svf-tools 1.0.352 → 1.0.356

package/lib/MemoryModel/LocationSet.cpp

@@ -45,7 +45,7 @@ bool LocationSet::addOffsetValue(const Value* offsetVal, const Type* type)
     return true;
 }
 
-/// Return TRUE if all offset values are constants
+/// Return true if all offset values are constants
 bool LocationSet::isConstantOffset() const
 {
     for(auto it : offsetValues){
@@ -55,12 +55,74 @@ bool LocationSet::isConstantOffset() const
     return true;
 }
 
-/// Return accmuated constant offset
-/// offsetValues: [(v1,t1), (v2,t2), (v3,t3)]
-/// v1*sz(t2) + v2*sz(t3) + v3 
-s64_t LocationSet::accumulateConstantOffset() const{
+/// Return element number of a type
+/// (1) StructType, return flatterned number elements, i.e., the index of the last element (getFlattenedOffsetVec().back()) plus one.
+/// (2) ArrayType, return number of elements
+/// (3) PointerType, return the element number of the pointee 
+/// (4) non-pointer SingleValueType, return 1
+u32_t LocationSet::getElementNum(const Type* type) const{
+    u32_t sz = 1;
+    if(const ArrayType* aty = SVFUtil::dyn_cast<ArrayType>(type))
+    {
+        /// handle nested arrays
+        const Type* innerTy = aty;
+        while (const ArrayType* arr = SVFUtil::dyn_cast<ArrayType>(innerTy))
+        {
+            sz *= arr->getNumElements();
+            innerTy = arr->getElementType();
+        }
+    }
+    else if (const StructType *sty = SVFUtil::dyn_cast<StructType>(type) )
+    {
+        const vector<u32_t> &so = SymbolTableInfo::SymbolInfo()->getFlattenedOffsetVec(sty);
+        sz = so.back() + 1;
+    }
+    else if (type->isSingleValueType())
+    {
+        /// This is a pointer arithmic
+        if(const PointerType* pty = SVFUtil::dyn_cast<PointerType>(type) ){
+            sz = getElementNum(pty->getElementType());
+        }
+    }
+    else{
+        SVFUtil::outs() << "GepIter Type" << *type << "\n";
+        assert(false && "What other types for this gep?");
+    }
+    return sz;
+}
 
-    return 0;
+/// Return accumulated constant offset
+/// 
+/// "value" is the offset variable (must be a constant)
+/// "type" is the location where we want to compute offset
+/// e.g., %3 = getelementptr inbounds [10 x i32], [10 x i32]* %1, i64 0, i64 5 
+/// offsetValues[0] value: i64 0, type: [10 x i32]*
+/// offsetValues[1] value: i64 5, type: [10 x i32]
+/// 
+/// Given a vector: [(v1,t1), (v2,t2), (v3,t3)]
+/// totalConstOffset = v1 * sz(t2) + v2 * sz(t3) + v3 * 1
+/// If the vector only has one element (one gep operand), then it must be a pointer arithmetic and type must be a PointerType
+/// totalConstOffset = v1 * sz(t1) 
+s64_t LocationSet::accumulateConstantOffset() const{
+    
+    assert(isConstantOffset() && "not a constant offset");
+
+    s64_t totalConstOffset = 0;
+    u32_t sz = 1;
+    for(int i = offsetValues.size() - 1; i >= 0; i--){
+        const Value* value = offsetValues[i].first;
+        const Type* type = offsetValues[i].second;
+        const ConstantInt *op = SVFUtil::dyn_cast<ConstantInt>(value);
+        assert(op && "not a constant offset?");
+        /// if this gep only has one operand, the gepIterType must be the pointer type, and we will need to retrieve size of its elementType.
+        if(offsetValues.size()==1){
+            assert(SVFUtil::isa<PointerType>(type) && "If gep has only one operand, its gepIterType must be PointerType!");
+            sz = getElementNum(type);
+        }
+        totalConstOffset += op->getSExtValue() * sz; 
+        sz *= getElementNum(type);
+    }
+    return totalConstOffset;
 }
 /*!
  * Compute all possible locations according to offset and number-stride pairs.
@@ -147,4 +209,4 @@ std::string LocationSet::dump() const
     }
     rawstr << " }\n";
     return rawstr.str();
-}
+}

package/lib/MemoryModel/PointerAnalysis.cpp

@@ -208,12 +208,6 @@ void PointerAnalysis::finalize()
     if (Options::PAGDotGraph)
         pag->dump("pag_final");
 
-    // dump ICFG
-    if (Options::DumpICFG){
-		pag->getICFG()->updateCallGraph(ptaCallGraph);
-		pag->getICFG()->dump("icfg_final");
-    }
-
     /// Dump results
     if (Options::PTSPrint)
     {

package/lib/MemoryModel/SVFIR.cpp

@@ -164,7 +164,7 @@ UnaryOPStmt* SVFIR::addUnaryOPStmt(NodeID src, NodeID dst, u32_t opcode)
 /*
 * Add BranchStmt
 */
-BranchStmt* SVFIR::addBranchStmt(NodeID br, NodeID cond, std::vector<const ICFGNode*> succs)
+BranchStmt* SVFIR::addBranchStmt(NodeID br, NodeID cond, const BranchStmt::SuccAndCondPairVec&  succs)
 {
     SVFVar* brNode = getGNode(br);
     SVFVar* condNode = getGNode(cond);

package/lib/MemoryModel/SymbolTableInfo.cpp

@@ -87,21 +87,19 @@ void SymbolTableInfo::collectTypeInfo(const Type* ty)
  */
 void SymbolTableInfo::collectArrayInfo(const ArrayType* ty)
 {
-    StInfo* stinfo = new StInfo();
-    typeToFieldInfo[ty] = stinfo;
-
     u64_t out_num = ty->getNumElements();
-    const llvm::Type* elemTy = ty->getElementType();
-    u32_t out_stride = getTypeSizeInBytes(elemTy);
+    const Type* elemTy = ty->getElementType();
     while (const ArrayType* aty = SVFUtil::dyn_cast<ArrayType>(elemTy))
     {
         out_num *= aty->getNumElements();
         elemTy = aty->getElementType();
-        out_stride = getTypeSizeInBytes(elemTy);
     }
+    
+    StInfo* stinfo = new StInfo(out_num);
+    typeToFieldInfo[ty] = stinfo;
 
     /// Array itself only has one field which is the inner most element
-    stinfo->addFldWithType(0,elemTy);
+    stinfo->addFldWithType(0, elemTy, 0);
 
     /// Array's flatten field infor is the same as its element's
     /// flatten infor.
@@ -124,19 +122,19 @@ void SymbolTableInfo::collectArrayInfo(const ArrayType* ty)
 void SymbolTableInfo::collectStructInfo(const StructType *sty)
 {
     /// The struct info should not be processed before
-    StInfo* stinfo = new StInfo();
+    StInfo* stinfo = new StInfo(1);
     typeToFieldInfo[sty] = stinfo;
 
     // Number of fields after flattening the struct
     u32_t nf = 0;
-    // field of the current struct
-    u32_t field_idx = 0;
+    // The offset when considering array stride info
+    u32_t strideOffset = 0;
     for (StructType::element_iterator it = sty->element_begin(), ie =
-                sty->element_end(); it != ie; ++it, ++field_idx)
+                sty->element_end(); it != ie; ++it)
     {
         const Type *et = *it;
         /// offset with int_32 (s64_t) is large enough and will not cause overflow
-        stinfo->addFldWithType(nf, et);
+        stinfo->addFldWithType(nf, et, strideOffset);
 
         if (SVFUtil::isa<StructType>(et) || SVFUtil::isa<ArrayType>(et))
         {
@@ -151,12 +149,14 @@ void SymbolTableInfo::collectStructInfo(const StructType *sty)
                 stinfo->getFlattenedFieldInfoVec().push_back(field);
             }
             nf += nfE;
+            strideOffset += nfE * subStinfo->getStride();
         }
         else     //simple type
         {
             FlattenedFieldInfo field(nf, et);
             stinfo->getFlattenedFieldInfoVec().push_back(field);
-            ++nf;
+            nf += 1;
+            strideOffset += 1;
         }
     }
 
@@ -174,11 +174,11 @@ void SymbolTableInfo::collectStructInfo(const StructType *sty)
  */
 void SymbolTableInfo::collectSimpleTypeInfo(const Type* ty)
 {
-    StInfo* stinfo = new StInfo();
+    StInfo* stinfo = new StInfo(1);
     typeToFieldInfo[ty] = stinfo;
 
     /// Only one field
-    stinfo->addFldWithType(0, ty);
+    stinfo->addFldWithType(0, ty, 0);
 
     FlattenedFieldInfo field(0, ty);
     stinfo->getFlattenedFieldInfoVec().push_back(field);
@@ -322,7 +322,14 @@ const MemObj* SymbolTableInfo::createDummyObj(SymID symId, const Type* type)
     return memObj;
 }
 
-const std::vector<u32_t>& SymbolTableInfo::getFlattenedFieldIdxVec(const Type *T)
+/// Flatterned full offset information of a struct including its array fields 
+const std::vector<u32_t>& SymbolTableInfo::getFlattenedOffsetVec(const StructType *T)
+{
+    return getStructInfoIter(T)->second->getFlattenedOffsetVec();
+}
+
+/// Flatterned field index information of a struct ignoring any array field
+const std::vector<u32_t>& SymbolTableInfo::getFlattenedFieldIdxVec(const StructType *T)
 {
     return getStructInfoIter(T)->second->getFlattenedFieldIdxVec();
 }

package/lib/SABER/SrcSnkDDA.cpp

@@ -46,9 +46,9 @@ void SrcSnkDDA::initialize(SVFModule* module)
 
     AndersenWaveDiff* ander = AndersenWaveDiff::createAndersenWaveDiff(pag);
     if(Options::SABERFULLSVFG)
-        svfg =  memSSA.buildFullSVFGWithoutOPT(ander);
+        svfg =  memSSA.buildFullSVFG(ander);
     else
-        svfg =  memSSA.buildPTROnlySVFGWithoutOPT(ander);
+        svfg =  memSSA.buildPTROnlySVFG(ander);
     setGraph(memSSA.getSVFG());
     ptaCallGraph = ander->getPTACallGraph();
     //AndersenWaveDiff::releaseAndersenWaveDiff();

package/lib/SVF-FE/SVFIRBuilder.cpp

@@ -887,12 +887,14 @@ void SVFIRBuilder::visitBranchInst(BranchInst &inst){
 	else
 		cond = pag->getNullPtr();
 
-    std::vector<const ICFGNode*> successors;
+    assert(inst.getNumSuccessors() <= 2 && "if/else has more than two branches?");
+
+    BranchStmt::SuccAndCondPairVec successors;
     for (u32_t i = 0; i < inst.getNumSuccessors(); ++i)
     {
         const Instruction* succInst = &inst.getSuccessor(i)->front();
         const ICFGNode* icfgNode = pag->getICFG()->getBlockICFGNode(succInst);
-        successors.push_back(icfgNode);
+        successors.push_back(std::make_pair(icfgNode, 1-i));
     }
     const BranchStmt *brStmt = addBranchStmt(brinst, cond,successors);
 }
@@ -901,12 +903,15 @@ void SVFIRBuilder::visitSwitchInst(SwitchInst &inst){
     NodeID brinst = getValueNode(&inst);
     NodeID cond = getValueNode(inst.getCondition());
 
-    std::vector<const ICFGNode*> successors;
+    BranchStmt::SuccAndCondPairVec successors;
     for (u32_t i = 0; i < inst.getNumSuccessors(); ++i)
     {
         const Instruction* succInst = &inst.getSuccessor(i)->front();
+        const ConstantInt* condVal = inst.findCaseDest(inst.getSuccessor(i));
+        /// default case is set to -1;
+        s64_t val = condVal ? condVal->getSExtValue() : -1;
         const ICFGNode* icfgNode = pag->getICFG()->getBlockICFGNode(succInst);
-        successors.push_back(icfgNode);
+        successors.push_back(std::make_pair(icfgNode,val));
     }
     const BranchStmt *brStmt = addBranchStmt(brinst, cond,successors);
 }

package/lib/Util/Options.cpp

@@ -467,7 +467,7 @@ namespace SVF
 
     llvm::cl::opt<bool> Options::OPTSVFG(
         "opt-svfg", 
-        llvm::cl::init(true),
+        llvm::cl::init(false),
         llvm::cl::desc("Optimize SVFG to eliminate formal-in and actual-out")
     );
 

package/lib/WPA/FlowSensitive.cpp

@@ -73,11 +73,9 @@ void FlowSensitive::initialize()
     }
 
     // When evaluating ctir aliases, we want the whole SVFG.
-    if(Options::OPTSVFG)
-        svfg = Options::CTirAliasEval ? memSSA.buildFullSVFG(ander) : memSSA.buildPTROnlySVFG(ander);
-    else
-        svfg = memSSA.buildPTROnlySVFGWithoutOPT(ander);
-
+    
+    svfg = Options::CTirAliasEval ? memSSA.buildFullSVFG(ander) : memSSA.buildPTROnlySVFG(ander);
+    
     setGraph(svfg);
     //AndersenWaveDiff::releaseAndersenWaveDiff();
 }

package/lib/WPA/WPAPass.cpp

@@ -150,15 +150,7 @@ void WPAPass::runPointerAnalysis(SVFModule* svfModule, u32_t kind)
     {
         SVFGBuilder memSSA(true);
         assert(SVFUtil::isa<AndersenBase>(_pta) && "supports only andersen/steensgaard for pre-computed SVFG");
-        SVFG *svfg;
-        if (Options::OPTSVFG)
-        {
-            svfg = memSSA.buildFullSVFG((BVDataPTAImpl*)_pta);
-        } else
-        {
-            svfg = memSSA.buildFullSVFGWithoutOPT((BVDataPTAImpl*)_pta);
-        }
-
+        SVFG *svfg = memSSA.buildFullSVFG((BVDataPTAImpl*)_pta);
         /// support mod-ref queries only for -ander
         if (Options::PASelected.isSet(PointerAnalysis::AndersenWaveDiff_WPA))
             _svfg = svfg;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.352",
+  "version": "1.0.356",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/tools/Example/svf-ex.cpp

@@ -184,7 +184,7 @@ int main(int argc, char ** argv)
 
     /// Sparse value-flow graph (SVFG)
     SVFGBuilder svfBuilder(true);
-    SVFG* svfg = svfBuilder.buildFullSVFGWithoutOPT(ander);
+    SVFG* svfg = svfBuilder.buildFullSVFG(ander);
 
     /// Collect uses of an LLVM Value
     /// traverseOnVFG(svfg, value);