMTA, tct->dumpCxt(cxt));
-    }
+    tct->pushCxt(cxt,call,callee);
 }
 
 bool LockAnalysis::matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
@@ -558,6 +568,11 @@ bool LockAnalysis::matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const Fun
     return true;
 }
 
+bool LockAnalysis::isContextSuffix(const CallStrCxt& lhs, const CallStrCxt& call)
+{
+    return tct->isContextSuffix(lhs,call);
+}
+
 
 /*!
  * Protected by at least one common lock under every context
@@ -615,10 +630,10 @@ bool LockAnalysis::isProtectedByCommonCxtLock(const CxtStmt& cxtStmt1, const Cxt
  */
 bool LockAnalysis::isProtectedByCommonCxtLock(const ICFGNode *i1, const ICFGNode *i2)
 {
-    if(!hasCxtStmtfromInst(i1) || !hasCxtStmtfromInst(i2))
+    if(!hasCxtStmtFromInst(i1) || !hasCxtStmtFromInst(i2))
         return false;
-    const CxtStmtSet& ctsset1 = getCxtStmtfromInst(i1);
-    const CxtStmtSet& ctsset2 = getCxtStmtfromInst(i2);
+    const CxtStmtSet& ctsset1 = getCxtStmtsFromInst(i1);
+    const CxtStmtSet& ctsset2 = getCxtStmtsFromInst(i2);
     for (CxtStmtSet::const_iterator cts1 = ctsset1.begin(), ects1 = ctsset1.end(); cts1 != ects1; cts1++)
     {
         const CxtStmt& cxtStmt1 = *cts1;
@@ -689,10 +704,10 @@ bool LockAnalysis::isInSameCSSpan(const CxtStmt& cxtStmt1, const CxtStmt& cxtStm
  */
 bool LockAnalysis::isInSameCSSpan(const ICFGNode *I1, const ICFGNode *I2) const
 {
-    if(!hasCxtStmtfromInst(I1) || !hasCxtStmtfromInst(I2))
+    if(!hasCxtStmtFromInst(I1) || !hasCxtStmtFromInst(I2))
         return false;
-    const CxtStmtSet& ctsset1 = getCxtStmtfromInst(I1);
-    const CxtStmtSet& ctsset2 = getCxtStmtfromInst(I2);
+    const CxtStmtSet& ctsset1 = getCxtStmtsFromInst(I1);
+    const CxtStmtSet& ctsset2 = getCxtStmtsFromInst(I2);
 
     for (CxtStmtSet::const_iterator cts1 = ctsset1.begin(), ects1 = ctsset1.end(); cts1 != ects1; cts1++)
     {

package/svf/lib/MTA/MHP.cpp

@@ -115,11 +115,8 @@ void MHP::analyzeInterleaving()
                 else if (tct->isCallSite(curInst) && !tct->isExtCall(curInst))
                 {
                     handleCall(cts, rootTid);
-                    CallGraph::FunctionSet callees;
-                    if (!tct->isCandidateFun(getCallee(SVFUtil::cast<CallICFGNode>(curInst), callees)))
-                        handleIntra(cts);
                 }
-                else if (isRetInstNode(curInst))
+                else if (SVFUtil::dyn_cast<FunExitICFGNode>(curInst))
                 {
                     handleRet(cts);
                 }
@@ -167,7 +164,7 @@ void MHP::updateNonCandidateFunInterleaving()
                         if (curNode == entryNode)
                             continue;
                         CxtThreadStmt newCts(cts.getTid(), curCxt, curNode);
-                        threadStmtToTheadInterLeav[newCts] |= threadStmtToTheadInterLeav[cts];
+                        threadStmtToThreadInterLeav[newCts] |= threadStmtToThreadInterLeav[cts];
                         instToTSMap[curNode].insert(newCts);
                     }
                 }
@@ -312,6 +309,23 @@ void MHP::handleCall(const CxtThreadStmt& cts, NodeID rootTid)
             addInterleavingThread(newCts, cts);
         }
     }
+
+    /// Propagate to the return site of the call instruction,
+    /// only if the callee is a non-candidate function, while for candidate function,
+    /// return site should be handled after the callee is handled.
+    if (const CallICFGNode *callSite = SVFUtil::cast<CallICFGNode>(call))
+    {
+        CallGraph::FunctionSet callees;
+        if (!tct->isCandidateFun(getCallee(callSite, callees)))
+        {
+            CxtThreadStmt newCts(cts.getTid(), cts.getContext(), callSite->getRetICFGNode());
+            addInterleavingThread(newCts, cts);
+        }
+    }
+    else
+    {
+        assert(false && "cts.getStmt() is not a CallICFGNode!");
+    }
 }
 
 /*!
@@ -329,14 +343,25 @@ void MHP::handleRet(const CxtThreadStmt& cts)
                 cit != ecit; ++cit)
         {
             CallStrCxt newCxt = cts.getContext();
-            if (matchCxt(newCxt, *cit, curFunNode->getFunction()))
+            if (matchAndPopCxt(newCxt, *cit, curFunNode->getFunction()))
             {
                 for(const ICFGEdge* outEdge : cts.getStmt()->getOutEdges())
                 {
-                    if(outEdge->getDstNode()->getFun() == cts.getStmt()->getFun())
+                    if(outEdge->getDstNode()->getFun() == (*cit)->getFun())
                     {
-                        CxtThreadStmt newCts(cts.getTid(), newCxt, outEdge->getDstNode());
-                        addInterleavingThread(newCts, cts);
+                        // Iterate over callSite's call string context and use as the successor's context
+                        if (!hasThreadStmtSet(*cit))
+                            continue;
+                        for (const CxtThreadStmt& cxtThreadStmt: getThreadStmtSet(*cit))
+                        {
+                            CallStrCxt callSiteCxt = cxtThreadStmt.getContext();
+                            // If new context is a suffix of the call site context
+                            if (isContextSuffix(newCxt, callSiteCxt))
+                            {
+                                CxtThreadStmt newCts(cts.getTid(), callSiteCxt, outEdge->getDstNode());
+                                addInterleavingThread(newCts, cts);
+                            }
+                        }
                     }
                 }
             }
@@ -346,14 +371,25 @@ void MHP::handleRet(const CxtThreadStmt& cts)
                 cit != ecit; ++cit)
         {
             CallStrCxt newCxt = cts.getContext();
-            if (matchCxt(newCxt, *cit, curFunNode->getFunction()))
+            if (matchAndPopCxt(newCxt, *cit, curFunNode->getFunction()))
             {
                 for(const ICFGEdge* outEdge : cts.getStmt()->getOutEdges())
                 {
-                    if(outEdge->getDstNode()->getFun() == cts.getStmt()->getFun())
+                    if(outEdge->getDstNode()->getFun() == (*cit)->getFun())
                     {
-                        CxtThreadStmt newCts(cts.getTid(), newCxt, outEdge->getDstNode());
-                        addInterleavingThread(newCts, cts);
+                        // Iterate over callSite's call string context and use as the successor's context
+                        if (!hasThreadStmtSet(*cit))
+                            continue;
+                        for (const CxtThreadStmt& cxtThreadStmt: getThreadStmtSet(*cit))
+                        {
+                            CallStrCxt callSiteCxt = cxtThreadStmt.getContext();
+                            // If new context is a suffix of the call site context
+                            if (isContextSuffix(newCxt, callSiteCxt))
+                            {
+                                CxtThreadStmt newCts(cts.getTid(), callSiteCxt, outEdge->getDstNode());
+                                addInterleavingThread(newCts, cts);
+                            }
+                        }
                     }
                 }
             }
@@ -366,7 +402,6 @@ void MHP::handleRet(const CxtThreadStmt& cts)
  */
 void MHP::handleIntra(const CxtThreadStmt& cts)
 {
-
     for(const ICFGEdge* outEdge : cts.getStmt()->getOutEdges())
     {
         if(outEdge->getDstNode()->getFun() == cts.getStmt()->getFun())
@@ -382,24 +417,27 @@ void MHP::handleIntra(const CxtThreadStmt& cts)
  */
 void MHP::updateAncestorThreads(NodeID curTid)
 {
-    NodeBS tds = tct->getAncestorThread(curTid);
+    NodeBS ancestorAndSelfTids = tct->getAncestorThreads(curTid);
     DBOUT(DMTA, outs() << "##Ancestor thread of " << curTid << " is : ");
     DBOUT(DMTA, dumpSet(tds));
     DBOUT(DMTA, outs() << "\n");
-    tds.set(curTid);
+    ancestorAndSelfTids.set(curTid);
 
-    for (const unsigned i : tds)
+    for (const unsigned tid : ancestorAndSelfTids)
     {
-        const CxtThread& ct = tct->getTCTNode(i)->getCxtThread();
+        const CxtThread& ct = tct->getTCTNode(tid)->getCxtThread();
         if (const ICFGNode* forkInst = ct.getThread())
         {
-            CallStrCxt forkSiteCxt = tct->getCxtOfCxtThread(ct);
             for(const ICFGEdge* outEdge : forkInst->getOutEdges())
             {
+                // Ensure dst node is in the same function as forkInst
                 if(outEdge->getDstNode()->getFun() == forkInst->getFun())
                 {
-                    CxtThreadStmt cts(tct->getParentThread(i), forkSiteCxt, outEdge->getDstNode());
-                    addInterleavingThread(cts, curTid);
+                    for (const auto& forkSiteCxt : tct->getCxtOfCxtThread(ct))
+                    {
+                        CxtThreadStmt cts(forkSiteCxt.first, forkSiteCxt.second, outEdge->getDstNode());
+                        addInterleavingThread(cts, curTid);
+                    }
                 }
             }
         }
@@ -418,9 +456,9 @@ void MHP::updateAncestorThreads(NodeID curTid)
  */
 void MHP::updateSiblingThreads(NodeID curTid)
 {
-    NodeBS tds = tct->getAncestorThread(curTid);
-    tds.set(curTid);
-    for (const unsigned tid : tds)
+    NodeBS ancestorAndSelfTids = tct->getAncestorThreads(curTid);
+    ancestorAndSelfTids.set(curTid);
+    for (const unsigned tid : ancestorAndSelfTids)
     {
         NodeBS siblingTds = tct->getSiblingThread(tid);
         for (const unsigned stid : siblingTds)
@@ -647,7 +685,7 @@ bool MHP::executedByTheSameThread(const ICFGNode* i1, const ICFGNode* i2)
  */
 void MHP::printInterleaving()
 {
-    for (const auto& pair : threadStmtToTheadInterLeav)
+    for (const auto& pair : threadStmtToThreadInterLeav)
     {
         outs() << "( t" << pair.first.getTid()
                << pair.first.getStmt()->toString() << " ) ==> [";
@@ -728,15 +766,16 @@ void ForkJoinAnalysis::analyzeForkJoinPair()
         clearFlagMap();
         if (const ICFGNode* forkInst = ct.getThread())
         {
-            CallStrCxt forkSiteCxt = tct->getCxtOfCxtThread(ct);
-            const ICFGNode* exitInst = getExitInstOfParentRoutineFun(rootTid);
-
+            /// Start from the instruction next to the fork site
             for(const ICFGEdge* outEdge : forkInst->getOutEdges())
             {
                 if(outEdge->getDstNode()->getFun() == forkInst->getFun())
                 {
-                    CxtStmt newCts(forkSiteCxt, outEdge->getDstNode());
-                    markCxtStmtFlag(newCts, TDAlive);
+                    for (const auto& forkSiteCxt : tct->getCxtOfCxtThread(ct))
+                    {
+                        CxtStmt newCts(forkSiteCxt.second, outEdge->getDstNode());
+                        markCxtStmtFlag(newCts, TDAlive);
+                    }
                 }
             }
 
@@ -756,12 +795,25 @@ void ForkJoinAnalysis::analyzeForkJoinPair()
                 {
                     handleJoin(cts, rootTid);
                 }
-                else if (tct->isCallSite(curInst) && tct->isCandidateFun(getCallee(curInst, callees)))
+                else if (tct->isCallSite(curInst) && !tct->isExtCall(curInst))
                 {
-
-                    handleCall(cts, rootTid);
+                    /// Propagate to the return site of the call instruction,
+                    /// only if the callee is a non-candidate function, while for candidate function,
+                    /// return site should be handled after the callee is handled.
+                    const CallICFGNode *callSite = SVFUtil::cast<CallICFGNode>(curInst);
+                    CallGraph::FunctionSet callees;
+                    if (!tct->isCandidateFun(getCallee(callSite, callees)))
+                    {
+                        // Do not dive into non-candidate functions
+                        CxtStmt newCts(cts.getContext(), callSite->getRetICFGNode());
+                        markCxtStmtFlag(newCts, cts);
+                    }
+                    else
+                    {
+                        handleCall(cts, rootTid);
+                    }
                 }
-                else if (isRetInstNode(curInst))
+                else if (SVFUtil::dyn_cast<FunExitICFGNode>(curInst))
                 {
                     handleRet(cts);
                 }
@@ -770,12 +822,20 @@ void ForkJoinAnalysis::analyzeForkJoinPair()
                     handleIntra(cts);
                 }
 
-                if (curInst == exitInst)
+                /// If the current instruction is an exit instruction of the start routine of
+                /// a parent context thread, we need to update the join information the parent
+                /// context thread.
+                for (NodeID parentTid : tct->getParentThreads(rootTid))
                 {
-                    if (getMarkedFlag(cts) != TDAlive)
-                        addToFullJoin(tct->getParentThread(rootTid), rootTid);
-                    else
-                        addToPartial(tct->getParentThread(rootTid), rootTid);
+                    const CxtThread& parentCxtThread = tct->getTCTNode(parentTid)->getCxtThread();
+                    const FunObjVar* parentRoutine = tct->getStartRoutineOfCxtThread(parentCxtThread);
+                    if (curInst == parentRoutine->getExitBB()->back())
+                    {
+                        if (getMarkedFlag(cts) != TDAlive)
+                            addToFullJoin(parentTid, rootTid);
+                        else
+                            addToPartial(parentTid, rootTid);
+                    }
                 }
             }
         }
@@ -822,9 +882,12 @@ void ForkJoinAnalysis::handleJoin(const CxtStmt& cts, NodeID rootTid)
         const ICFGNode* forkSite = tct->getTCTNode(rootTid)->getCxtThread().getThread();
         const ICFGNode* joinSite = cts.getStmt();
 
-        if (isAliasedForkJoin(SVFUtil::cast<CallICFGNode>(forkSite), SVFUtil::cast<CallICFGNode>(joinSite)))
+        if (hasJoinLoop(SVFUtil::cast<CallICFGNode>(joinSite)))
         {
-            if (hasJoinLoop(SVFUtil::cast<CallICFGNode>(joinSite)))
+            if (isAliasedForkJoin(SVFUtil::cast<CallICFGNode>(forkSite),
+                                SVFUtil::cast<CallICFGNode>(joinSite)) &&
+                    isSameSCEV(forkSite,joinSite)
+                )
             {
                 LoopBBs& joinLoop = getJoinLoop(SVFUtil::cast<CallICFGNode>(joinSite));
                 std::vector<const SVFBasicBlock *> exitbbs;
@@ -845,18 +908,9 @@ void ForkJoinAnalysis::handleJoin(const CxtStmt& cts, NodeID rootTid)
                         markCxtStmtFlag(cts, TDAlive);
                 }
             }
+            /// for the join site in a loop loop which does not join the current thread
+            /// we process the loop exit
             else
-            {
-                markCxtStmtFlag(cts, TDDead);
-                addDirectlyJoinTID(cts, rootTid);
-                DBOUT(DMTA, outs() << "\n\t match join site " << call->toString() << "for thread " << rootTid << "\n");
-            }
-        }
-        /// for the join site in a loop loop which does not join the current thread
-        /// we process the loop exit
-        else
-        {
-            if (hasJoinLoop(SVFUtil::cast<CallICFGNode>(joinSite)))
             {
                 std::vector<const SVFBasicBlock*> exitbbs;
                 joinSite->getFun()->getExitBlocksOfLoop(joinSite->getBB(), exitbbs);
@@ -870,6 +924,16 @@ void ForkJoinAnalysis::handleJoin(const CxtStmt& cts, NodeID rootTid)
                 }
             }
         }
+        else
+        {
+            if (isAliasedForkJoin(SVFUtil::cast<CallICFGNode>(forkSite),
+                                SVFUtil::cast<CallICFGNode>(joinSite)))
+            {
+                markCxtStmtFlag(cts, TDDead);
+                addDirectlyJoinTID(cts, rootTid);
+                DBOUT(DMTA, outs() << "\n\t match join site " << call->toString() << "for thread " << rootTid << "\n");
+            }
+        }
     }
     handleIntra(cts);
 }
@@ -916,14 +980,25 @@ void ForkJoinAnalysis::handleRet(const CxtStmt& cts)
         {
             CallStrCxt newCxt = curCxt;
             const ICFGNode* curNode = (*cit);
-            if (matchCxt(newCxt, SVFUtil::cast<CallICFGNode>(curNode), curFunNode->getFunction()))
+            if (matchAndPopCxt(newCxt, SVFUtil::cast<CallICFGNode>(curNode), curFunNode->getFunction()))
             {
                 for(const ICFGEdge* outEdge : curNode->getOutEdges())
                 {
                     if(outEdge->getDstNode()->getFun() == curNode->getFun())
                     {
-                        CxtStmt newCts(newCxt, outEdge->getDstNode());
-                        markCxtStmtFlag(newCts, cts);
+                        // Iterate over callSite's call string context and use as the successor's context
+                        if (!hasCxtStmtsFromInst(*cit))
+                            continue;
+                        for (const CxtStmt& cxtStmt: getCxtStmtsFromInst(*cit))
+                        {
+                            CallStrCxt callSiteCxt = cxtStmt.getContext();
+                            // If new context is a suffix of the call site context
+                            if (isContextSuffix(newCxt, callSiteCxt))
+                            {
+                                CxtStmt newCts(callSiteCxt, outEdge->getDstNode());
+                                markCxtStmtFlag(newCts, cts);
+                            }
+                        }
                     }
                 }
             }
@@ -935,14 +1010,25 @@ void ForkJoinAnalysis::handleRet(const CxtStmt& cts)
             CallStrCxt newCxt = curCxt;
             const ICFGNode* curNode = (*cit);
 
-            if (matchCxt(newCxt, SVFUtil::cast<CallICFGNode>(curNode), curFunNode->getFunction()))
+            if (matchAndPopCxt(newCxt, SVFUtil::cast<CallICFGNode>(curNode), curFunNode->getFunction()))
             {
                 for(const ICFGEdge* outEdge : curNode->getOutEdges())
                 {
                     if(outEdge->getDstNode()->getFun() == curNode->getFun())
                     {
-                        CxtStmt newCts(newCxt, outEdge->getDstNode());
-                        markCxtStmtFlag(newCts, cts);
+                        // Iterate over callSite's call string context and use as the successor's context
+                        if (!hasCxtStmtsFromInst(*cit))
+                            continue;
+                        for (const CxtStmt& cxtStmt: getCxtStmtsFromInst(*cit))
+                        {
+                            CallStrCxt callSiteCxt = cxtStmt.getContext();
+                            // If new context is a suffix of the call site context
+                            if (isContextSuffix(newCxt, callSiteCxt))
+                            {
+                                CxtStmt newCts(callSiteCxt, outEdge->getDstNode());
+                                markCxtStmtFlag(newCts, cts);
+                            }
+                        }
                     }
                 }
             }

package/svf/lib/MTA/MTA.cpp

@@ -49,8 +49,7 @@ MTA::~MTA()
 {
     if (tcg)
         delete tcg;
-    //if (tct)
-    //    delete tct;
+
     delete mhp;
     delete lsa;
 }
@@ -60,33 +59,12 @@ MTA::~MTA()
  */
 bool MTA::runOnModule(SVFIR* pag)
 {
-    mhp = computeMHP();
-    lsa = computeLocksets(mhp->getTCT());
-
-    if(Options::RaceCheck())
-        detect();
-
-    return false;
-}
-
-/*!
- * Compute lock sets
- */
-LockAnalysis* MTA::computeLocksets(TCT* tct)
-{
-    LockAnalysis* lsa = new LockAnalysis(tct);
-    lsa->analyze();
-    return lsa;
-}
-
-MHP* MTA::computeMHP()
-{
-
     DBOUT(DGENERAL, outs() << pasMsg("MTA analysis\n"));
     DBOUT(DMTA, outs() << pasMsg("MTA analysis\n"));
-    SVFIR* pag = PAG::getPAG();
+
     PointerAnalysis* pta = AndersenWaveDiff::createAndersenWaveDiff(pag);
     pta->getCallGraph()->dump("ptacg");
+    pag->getICFG()->updateCallGraph(pta->getCallGraph());
 
     DBOUT(DGENERAL, outs() << pasMsg("Build TCT\n"));
     DBOUT(DMTA, outs() << pasMsg("Build TCT\n"));
@@ -104,11 +82,32 @@ MHP* MTA::computeMHP()
 
     tcg->dump("tcg");
 
+    mhp = computeMHP(tct.get());
+    lsa = computeLocksets(tct.get());
+
+    if(Options::RaceCheck())
+        detect();
+
+    return false;
+}
+
+/*!
+ * Compute lock sets
+ */
+LockAnalysis* MTA::computeLocksets(TCT* tct)
+{
+    LockAnalysis* lsa = new LockAnalysis(tct);
+    lsa->analyze();
+    return lsa;
+}
+
+MHP* MTA::computeMHP(TCT* tct)
+{
     DBOUT(DGENERAL, outs() << pasMsg("MHP analysis\n"));
     DBOUT(DMTA, outs() << pasMsg("MHP analysis\n"));
 
     DOTIMESTAT(double mhpStart = stat->getClk());
-    MHP* mhp = new MHP(tct.get());
+    MHP* mhp = new MHP(tct);
     mhp->analyze();
     DOTIMESTAT(double mhpEnd = stat->getClk());
     DOTIMESTAT(stat->MHPTime += (mhpEnd - mhpStart) / TIMEINTERVAL);

package/svf/lib/MTA/TCT.cpp

@@ -156,7 +156,7 @@ void TCT::markRelProcs()
 }
 
 /*!
- *
+ * Add relevant procedures that are backward reachable from svffun on Thread Call Graph
  */
 void TCT::markRelProcs(const FunObjVar* svffun)
 {
@@ -182,7 +182,7 @@ void TCT::markRelProcs(const FunObjVar* svffun)
 }
 
 /*!
- * Get Main function
+ * Get entry function, i.e., functions without callers, e.g., main function
  */
 void TCT::collectEntryFunInCallGraph()
 {
@@ -249,7 +249,10 @@ void TCT::handleCallRelation(CxtThreadProc& ctp, const CallGraphEdge* cgEdge, co
     CallStrCxt cxt(ctp.getContext());
     CallStrCxt oldCxt = cxt;
     const CallICFGNode* callNode = cs;
-    pushCxt(cxt,callNode,callee);
+
+    /// handle calling context for candidate functions only
+    if(isCandidateFun(callNode->getFun()) == true)
+        pushCxt(cxt,callNode,callee);
 
     if(cgEdge->getEdgeKind() == CallGraphEdge::CallRetEdge)
     {
@@ -264,7 +267,7 @@ void TCT::handleCallRelation(CxtThreadProc& ctp, const CallGraphEdge* cgEdge, co
     else if(cgEdge->getEdgeKind() == CallGraphEdge::TDForkEdge)
     {
         /// Create spawnee TCT node
-        TCTNode* spawneeNode = getOrCreateTCTNode(cxt,callNode, oldCxt, callee);
+        TCTNode* spawneeNode = getOrCreateTCTNode(cxt,callNode, ctp, callee);
         CxtThreadProc newctp(spawneeNode->getId(),cxt,callee);
 
         if(pushToCTPWorkList(newctp))
@@ -398,7 +401,8 @@ void TCT::build()
         if (!isCandidateFun(*it))
             continue;
         CallStrCxt cxt;
-        TCTNode* mainTCTNode = getOrCreateTCTNode(cxt, nullptr, cxt, *it);
+        CxtThreadProc dummyCtp(-1, cxt, nullptr);
+        TCTNode* mainTCTNode = getOrCreateTCTNode(cxt, nullptr, dummyCtp, *it);
         CxtThreadProc t(mainTCTNode->getId(), cxt, *it);
         pushToCTPWorkList(t);
     }
@@ -440,21 +444,20 @@ void TCT::build()
 }
 
 /*!
- * Push calling context
+ * Push calling context, with k limiting
  */
 void TCT::pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
 {
-
     const FunObjVar* caller = call->getFun();
     CallSiteID csId = tcg->getCallSiteID(call, callee);
 
-    /// handle calling context for candidate functions only
-    if(isCandidateFun(caller) == false)
-        return;
-
     if(inSameCallGraphSCC(tcg->getCallGraphNode(caller),tcg->getCallGraphNode(callee))==false)
     {
-        pushCxt(cxt,csId);
+        cxt.push_back(csId);
+        if (cxt.size() > Options::MaxContextLen())
+            cxt.erase(cxt.begin());
+        if (cxt.size() > MaxCxtSize)
+            MaxCxtSize = cxt.size();
         DBOUT(DMTA,dumpCxt(cxt));
     }
 }
@@ -463,9 +466,8 @@ void TCT::pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* ca
 /*!
  * Match calling context
  */
-bool TCT::matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
+bool TCT::matchAndPopCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee)
 {
-
     const FunObjVar* caller = call->getFun();
     CallSiteID csId = tcg->getCallSiteID(call, callee);
 
@@ -489,6 +491,25 @@ bool TCT::matchCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* c
     return true;
 }
 
+/*!
+ * If lhs is a suffix of rhs, including equal
+ */
+bool TCT::isContextSuffix(const CallStrCxt& lhs, const CallStrCxt& call)
+{
+    if (lhs.size() > call.size())
+        return false;
+    bool isSuffix = true;
+    for (size_t i = 0; i < lhs.size(); ++i)
+    {
+        if (lhs[lhs.size() - 1 - i] != call[call.size() - 1 - i])
+        {
+            isSuffix = false;
+            break;
+        }
+    }
+    return isSuffix;
+}
+
 
 /*!
  * Dump calling context information
@@ -513,8 +534,7 @@ void TCT::dumpCxt(CallStrCxt& cxt)
  */
 void TCT::dump(const std::string& filename)
 {
-    if (Options::TCTDotGraph())
-        GraphPrinter::WriteGraphToFile(outs(), filename, this);
+    GraphPrinter::WriteGraphToFile(outs(), filename, this);
 }
 
 /*!