svf-tools 1.0.328 → 1.0.332

package/lib/SVF-FE/SVFIRBuilder.cpp

@@ -204,7 +204,69 @@ void SVFIRBuilder::initialiseNodes()
  */
 bool SVFIRBuilder::computeGepOffset(const User *V, LocationSet& ls)
 {
-    return SymbolTableInfo::SymbolInfo()->computeGepOffset(V,ls);
+    assert(V);
+
+    const llvm::GEPOperator *gepOp = SVFUtil::dyn_cast<const llvm::GEPOperator>(V);
+    DataLayout * dataLayout = SymbolTableInfo::getDataLayout(LLVMModuleSet::getLLVMModuleSet()->getMainLLVMModule());
+    llvm::APInt byteOffset(dataLayout->getIndexSizeInBits(gepOp->getPointerAddressSpace()),0,true);
+    if(gepOp && dataLayout && gepOp->accumulateConstantOffset(*dataLayout,byteOffset))
+    {
+        Size_t bo = byteOffset.getSExtValue();
+    }
+
+    for (bridge_gep_iterator gi = bridge_gep_begin(*V), ge = bridge_gep_end(*V);
+            gi != ge; ++gi)
+    {
+        ls.addOffsetValue(gi.getOperand());
+        // Handling array types, skipe array handling here
+        // We treat whole array as one, then we can distinguish different field of an array of struct
+        // e.g. s[1].f1 is differet from s[0].f2
+        if(SVFUtil::isa<ArrayType>(*gi))
+            continue;
+
+        //The int-value object of the current index operand
+        //  (may not be constant for arrays).
+        ConstantInt *op = SVFUtil::dyn_cast<ConstantInt>(gi.getOperand());
+
+        /// given a gep edge p = q + i,
+        if(!op)
+        {
+            return false;
+        }
+        //The actual index
+        Size_t idx = op->getSExtValue();
+
+
+        // Handling pointer types
+        // These GEP instructions are simply making address computations from the base pointer address
+        // e.g. idx = (char*) &p + 4,  at this case gep only one offset index (idx)
+        // Case 1: This operation is likely accessing an array through pointer p.
+        // Case 2: It may also be used to access a field of a struct (which is not ANSI-compliant)
+        // Since this is a field-index based memory model,
+        // for case 1: we consider the whole array as one element, This can be improved by LocMemModel as it can distinguish different
+        // elements of the same array.
+        // for case 2: we treat idx the same as &p by ignoring const 4 (This handling is unsound since the program itself is not ANSI-compliant).
+        if (SVFUtil::isa<PointerType>(*gi))
+        {
+            //off += idx;
+        }
+
+
+        // Handling struct here
+        if (const StructType *ST = SVFUtil::dyn_cast<StructType>(*gi) )
+        {
+            assert(op && "non-const struct index in GEP");
+            const vector<u32_t> &so = SymbolTableInfo::SymbolInfo()->getFlattenedFieldIdxVec(ST);
+            if ((unsigned)idx >= so.size())
+            {
+                outs() << "!! Struct index out of bounds" << idx << "\n";
+                assert(0);
+            }
+            //add the translated offset
+            ls.setFldIdx(ls.accumulateConstantOffset() + so[idx]);
+        }
+    }
+    return true;
 }
 
 /*!
@@ -420,7 +482,7 @@ void SVFIRBuilder::InitialGlobal(const GlobalVariable *gvar, Constant *C,
     {
         const StructType *sty = SVFUtil::cast<StructType>(C->getType());
         const std::vector<u32_t>& offsetvect =
-            SymbolTableInfo::SymbolInfo()->getFattenFieldIdxVec(sty);
+            SymbolTableInfo::SymbolInfo()->getFlattenedFieldIdxVec(sty);
         for (u32_t i = 0, e = C->getNumOperands(); i != e; i++)
         {
             u32_t off = offsetvect[i];
@@ -895,9 +957,54 @@ void SVFIRBuilder::handleDirectCall(CallSite cs, const SVFFunction *F)
 /*!
  * Find the base type and the max possible offset of an object pointed to by (V).
  */
-const Type *SVFIRBuilder::getBaseTypeAndFlattenedFields(Value *V, std::vector<LocationSet> &fields)
+const Type *SVFIRBuilder::getBaseTypeAndFlattenedFields(const Value *V, std::vector<LocationSet> &fields)
 {
-    return SymbolTableInfo::SymbolInfo()->getBaseTypeAndFlattenedFields(V, fields);
+    assert(V);
+    fields.push_back(LocationSet(0));
+
+    const Type *T = V->getType();
+    // Use the biggest struct type out of all operands.
+    if (const User *U = SVFUtil::dyn_cast<User>(V))
+    {
+        u32_t msz = 1;      //the max size seen so far
+        // In case of BitCast, try the target type itself
+        if (SVFUtil::isa<BitCastInst>(V))
+        {
+            u32_t sz = getFields(fields, T, msz);
+            if (msz < sz)
+            {
+                msz = sz;
+            }
+        }
+        // Try the types of all operands
+        for (User::const_op_iterator it = U->op_begin(), ie = U->op_end();
+                it != ie; ++it)
+        {
+            const Type *operandtype = it->get()->getType();
+
+            u32_t sz = getFields(fields, operandtype, msz);
+            if (msz < sz)
+            {
+                msz = sz;
+                T = operandtype;
+            }
+        }
+    }
+    // If V is a CE, the actual pointer type is its operand.
+    else if (const ConstantExpr *E = SVFUtil::dyn_cast<ConstantExpr>(V))
+    {
+        T = E->getOperand(0)->getType();
+        getFields(fields, T, 0);
+    }
+    // Handle Argument case
+    else if (SVFUtil::isa<Argument>(V))
+    {
+        getFields(fields, T, 0);
+    }
+
+    while (const PointerType *ptype = SVFUtil::dyn_cast<PointerType>(T))
+        T = ptype->getElementType();
+    return T;
 }
 
 /*!
@@ -1182,7 +1289,7 @@ void SVFIRBuilder::handleExtCall(CallSite cs, const SVFFunction *callee)
                 // We have vArg3 points to the entry of _Rb_tree_node_base { color; parent; left; right; }.
                 // Now we calculate the offset from base to vArg3
                 NodeID vnArg3 = pag->getValueNode(vArg3);
-                Size_t offset = pag->getLocationSetFromBaseNode(vnArg3).getOffset();
+                Size_t offset = pag->getLocationSetFromBaseNode(vnArg3).accumulateConstantOffset();
 
                 // We get all flattened fields of base
                 vector<LocationSet> fields;
@@ -1206,7 +1313,7 @@ void SVFIRBuilder::handleExtCall(CallSite cs, const SVFFunction *callee)
 
                 Value *vArg = cs.getArgument(0);
                 NodeID vnArg = pag->getValueNode(vArg);
-                Size_t offset = pag->getLocationSetFromBaseNode(vnArg).getOffset();
+                Size_t offset = pag->getLocationSetFromBaseNode(vnArg).accumulateConstantOffset();
 
                 // We get all fields
                 vector<LocationSet> fields;
@@ -1415,7 +1522,7 @@ NodeID SVFIRBuilder::getGepValVar(const Value* val, const LocationSet& ls, const
          * 2. GlobalVariable
          */
         assert((SVFUtil::isa<Instruction>(curVal) || SVFUtil::isa<GlobalVariable>(curVal)) && "curVal not an instruction or a globalvariable?");
-        const std::vector<FieldInfo> &fieldinfo = SymbolTableInfo::SymbolInfo()->getFlattenFieldInfoVec(baseType);
+        const std::vector<FlattenedFieldInfo> &fieldinfo = SymbolTableInfo::SymbolInfo()->getFlattenedFieldInfoVec(baseType);
         const Type *type = fieldinfo[fieldidx].getFlattenElemTy();
 
         // We assume every GepValNode and its GepEdge to the baseNode are unique across the whole program
@@ -1506,7 +1613,28 @@ void SVFIRBuilder::setCurrentBBAndValueForPAGEdge(PAGEdge* edge)
     }
 
     pag->addToSVFStmtList(icfgNode,edge);
-    icfgNode->addPAGEdge(edge);
+    icfgNode->addSVFStmt(edge);
 }
 
 
+/*!
+ * Replace fields with flatten fields of T if the number of its fields is larger than msz.
+ */
+u32_t SVFIRBuilder::getFields(std::vector<LocationSet>& fields, const Type* T, u32_t msz)
+{
+    if (!SVFUtil::isa<PointerType>(T))
+        return 0;
+
+    T = T->getContainedType(0);
+    const std::vector<FlattenedFieldInfo>& stVec = SymbolTableInfo::SymbolInfo()->getFlattenedFieldInfoVec(T);
+    u32_t sz = stVec.size();
+    if (msz < sz)
+    {
+        /// Replace fields with T's flatten fields.
+        fields.clear();
+        for(std::vector<FlattenedFieldInfo>::const_iterator it = stVec.begin(), eit = stVec.end(); it!=eit; ++it)
+            fields.push_back(LocationSet(*it));
+    }
+
+    return sz;
+}

package/lib/SVF-FE/SymbolTableBuilder.cpp

@@ -444,7 +444,7 @@ void SymbolTableBuilder::handleGlobalInitializerCE(const Constant *C,
     {
         const StructType *sty = SVFUtil::cast<StructType>(C->getType());
         const std::vector<u32_t>& offsetvect =
-            SymbolTableInfo::SymbolInfo()->getFattenFieldIdxVec(sty);
+            SymbolTableInfo::SymbolInfo()->getFlattenedFieldIdxVec(sty);
         for (u32_t i = 0, e = C->getNumOperands(); i != e; i++)
         {
             u32_t off = offsetvect[i];
@@ -515,8 +515,8 @@ void SymbolTableBuilder::analyzeGlobalStackObjType(ObjTypeInfo* typeinfo, const
     }
     if (const StructType *ST= SVFUtil::dyn_cast<StructType>(elemTy))
     {
-        const std::vector<FieldInfo>& flattenFields = SymbolTableInfo::SymbolInfo()->getFlattenFieldInfoVec(ST);
-        for(std::vector<FieldInfo>::const_iterator it = flattenFields.begin(), eit = flattenFields.end();
+        const std::vector<FlattenedFieldInfo>& flattenFields = SymbolTableInfo::SymbolInfo()->getFlattenedFieldInfoVec(ST);
+        for(std::vector<FlattenedFieldInfo>::const_iterator it = flattenFields.begin(), eit = flattenFields.end();
                 it!=eit; ++it)
         {
             if((*it).getFlattenElemTy()->isPointerTy())
@@ -600,7 +600,7 @@ u32_t SymbolTableBuilder::getObjSize(const Value* val)
     u32_t numOfFields = 1;
     if (SVFUtil::isa<StructType>(ety) || SVFUtil::isa<ArrayType>(ety))
     {
-        numOfFields = SymbolTableInfo::SymbolInfo()->getFlattenFieldInfoVec(ety).size();
+        numOfFields = SymbolTableInfo::SymbolInfo()->getFlattenedFieldInfoVec(ety).size();
     }
     return numOfFields;
 }

package/lib/Util/TypeBasedHeapCloning.cpp

@@ -153,9 +153,9 @@ const NodeBS TypeBasedHeapCloning::getGepObjClones(NodeID base, unsigned offset)
     // totalOffset is the offset from the real base (i.e. base of base),
     // offset is the offset into base, whether it is a field itself or not.
     unsigned totalOffset = offset;
-    if (const GepObjPN *baseGep = SVFUtil::dyn_cast<GepObjPN>(baseNode))
+    if (const GepObjVar *baseGep = SVFUtil::dyn_cast<GepObjVar>(baseNode))
     {
-        totalOffset += baseGep->getLocationSet().getOffset();
+        totalOffset += baseGep->getOffset();
     }
 
     const DIType *baseType = getType(base);
@@ -184,12 +184,12 @@ const NodeBS TypeBasedHeapCloning::getGepObjClones(NodeID base, unsigned offset)
     {
         PAGNode *node = ppag->getGNode(gep);
         assert(node && "TBHC: expected gep node doesn't exist.");
-        assert((SVFUtil::isa<GepObjPN>(node) || SVFUtil::isa<FIObjVar>(node))
+        assert((SVFUtil::isa<GepObjVar>(node) || SVFUtil::isa<FIObjVar>(node))
                && "TBHC: expected a GEP or FI object.");
 
-        if (GepObjPN *gepNode = SVFUtil::dyn_cast<GepObjPN>(node))
+        if (GepObjVar *gepNode = SVFUtil::dyn_cast<GepObjVar>(node))
         {
-            if (gepNode->getLocationSet().getOffset() == totalOffset)
+            if (gepNode->getOffset() == totalOffset)
             {
                 geps.set(gep);
             }
@@ -225,7 +225,7 @@ const NodeBS TypeBasedHeapCloning::getGepObjClones(NodeID base, unsigned offset)
             newGep = ppag->getGepObjVar(base, newLS);
         }
 
-        if (GepObjPN *gep = SVFUtil::dyn_cast<GepObjPN>(ppag->getGNode(newGep)))
+        if (GepObjVar *gep = SVFUtil::dyn_cast<GepObjVar>(ppag->getGNode(newGep)))
         {
             gep->setBaseNode(base);
         }
@@ -412,9 +412,9 @@ NodeID TypeBasedHeapCloning::cloneObject(NodeID o, const DIType *type, bool)
 {
     NodeID clone;
     const PAGNode *obj = ppag->getGNode(o);
-    if (const GepObjPN *gepObj = SVFUtil::dyn_cast<GepObjPN>(obj))
+    if (const GepObjVar *gepObj = SVFUtil::dyn_cast<GepObjVar>(obj))
     {
-        const NodeBS &clones = getGepObjClones(gepObj->getBaseNode(), gepObj->getLocationSet().getOffset());
+        const NodeBS &clones = getGepObjClones(gepObj->getBaseNode(), gepObj->getOffset());
         // TODO: a bit of repetition.
         for (NodeID clone : clones)
         {
@@ -427,7 +427,7 @@ NodeID TypeBasedHeapCloning::cloneObject(NodeID o, const DIType *type, bool)
         clone = addCloneGepObjNode(gepObj->getMemObj(), gepObj->getLocationSet());
 
         // The base needs to know about the new clone.
-        addGepToObj(clone, gepObj->getBaseNode(), gepObj->getLocationSet().getOffset());
+        addGepToObj(clone, gepObj->getBaseNode(), gepObj->getOffset());
 
         addClone(o, clone);
         addClone(getOriginalObj(o), clone);
@@ -539,7 +539,7 @@ const DIType *TypeBasedHeapCloning::getTypeFromCTirMetadata(const Value *v)
 bool TypeBasedHeapCloning::isGep(const PAGNode *n) const
 {
     assert(n != nullptr && "TBHC: testing if null is a GEP object!");
-    return SVFUtil::isa<GepObjPN>(n);
+    return SVFUtil::isa<GepObjVar>(n);
 }
 
 /// Returns true if the function name matches MAYALIAS, NOALIAS, etc.

package/lib/WPA/Andersen.cpp

@@ -64,10 +64,6 @@ AndersenBase::~AndersenBase()
 {
   delete consCG;
   consCG = nullptr;
-
-  auto * chg = getCHGraph();
-  delete chg;
-  chg = nullptr;
 }
 
 /*!
@@ -170,7 +166,7 @@ void AndersenBase::normalizePointsTo()
     // for redundant gepnodes and remove those nodes from pag
     for (NodeID n: redundantGepNodes) {
         NodeID base = pag->getBaseObjVar(n);
-        GepObjPN *gepNode = SVFUtil::dyn_cast<GepObjPN>(pag->getGNode(n));
+        GepObjVar *gepNode = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(n));
         assert(gepNode && "Not a gep node in redundantGepNodes set");
         const LocationSet ls = gepNode->getLocationSet();
         GepObjVarMap.erase(std::make_pair(base, ls));

package/lib/WPA/AndersenSFR.cpp

@@ -133,8 +133,8 @@ void AndersenSFR::fieldExpand(NodeSet& initials, Size_t offset, NodeBS& strides,
             const MemObj* obj = pag->getBaseObj(init);
             const Size_t maxLimit = obj->getMaxFieldOffsetLimit();
             Size_t initOffset;
-            if (GepObjPN *gepNode = SVFUtil::dyn_cast<GepObjPN>(initPN))
-                initOffset = gepNode->getLocationSet().getOffset();
+            if (GepObjVar *gepNode = SVFUtil::dyn_cast<GepObjVar>(initPN))
+                initOffset = gepNode->getOffset();
             else if (SVFUtil::isa<FIObjVar>(initPN) || SVFUtil::isa<DummyObjVar>(initPN))
                 initOffset = 0;
             else

package/lib/WPA/CSC.cpp

@@ -107,7 +107,7 @@ void CSC::visit(NodeID nodeId, Size_t _w)
         if (_consG->hasEdge(node, backNode, ConstraintEdge::NormalGep))
         {
             NormalGepCGEdge* normalGep = SVFUtil::dyn_cast<NormalGepCGEdge>(_consG->getEdge(node, backNode, ConstraintEdge::NormalGep));
-            Size_t _w = normalGep->getLocationSet().getOffset();
+            Size_t _w = normalGep->getOffset();
             Size_t _l = _D[nodeId] +_w - _D[backNodeId];
             backNode->strides.set(_l);
             for (auto cNodeId : _C)

package/lib/WPA/FlowSensitiveTBHC.cpp

@@ -69,7 +69,7 @@ void FlowSensitiveTBHC::backPropagate(NodeID clone)
     assert(cloneObj && "FSTBHC: original object does not exist in SVFIR?");
     // Check the original object too because when reuse of a gep occurs, the new object
     // is an FI object.
-    if (SVFUtil::isa<CloneGepObjVar>(cloneObj) || SVFUtil::isa<GepObjPN>(originalObj))
+    if (SVFUtil::isa<CloneGepObjVar>(cloneObj) || SVFUtil::isa<GepObjVar>(originalObj))
     {
         // Since getGepObjClones is updated, some GEP nodes need to be redone.
         const NodeBS &retrievers = gepToSVFGRetrievers[getOriginalObj(clone)];
@@ -143,10 +143,10 @@ bool FlowSensitiveTBHC::propAlongIndirectEdge(const IndirectSVFGEdge* edge)
             }
         }
 
-        if (GepObjPN *gep = SVFUtil::dyn_cast<GepObjPN>(pag->getGNode(o)))
+        if (GepObjVar *gep = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(o)))
         {
             // Want the geps which are at the same "level" as this one (same mem obj, same offset).
-            const NodeBS &geps = getGepObjsFromMemObj(gep->getMemObj(), gep->getLocationSet().getOffset());
+            const NodeBS &geps = getGepObjsFromMemObj(gep->getMemObj(), gep->getOffset());
             for (NodeID g : geps)
             {
                 const DIType *gepType = getType(g);
@@ -328,7 +328,7 @@ bool FlowSensitiveTBHC::processGep(const GepSVFGNode* gep)
                 }
 
                 if (DCHGraph::isAgg(baseType) && baseType->getTag() != dwarf::DW_TAG_array_type
-                        && normalGep->getLocationSet().getOffset() >= dchg->getNumFields(baseType))
+                        && normalGep->getOffset() >= dchg->getNumFields(baseType))
                 {
                     // If the field offset is too high for this object, it is killed. It seems that a
                     // clone was made on this GEP but this is not the base (e.g. base->f1->f2), and SVF
@@ -342,7 +342,7 @@ bool FlowSensitiveTBHC::processGep(const GepSVFGNode* gep)
                 else
                 {
                     // Operate on the field and all its clones.
-                    const NodeBS fieldClones = getGepObjClones(oq, normalGep->getLocationSet().getOffset());
+                    const NodeBS fieldClones = getGepObjClones(oq, normalGep->getOffset());
                     for (NodeID fc : fieldClones)
                     {
                         gepToSVFGRetrievers[getOriginalObj(fc)].set(gep->getId());
@@ -648,7 +648,7 @@ void FlowSensitiveTBHC::expandFIObjs(const PointsTo& pts, PointsTo& expandedPts)
     for (NodeID o : pts)
     {
         expandedPts |= getAllFieldsObjVars(o);
-        while (const GepObjPN *gepObj = SVFUtil::dyn_cast<GepObjPN>(pag->getGNode(o)))
+        while (const GepObjVar *gepObj = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(o)))
         {
             expandedPts |= getAllFieldsObjVars(o);
             o = gepObj->getBaseNode();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.328",
+  "version": "1.0.332",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {