svf-tools 1.0.317 → 1.0.321

package/lib/Graphs/CHG.cpp

@@ -0,0 +1,280 @@
+//===----- CHG.cpp  Base class of pointer analyses ---------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * CHG.cpp (previously CHA.cpp)
+ *
+ *  Created on: Apr 13, 2016
+ *      Author: Xiaokang Fan
+ */
+
+#include "Graphs/CHG.h"
+#include "Util/SVFUtil.h"
+#include "SVF-FE/CPPUtil.h"
+
+using namespace SVF;
+using namespace SVFUtil;
+using namespace std;
+
+static bool hasEdge(const CHNode *src, const CHNode *dst,
+                    CHEdge::CHEDGETYPE et)
+{
+    for (CHEdge::CHEdgeSetTy::const_iterator it = src->getOutEdges().begin(),
+            eit = src->getOutEdges().end(); it != eit; ++it)
+    {
+        CHNode *node = (*it)->getDstNode();
+        CHEdge::CHEDGETYPE edgeType = (*it)->getEdgeType();
+        if (node == dst && edgeType == et)
+            return true;
+    }
+    return false;
+}
+
+static bool checkArgTypes(CallSite cs, const Function *fn) {
+
+    // here we skip the first argument (i.e., this pointer)
+    u32_t arg_size = (fn->arg_size() > cs.arg_size()) ? cs.arg_size(): fn->arg_size();
+    if(arg_size > 1){
+        for (unsigned i = 1; i < arg_size; i++) {
+            auto cs_arg = cs.getArgOperand(i);
+            auto fn_arg = fn->getArg(i);
+            if (cs_arg->getType() != fn_arg->getType()) {
+                return false;
+            }
+        }
+    }
+
+    return true;
+}
+
+void CHGraph::addEdge(const string className, const string baseClassName,
+                      CHEdge::CHEDGETYPE edgeType)
+{
+    CHNode *srcNode = getNode(className);
+    CHNode *dstNode = getNode(baseClassName);
+    assert(srcNode && dstNode && "node not found?");
+
+    if (!hasEdge(srcNode, dstNode, edgeType))
+    {
+        CHEdge *edge = new CHEdge(srcNode, dstNode, edgeType);
+        srcNode->addOutgoingEdge(edge);
+        dstNode->addIncomingEdge(edge);
+    }
+}
+
+CHNode *CHGraph::getNode(const string name) const
+{
+    auto chNode = classNameToNodeMap.find(name);
+    if (chNode != classNameToNodeMap.end()) return chNode->second;
+    else return nullptr;
+}
+
+
+/*
+ * Get virtual functions for callsite "cs" based on vtbls (calculated
+ * based on pointsto set)
+ */
+void CHGraph::getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &virtualFunctions)
+{
+
+    /// get target virtual functions
+    size_t idx = cppUtil::getVCallIdx(cs);
+    /// get the function name of the virtual callsite
+    string funName = cppUtil::getFunNameOfVCallSite(cs);
+    for (const GlobalValue *vt : vtbls)
+    {
+        const CHNode *child = getNode(cppUtil::getClassNameFromVtblObj(vt));
+        if (child == nullptr)
+            continue;
+        CHNode::FuncVector vfns;
+        child->getVirtualFunctions(idx, vfns);
+        for (CHNode::FuncVector::const_iterator fit = vfns.begin(),
+                feit = vfns.end(); fit != feit; ++fit)
+        {
+            const SVFFunction* callee = *fit;
+            if (cs.arg_size() == callee->arg_size() ||
+                    (cs.getFunctionType()->isVarArg() && callee->isVarArg()))
+            {
+
+                // if argument types do not match
+                // skip this one
+                if (!checkArgTypes(cs, callee->getLLVMFun()))
+                    continue;
+
+                cppUtil::DemangledName dname = cppUtil::demangle(callee->getName().str());
+                string calleeName = dname.funcName;
+
+                /*
+                 * The compiler will add some special suffix (e.g.,
+                 * "[abi:cxx11]") to the end of some virtual function:
+                 * In dealII
+                 * function: FE_Q<3>::get_name
+                 * will be mangled as: _ZNK4FE_QILi3EE8get_nameB5cxx11Ev
+                 * after demangling: FE_Q<3>::get_name[abi:cxx11]
+                 * The special suffix ("[abi:cxx11]") needs to be removed
+                 */
+                const std::string suffix("[abi:cxx11]");
+                size_t suffix_pos = calleeName.rfind(suffix);
+                if (suffix_pos != string::npos)
+                    calleeName.erase(suffix_pos, suffix.size());
+
+                /*
+                 * if we can't get the function name of a virtual callsite, all virtual
+                 * functions calculated by idx will be valid
+                 */
+                if (funName.size() == 0)
+                {
+                    virtualFunctions.insert(callee);
+                }
+                else if (funName[0] == '~')
+                {
+                    /*
+                     * if the virtual callsite is calling a destructor, then all
+                     * destructors in the ch will be valid
+                     * class A { virtual ~A(){} };
+                     * class B: public A { virtual ~B(){} };
+                     * int main() {
+                     *   A *a = new B;
+                     *   delete a;  /// the function name of this virtual callsite is ~A()
+                     * }
+                     */
+                    if (calleeName[0] == '~')
+                    {
+                        virtualFunctions.insert(callee);
+                    }
+                }
+                else
+                {
+                    /*
+                     * for other virtual function calls, the function name of the callsite
+                     * and the function name of the target callee should match exactly
+                     */
+                    if (funName.compare(calleeName) == 0)
+                    {
+                        virtualFunctions.insert(callee);
+                    }
+                }
+            }
+        }
+    }
+}
+
+
+void CHNode::getVirtualFunctions(u32_t idx, FuncVector &virtualFunctions) const
+{
+    for (vector<FuncVector>::const_iterator it = virtualFunctionVectors.begin(),
+            eit = virtualFunctionVectors.end(); it != eit; ++it)
+    {
+        if ((*it).size() > idx)
+            virtualFunctions.push_back((*it)[idx]);
+    }
+}
+
+void CHGraph::printCH()
+{
+    for (CHGraph::const_iterator it = this->begin(), eit = this->end();
+            it != eit; ++it)
+    {
+        const CHNode *node = it->second;
+        outs() << "class: " << node->getName() << "\n";
+        for (CHEdge::CHEdgeSetTy::const_iterator it = node->OutEdgeBegin();
+                it != node->OutEdgeEnd(); ++it)
+        {
+            if ((*it)->getEdgeType() == CHEdge::INHERITANCE)
+                outs() << (*it)->getDstNode()->getName() << " --inheritance--> "
+                       << (*it)->getSrcNode()->getName() << "\n";
+            else
+                outs() << (*it)->getSrcNode()->getName() << " --instance--> "
+                       << (*it)->getDstNode()->getName() << "\n";
+        }
+    }
+    outs() << '\n';
+}
+
+/*!
+ * Dump call graph into dot file
+ */
+void CHGraph::dump(const std::string& filename)
+{
+    GraphPrinter::WriteGraphToFile(outs(), filename, this);
+    printCH();
+}
+
+void CHGraph::view()
+{
+    llvm::ViewGraph(this, "Class Hierarchy Graph");
+}
+
+namespace llvm
+{
+
+/*!
+ * Write value flow graph into dot file for debugging
+ */
+template<>
+struct DOTGraphTraits<CHGraph*> : public DefaultDOTGraphTraits
+{
+
+    typedef CHNode NodeType;
+    DOTGraphTraits(bool isSimple = false) :
+        DefaultDOTGraphTraits(isSimple)
+    {
+    }
+
+    /// Return name of the graph
+    static std::string getGraphName(CHGraph*)
+    {
+        return "Class Hierarchy Graph";
+    }
+    /// Return function name;
+    static std::string getNodeLabel(CHNode *node, CHGraph*)
+    {
+        return node->getName();
+    }
+
+    static std::string getNodeAttributes(CHNode *node, CHGraph*)
+    {
+        if (node->isPureAbstract())
+        {
+            return "shape=tab";
+        }
+        else
+            return "shape=box";
+    }
+
+    template<class EdgeIter>
+    static std::string getEdgeAttributes(CHNode*, EdgeIter EI, CHGraph*)
+    {
+
+        CHEdge* edge = *(EI.getCurrent());
+        assert(edge && "No edge found!!");
+        if (edge->getEdgeType() == CHEdge::INHERITANCE)
+        {
+            return "style=solid";
+        }
+        else
+        {
+            return "style=dashed";
+        }
+    }
+};
+} // End namespace llvm

package/lib/Graphs/ConsG.cpp

@@ -65,6 +65,15 @@ void ConstraintGraph::buildCG()
         addCopyCGEdge(edge->getSrcID(),edge->getDstID());
     }
 
+    PAGEdge::PAGEdgeSetTy& phis = getPAGEdgeSet(PAGEdge::Phi);
+    for (PAGEdge::PAGEdgeSetTy::iterator iter = phis.begin(), eiter =
+                phis.end(); iter != eiter; ++iter)
+    {
+        const PhiPE* edge = SVFUtil::cast<PhiPE>(*iter);
+        for(const auto opVar : edge->getOpndVars())
+            addCopyCGEdge(opVar->getId(),edge->getResID());
+    }
+
     PAGEdge::PAGEdgeSetTy& calls = getPAGEdgeSet(PAGEdge::Call);
     for (PAGEdge::PAGEdgeSetTy::iterator iter = calls.begin(), eiter =
                 calls.end(); iter != eiter; ++iter)

package/lib/Graphs/IRGraph.cpp

@@ -48,13 +48,6 @@ bool IRGraph::addEdge(SVFVar* src, SVFVar* dst, SVFStmt* edge)
           << " kind :" << dst->getNodeKind() << "\n");
     src->addOutEdge(edge);
     dst->addInEdge(edge);
-    bool added = PAGEdgeKindToSetMap[edge->getEdgeKind()].insert(edge).second;
-    assert(added && "duplicated edge, not added!!!");
-    if (edge->isPTAEdge())
-    {
-        totalPTAPAGEdge++;
-        PTAPAGEdgeKindToSetMap[edge->getEdgeKind()].insert(edge);
-    }
     return true;
 }
 
@@ -73,7 +66,21 @@ SVFStmt* IRGraph::hasNonlabeledEdge(SVFVar* src, SVFVar* dst, SVFStmt::PEDGEK ki
 }
 
 /*!
- * Return true if it is an inter-procedural edge
+ * Return an MultiOpndStmt if found
+ */
+SVFStmt* IRGraph::hasLabeledEdge(SVFVar* src, SVFVar* op1, SVFStmt::PEDGEK kind, const SVFVar* op2)
+{
+    SVFStmt edge(src,op1,SVFStmt::makeEdgeFlagWithAddionalOpnd(kind,op2));
+    SVFStmt::PAGEdgeSetTy::iterator it = PAGEdgeKindToSetMap[kind].find(&edge);
+    if (it != PAGEdgeKindToSetMap[kind].end())
+    {
+        return *it;
+    }
+    return nullptr;
+}
+
+/*!
+ * Return an inter-procedural edge if found
  */
 SVFStmt* IRGraph::hasLabeledEdge(SVFVar* src, SVFVar* dst, SVFStmt::PEDGEK kind, const ICFGNode* callInst)
 {
@@ -213,6 +220,10 @@ struct DOTGraphTraits<IRGraph*> : public DefaultDOTGraphTraits
         {
             return "color=red";
         }
+        else if (SVFUtil::isa<PhiPE>(edge))
+        {
+            return "color=grey";
+        }
         else if (SVFUtil::isa<CmpPE>(edge))
         {
             return "color=grey";
@@ -225,6 +236,10 @@ struct DOTGraphTraits<IRGraph*> : public DefaultDOTGraphTraits
         {
             return "color=grey";
         }
+        else if (SVFUtil::isa<BranchStmt>(edge))
+        {
+            return "color=grey";
+        }
         else if (SVFUtil::isa<TDForkPE>(edge))
         {
             return "color=Turquoise";

package/lib/Graphs/VFG.cpp

@@ -122,6 +122,15 @@ const std::string UnaryOPVFGNode::toString() const {
     return rawstr.str();
 }
 
+const std::string BranchVFGNode::toString() const {
+    std::string str;
+    raw_string_ostream rawstr(str);
+    rawstr << "BranchVFGNode ID: " << getId() << " ";
+    rawstr << "PAGEdge: [" << brstmt->toString() << "\t";
+    return rawstr.str();
+}
+
+
 const std::string GepVFGNode::toString() const {
     std::string str;
     raw_string_ostream rawstr(str);
@@ -340,8 +349,8 @@ void VFG::addVFGNodes()
                 copys.end(); iter != eiter; ++iter)
     {
         const CopyPE* edge = SVFUtil::cast<CopyPE>(*iter);
-        if(!isPhiCopyEdge(edge))
-            addCopyVFGNode(edge);
+        assert(!isPhiCopyEdge(edge) && "Copy edges can not be a PhiNode (or from PhiNode)");
+        addCopyVFGNode(edge);
     }
 
     // initialize gep nodes
@@ -479,32 +488,49 @@ void VFG::addVFGNodes()
     }
 
     // initialize llvm phi nodes (phi of top level pointers)
-    SVFIR::PHINodeMap& phiNodeMap = pag->getPhiNodeMap();
-    for (SVFIR::PHINodeMap::iterator pit = phiNodeMap.begin(), epit = phiNodeMap.end(); pit != epit; ++pit)
+    PAGEdge::PAGEdgeSetTy& phis = getPAGEdgeSet(PAGEdge::Phi);
+    for (PAGEdge::PAGEdgeSetTy::iterator iter = phis.begin(), eiter =
+                phis.end(); iter != eiter; ++iter)
     {
-        if (isInterestedPAGNode(pit->first))
-            addIntraPHIVFGNode(pit->first, pit->second);
+        const PhiPE* edge = SVFUtil::cast<PhiPE>(*iter);
+        if(isInterestedPAGNode(edge->getRes()))
+            addIntraPHIVFGNode(edge);
     }
     // initialize llvm binary nodes (binary operators)
-    SVFIR::BinaryNodeMap& binaryNodeMap = pag->getBinaryNodeMap();
-    for (SVFIR::BinaryNodeMap::iterator pit = binaryNodeMap.begin(), epit = binaryNodeMap.end(); pit != epit; ++pit)
+    PAGEdge::PAGEdgeSetTy& binaryops = getPAGEdgeSet(PAGEdge::BinaryOp);
+    for (PAGEdge::PAGEdgeSetTy::iterator iter = binaryops.begin(), eiter =
+                binaryops.end(); iter != eiter; ++iter)
+    {
+        const BinaryOPPE* edge = SVFUtil::cast<BinaryOPPE>(*iter);
+        if(isInterestedPAGNode(edge->getRes()))
+            addBinaryOPVFGNode(edge);
+    }
+    // initialize llvm unary nodes (unary operators)
+    PAGEdge::PAGEdgeSetTy& unaryops = getPAGEdgeSet(PAGEdge::UnaryOp);
+    for (PAGEdge::PAGEdgeSetTy::iterator iter = unaryops.begin(), eiter =
+                unaryops.end(); iter != eiter; ++iter)
     {
-        if (isInterestedPAGNode(pit->first))
-            addBinaryOPVFGNode(pit->first, pit->second);
+        const UnaryOPPE* edge = SVFUtil::cast<UnaryOPPE>(*iter);
+        if(isInterestedPAGNode(edge->getRes()))
+            addUnaryOPVFGNode(edge);
     }
     // initialize llvm unary nodes (unary operators)
-    SVFIR::UnaryNodeMap& unaryNodeMap = pag->getUnaryNodeMap();
-    for (SVFIR::UnaryNodeMap::iterator pit = unaryNodeMap.begin(), epit = unaryNodeMap.end(); pit != epit; ++pit)
+    PAGEdge::PAGEdgeSetTy& brs = getPAGEdgeSet(PAGEdge::Branch);
+    for (PAGEdge::PAGEdgeSetTy::iterator iter = brs.begin(), eiter =
+                brs.end(); iter != eiter; ++iter)
     {
-        if (isInterestedPAGNode(pit->first))
-            addUnaryOPVFGNode(pit->first, pit->second);
+        const BranchStmt* edge = SVFUtil::cast<BranchStmt>(*iter);
+        if(isInterestedPAGNode(edge->getBranchInst()))
+            addBranchVFGNode(edge);
     }
     // initialize llvm cmp nodes (comparision)
-    SVFIR::CmpNodeMap& cmpNodeMap = pag->getCmpNodeMap();
-    for (SVFIR::CmpNodeMap::iterator pit = cmpNodeMap.begin(), epit =cmpNodeMap.end(); pit != epit; ++pit)
+    PAGEdge::PAGEdgeSetTy& cmps = getPAGEdgeSet(PAGEdge::Cmp);
+    for (PAGEdge::PAGEdgeSetTy::iterator iter = cmps.begin(), eiter =
+                cmps.end(); iter != eiter; ++iter)
     {
-        if (isInterestedPAGNode(pit->first))
-            addCmpVFGNode(pit->first, pit->second);
+        const CmpPE* edge = SVFUtil::cast<CmpPE>(*iter);
+        if(isInterestedPAGNode(edge->getRes()))
+            addCmpVFGNode(edge);
     }
 }
 
@@ -867,7 +893,7 @@ const PAGNode* VFG::getLHSTopLevPtr(const VFGNode* node) const
     else if(const FormalRetVFGNode* fr = SVFUtil::dyn_cast<FormalRetVFGNode>(node))
         return fr->getRet();
     else if(const NullPtrVFGNode* nullVFG = SVFUtil::dyn_cast<NullPtrVFGNode>(node))
-        return nullVFG->getGNode();
+        return nullVFG->getPAGNode();
     else
         assert(false && "unexpected node kind!");
     return nullptr;

package/lib/MSSA/SVFGBuilder.cpp

@@ -69,8 +69,6 @@ void SVFGBuilder::buildSVFG()
 {
     MemSSA* mssa = svfg->getMSSA();
     svfg->buildSVFG();
-    if(mssa->getPTA()->printStat())
-        svfg->performStat();
 }
 
 /// Create DDA SVFG
@@ -105,6 +103,9 @@ SVFG* SVFGBuilder::build(BVDataPTAImpl* pta, VFG::VFGK kind)
     if(Options::SVFGWithIndirectCall || SVFGWithIndCall)
         svfg->updateCallGraph(pta);
 
+    if(mssa->getPTA()->printStat())
+        svfg->performStat();
+
     if(Options::DumpVFG)
         svfg->dump("svfg_final");
 

package/lib/MemoryModel/PAGBuilderFromFile.cpp

@@ -177,11 +177,17 @@ void PAGBuilderFromFile::addEdge(NodeID srcID, NodeID dstID,
     else if (edge == "ret")
         pag->addEdge(srcNode, dstNode, new RetPE(srcNode, dstNode, nullptr));
     else if (edge == "cmp")
-        pag->addCmpPE(srcID, dstID);
+        pag->addCmpPE(srcID, dstID, dstID, dstID);
     else if (edge == "binary-op")
-        pag->addBinaryOPPE(srcID, dstID);
+        pag->addBinaryOPPE(srcID, dstID, dstID, dstID);
     else if (edge == "unary-op")
-        pag->addUnaryOPPE(srcID, dstID);
+        pag->addUnaryOPPE(srcID, dstID, dstID);
+    else if (edge == "phi")
+        pag->addPhiNode(srcID, dstID);
+    else if (edge == "branch"){
+        assert(false && "fix successors here!");
+        //pag->addBranchStmt(srcID, dstID, nullptr);
+    }
     else
         assert(false && "format not support, can not create such edge");
 }

package/lib/MemoryModel/PointerAnalysis.cpp

@@ -29,7 +29,7 @@
 
 #include "Util/Options.h"
 #include "SVF-FE/CallGraphBuilder.h"
-#include "SVF-FE/CHG.h"
+#include "SVF-FE/CHGBuilder.h"
 #include "SVF-FE/DCHG.h"
 #include "SVF-FE/CPPUtil.h"
 #include "Util/SVFModule.h"
@@ -41,7 +41,6 @@
 #include "MemoryModel/PTAStat.h"
 #include "Graphs/ThreadCallGraph.h"
 #include "Graphs/ICFG.h"
-#include "Graphs/ExternalPAG.h"
 #include "WPA/FlowSensitiveTBHC.h"
 
 #include <iomanip>
@@ -120,7 +119,8 @@ void PointerAnalysis::initialize()
 			chgraph = dchg;
 		} else {
 			CHGraph *chg = new CHGraph(pag->getModule());
-			chg->buildCHG();
+            CHGBuilder builder(chg);
+			builder.buildCHG();
 			chgraph = chg;
 		}
 	}
@@ -232,8 +232,6 @@ void PointerAnalysis::finalize()
 		pag->getICFG()->dump("icfg_final");
     }
 
-    if (!DumpPAGFunctions.empty()) ExternalPAG::dumpFunctions(DumpPAGFunctions);
-
     /// Dump results
     if (Options::PTSPrint)
     {