svf-tools 1.0.371 → 1.0.375

package/lib/MemoryModel/SVFIR.cpp

@@ -53,7 +53,7 @@ AddrStmt* SVFIR::addAddrStmt(NodeID src, NodeID dst)
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasNonlabeledEdge(srcNode,dstNode, SVFStmt::Addr))
-        return SVFUtil::cast<AddrStmt>(edge);
+        return nullptr;
     else
     {
         AddrStmt* addrPE = new AddrStmt(srcNode, dstNode);
@@ -71,7 +71,7 @@ CopyStmt* SVFIR::addCopyStmt(NodeID src, NodeID dst)
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasNonlabeledEdge(srcNode,dstNode, SVFStmt::Copy))
-        return SVFUtil::cast<CopyStmt>(edge);
+        return nullptr;
     else
     {
         CopyStmt* copyPE = new CopyStmt(srcNode, dstNode);
@@ -113,7 +113,7 @@ SelectStmt* SVFIR::addSelectStmt(NodeID res, NodeID op1, NodeID op2, NodeID cond
     SVFVar* dstNode = getGNode(res);
     SVFVar* condNode = getGNode(cond);
     if(SVFStmt* edge = hasLabeledEdge(op1Node, dstNode, SVFStmt::Select, op2Node))
-        return SVFUtil::cast<SelectStmt>(edge);
+        return nullptr;
     else
     {
         std::vector<SVFVar*> opnds = {op1Node, op2Node};
@@ -133,7 +133,7 @@ CmpStmt* SVFIR::addCmpStmt(NodeID op1, NodeID op2, NodeID dst, u32_t predicate)
     SVFVar* op2Node = getGNode(op2);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(op1Node, dstNode, SVFStmt::Cmp, op2Node))
-        return SVFUtil::cast<CmpStmt>(edge);
+        return nullptr;
     else
     {
         std::vector<SVFVar*> opnds = {op1Node, op2Node};
@@ -154,7 +154,7 @@ BinaryOPStmt* SVFIR::addBinaryOPStmt(NodeID op1, NodeID op2, NodeID dst, u32_t o
     SVFVar* op2Node = getGNode(op2);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(op1Node, dstNode, SVFStmt::BinaryOp, op2Node))
-        return SVFUtil::cast<BinaryOPStmt>(edge);
+        return nullptr;
     else
     {
         std::vector<SVFVar*> opnds = {op1Node, op2Node};
@@ -173,7 +173,7 @@ UnaryOPStmt* SVFIR::addUnaryOPStmt(NodeID src, NodeID dst, u32_t opcode)
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasNonlabeledEdge(srcNode,dstNode, SVFStmt::UnaryOp))
-        return SVFUtil::cast<UnaryOPStmt>(edge);
+        return nullptr;
     else
     {
         UnaryOPStmt* unaryOP = new UnaryOPStmt(srcNode, dstNode, opcode);
@@ -191,7 +191,7 @@ BranchStmt* SVFIR::addBranchStmt(NodeID br, NodeID cond, const BranchStmt::SuccA
     SVFVar* brNode = getGNode(br);
     SVFVar* condNode = getGNode(cond);
     if(SVFStmt* edge = hasNonlabeledEdge(condNode,brNode, SVFStmt::Branch))
-        return SVFUtil::cast<BranchStmt>(edge);
+        return nullptr;
     else
     {
         BranchStmt* branch = new BranchStmt(brNode, condNode, succs);
@@ -209,7 +209,7 @@ LoadStmt* SVFIR::addLoadStmt(NodeID src, NodeID dst)
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasNonlabeledEdge(srcNode,dstNode, SVFStmt::Load))
-        return SVFUtil::cast<LoadStmt>(edge);
+        return nullptr;
     else
     {
         LoadStmt* loadPE = new LoadStmt(srcNode, dstNode);
@@ -228,7 +228,7 @@ StoreStmt* SVFIR::addStoreStmt(NodeID src, NodeID dst, const IntraICFGNode* curV
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(srcNode,dstNode, SVFStmt::Store, curVal))
-        return SVFUtil::cast<StoreStmt>(edge);
+        return nullptr;
     else
     {
         StoreStmt* storePE = new StoreStmt(srcNode, dstNode, curVal);
@@ -246,7 +246,7 @@ CallPE* SVFIR::addCallPE(NodeID src, NodeID dst, const CallICFGNode* cs, const F
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(srcNode,dstNode, SVFStmt::Call, cs))
-        return SVFUtil::cast<CallPE>(edge);
+        return nullptr;
     else
     {
         CallPE* callPE = new CallPE(srcNode, dstNode, cs,entry);
@@ -264,7 +264,7 @@ RetPE* SVFIR::addRetPE(NodeID src, NodeID dst, const CallICFGNode* cs, const Fun
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(srcNode,dstNode, SVFStmt::Ret, cs))
-        return SVFUtil::cast<RetPE>(edge);
+        return nullptr;
     else
     {
         RetPE* retPE = new RetPE(srcNode, dstNode, cs, exit);
@@ -293,7 +293,7 @@ TDForkPE* SVFIR::addThreadForkPE(NodeID src, NodeID dst, const CallICFGNode* cs,
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(srcNode,dstNode, SVFStmt::ThreadFork, cs))
-        return SVFUtil::cast<TDForkPE>(edge);
+        return nullptr;
     else
     {
         TDForkPE* forkPE = new TDForkPE(srcNode, dstNode, cs, entry);
@@ -311,7 +311,7 @@ TDJoinPE* SVFIR::addThreadJoinPE(NodeID src, NodeID dst, const CallICFGNode* cs,
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasLabeledEdge(srcNode,dstNode, SVFStmt::ThreadJoin, cs))
-        return SVFUtil::cast<TDJoinPE>(edge);
+        return nullptr;
     else
     {
         TDJoinPE* joinPE = new TDJoinPE(srcNode, dstNode, cs, exit);
@@ -352,7 +352,7 @@ GepStmt* SVFIR::addNormalGepStmt(NodeID src, NodeID dst, const LocationSet& ls)
     SVFVar* baseNode = getGNode(getBaseValVar(src));
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasNonlabeledEdge(baseNode, dstNode, SVFStmt::Gep))
-        return SVFUtil::cast<GepStmt>(edge);
+        return nullptr;
     else
     {
         GepStmt* gepPE = new GepStmt(baseNode, dstNode, baseLS+ls);
@@ -372,7 +372,7 @@ GepStmt* SVFIR::addVariantGepStmt(NodeID src, NodeID dst, const LocationSet& ls)
     SVFVar* baseNode = getGNode(getBaseValVar(src));
     SVFVar* dstNode = getGNode(dst);
     if(SVFStmt* edge = hasNonlabeledEdge(baseNode, dstNode, SVFStmt::Gep))
-        return SVFUtil::cast<GepStmt>(edge);
+        return nullptr;
     else
     {
         GepStmt* gepPE = new GepStmt(baseNode, dstNode,baseLS+ls, true);
@@ -388,14 +388,14 @@ GepStmt* SVFIR::addVariantGepStmt(NodeID src, NodeID dst, const LocationSet& ls)
  * Add a temp field value node, this method can only invoked by getGepValVar
  * due to constaint expression, curInst is used to distinguish different instructions (e.g., memorycpy) when creating GepValVar.
  */
-NodeID SVFIR::addGepValNode(const Value* curInst,const Value* gepVal, const LocationSet& ls, NodeID i, const Type *type, u32_t fieldidx)
+NodeID SVFIR::addGepValNode(const Value* curInst,const Value* gepVal, const LocationSet& ls, NodeID i, const Type *type)
 {
     NodeID base = getBaseValVar(getValueNode(gepVal));
     //assert(findPAGNode(i) == false && "this node should not be created before");
     assert(0==GepValObjMap[curInst].count(std::make_pair(base, ls))
            && "this node should not be created before");
     GepValObjMap[curInst][std::make_pair(base, ls)] = i;
-    GepValVar *node = new GepValVar(gepVal, i, ls, type, fieldidx);
+    GepValVar *node = new GepValVar(gepVal, i, ls, type);
     return addValNode(gepVal, node, i);
 }
 
@@ -537,6 +537,24 @@ NodeID SVFIR::getBaseValVar(NodeID nodeId)
         return nodeId;
 }
 
+/*!
+ * It is used to create a dummy GepValVar during global initiailzation.
+ */
+NodeID SVFIR::getGepValVar(const Value* curInst, NodeID base, const LocationSet& ls) const
+{
+    GepValueVarMap::const_iterator iter = GepValObjMap.find(curInst);
+    if(iter==GepValObjMap.end()){
+        return UINT_MAX;
+    }
+    else{
+        NodeLocationSetMap::const_iterator lit = iter->second.find(std::make_pair(base, ls));
+        if(lit==iter->second.end())
+            return UINT_MAX;
+        else
+            return lit->second;
+    }
+}
+
 /*!
  * Get a base SVFVar given a pointer
  * Return the source node of its connected normal gep edge
@@ -669,7 +687,37 @@ void SVFIR::initialiseCandidatePointers()
         candidatePointers.insert(nodeId);
     }
 }
-
+/*!
+ * Return true if FIObjVar can point to any object 
+ * Or a field GepObjVar can point to any object.
+ */
+bool SVFIR::isNonPointerObj(NodeID id) const
+{
+    SVFVar* node = getGNode(id);
+    if (const FIObjVar* fiNode = SVFUtil::dyn_cast<FIObjVar>(node))
+    {
+        if(Options::FirstFieldEqBase)
+            return fiNode->getMemObj()->isNonPtrFieldObj(0);
+        else
+            return (fiNode->getMemObj()->hasPtrObj()==false);
+    }
+    else if (const GepObjVar* gepNode = SVFUtil::dyn_cast<GepObjVar>(node))
+    {
+        return (gepNode->getMemObj()->isNonPtrFieldObj(gepNode->getLocationSet()));
+    }
+    else if (const DummyObjVar* dummyNode = SVFUtil::dyn_cast<DummyObjVar>(node))
+    {
+        if(Options::FirstFieldEqBase)
+            return dummyNode->getMemObj()->isNonPtrFieldObj(0);
+        else
+            return (dummyNode->getMemObj()->hasPtrObj()==false);
+    }
+    else
+    {
+        assert(false && "expecting a object node");
+        abort();
+    }
+}
 /*
  * If this is a dummy node or node does not have incoming edges we assume it is not a pointer here
  */
@@ -683,7 +731,7 @@ bool SVFIR::isValidPointer(NodeID nodeId) const
 
 bool SVFIR::isValidTopLevelPtr(const SVFVar* node)
 {
-    if (node->isTopLevelPtr())
+    if (SVFUtil::isa<ValVar>(node))
     {
         if (isValidPointer(node->getId()) && node->hasValue())
         {

package/lib/MemoryModel/SVFVariables.cpp

@@ -40,36 +40,28 @@ using namespace SVFUtil;
 SVFVar::SVFVar(const Value* val, NodeID i, PNODEK k) :
     GenericPAGNodeTy(i,k), value(val)
 {
-
     assert( ValNode <= k && k <= CloneDummyObjNode && "new SVFIR node kind?");
-
     switch (k)
     {
     case ValNode:
     case GepValNode:
     {
         assert(val != nullptr && "value is nullptr for ValVar or GepValNode");
-        isTLPointer = val->getType()->isPointerTy();
-        isATPointer = false;
+        isPtr = val->getType()->isPointerTy();
         break;
     }
-
     case RetNode:
     {
         assert(val != nullptr && "value is nullptr for RetNode");
-        isTLPointer = SVFUtil::cast<Function>(val)->getReturnType()->isPointerTy();
-        isATPointer = false;
+        isPtr = SVFUtil::cast<Function>(val)->getReturnType()->isPointerTy();
         break;
     }
-
     case VarargNode:
     case DummyValNode:
     {
-        isTLPointer = true;
-        isATPointer = false;
+        isPtr = true;
         break;
     }
-
     case ObjNode:
     case GepObjNode:
     case FIObjNode:
@@ -78,8 +70,9 @@ SVFVar::SVFVar(const Value* val, NodeID i, PNODEK k) :
     case CloneFIObjNode:
     case CloneDummyObjNode:
     {
-        isTLPointer = false;
-        isATPointer = true;
+        isPtr = true;
+        if(val)
+            isPtr = val->getType()->isPointerTy();
         break;
     }
     }

package/lib/MemoryModel/SymbolTableInfo.cpp

@@ -44,6 +44,17 @@ SymbolTableInfo* SymbolTableInfo::symInfo = nullptr;
 u32_t StInfo::maxFieldLimit = 0;
 
 
+ObjTypeInfo::ObjTypeInfo(const Type* t, u32_t max) : type(t), flags(0), maxOffsetLimit(max)
+{
+    assert(t && "no type information for this object?");
+}
+
+
+void ObjTypeInfo::resetTypeForHeapStaticObj(const Type* t){
+    assert((isStaticObj() || isHeap()) && "can only reset the inferred type for heap and static objects!");
+    type = t;
+}
+
 /// Add field (index and offset) with its corresponding type
 void StInfo::addFldWithType(u32_t fldIdx, const Type* type, u32_t elemIdx)
 {
@@ -90,8 +101,11 @@ SymbolTableInfo::TypeToFieldInfoMap::iterator SymbolTableInfo::getStructInfoIter
  */
 ObjTypeInfo* SymbolTableInfo::createObjTypeInfo(const Type* type)
 {
-    ObjTypeInfo* typeInfo = new ObjTypeInfo(StInfo::getMaxFieldLimit(),type);
-    typeInfo->analyzeHeapObjType(type);
+    ObjTypeInfo* typeInfo = new ObjTypeInfo(type, StInfo::getMaxFieldLimit());
+    if(type && type->isPointerTy()){
+        typeInfo->setFlag(ObjTypeInfo::HEAP_OBJ);
+        typeInfo->setFlag(ObjTypeInfo::HASPTR_OBJ);
+    }
     return typeInfo;
 }
 
@@ -140,10 +154,19 @@ void SymbolTableInfo::collectArrayInfo(const ArrayType* ty)
     StInfo* stinfo = new StInfo(totalElemNum);
     typeToFieldInfo[ty] = stinfo;
 
+    /// array without any element (this is not true in C/C++ arrays) we assume there is an empty dummy element
+    if(totalElemNum==0){
+        stinfo->addFldWithType(0, elemTy, 0);
+        stinfo->setNumOfFieldsAndElems(1, 1);
+        FlattenedFieldInfo field(0, elemTy);
+        stinfo->getFlattenedFieldInfoVec().push_back(field);
+        return;
+    }
+
     /// Array's flatten field infor is the same as its element's
     /// flatten infor.
     StInfo* elemStInfo = getStructInfo(elemTy);
-    u32_t nfE = elemStInfo->getFlattenedFieldInfoVec().size();
+    u32_t nfE = elemStInfo->getNumOfFlattenFields();
     for (u32_t j = 0; j < nfE; j++)
     {
         u32_t idx = elemStInfo->getFlattenedFieldInfoVec()[j].getFlattenFldIdx();
@@ -186,7 +209,7 @@ void SymbolTableInfo::collectStructInfo(const StructType *sty)
         if (SVFUtil::isa<StructType>(et) || SVFUtil::isa<ArrayType>(et))
         {
             StInfo * subStinfo = getStructInfo(et);
-            u32_t nfE = subStinfo->getFlattenedFieldInfoVec().size();
+            u32_t nfE = subStinfo->getNumOfFlattenFields();
             //Copy ST's info, whose element 0 is the size of ST itself.
             for (u32_t j = 0; j < nfE; j++)
             {
@@ -351,7 +374,7 @@ MemObj* SymbolTableInfo::createBlkObj(SymID symId)
 {
     assert(isBlkObj(symId));
     assert(objMap.find(symId)==objMap.end());
-    MemObj* obj = new MemObj(symId, createObjTypeInfo());
+    MemObj* obj = new MemObj(symId, createObjTypeInfo(IntegerType::get(LLVMModuleSet::getLLVMModuleSet()->getContext(), 32)));
     objMap[symId] = obj;
     return obj;
 }
@@ -360,7 +383,7 @@ MemObj* SymbolTableInfo::createConstantObj(SymID symId)
 {
     assert(isConstantObj(symId));
     assert(objMap.find(symId)==objMap.end());
-    MemObj* obj = new MemObj(symId, createObjTypeInfo());
+    MemObj* obj = new MemObj(symId, createObjTypeInfo(IntegerType::get(LLVMModuleSet::getLLVMModuleSet()->getContext(), 32)));
     objMap[symId] = obj;
     return obj;
 }
@@ -374,27 +397,34 @@ const MemObj* SymbolTableInfo::createDummyObj(SymID symId, const Type* type)
 }
 
 /// Number of flattenned elements of an array or struct
-const u32_t SymbolTableInfo::getNumOfFlattenElements(const Type *T)
+u32_t SymbolTableInfo::getNumOfFlattenElements(const Type *T)
 {
-    return getStructInfoIter(T)->second->getNumOfFlattenElements();
-}
-
-/// Number of flattenned fields of a struct
-const u32_t SymbolTableInfo::getNumOfFlattenFields(const StructType *T)
-{
-    return getStructInfoIter(T)->second->getNumOfFlattenFields();
-}
-
-/// Flatterned full offset information of a struct including its array fields 
-const std::vector<u32_t>& SymbolTableInfo::getFlattenedElemIdxVec(const Type *T)
-{
-    return getStructInfoIter(T)->second->getFlattenedElemIdxVec();
+    if(Options::ModelArrays)
+        return getStructInfoIter(T)->second->getNumOfFlattenElements();
+    else
+        return getStructInfoIter(T)->second->getNumOfFlattenFields();
 }
 
-/// Flatterned field index information of a struct ignoring any array field
-const std::vector<u32_t>& SymbolTableInfo::getFlattenedFieldIdxVec(const StructType *T)
+/// Flatterned offset information of a struct or an array including its array fields 
+u32_t SymbolTableInfo::getFlattenedElemIdx(const Type *T, s64_t origId)
 {
-    return getStructInfoIter(T)->second->getFlattenedFieldIdxVec();
+    if(Options::ModelArrays){
+        std::vector<u32_t>& so = getStructInfoIter(T)->second->getFlattenedElemIdxVec();
+        assert ((unsigned)origId <= so.size() && !so.empty() && "Array index out of bounds, can't get flattened index!");
+        return so[origId];
+    }
+    else{
+        if(SVFUtil::isa<StructType>(T)){
+            std::vector<u32_t>& so = getStructInfoIter(T)->second->getFlattenedFieldIdxVec();
+            assert ((unsigned)origId <= so.size() && !so.empty() && "Struct index out of bounds, can't get flattened index!");
+            return so[origId];
+        }
+        else{
+            /// When Options::ModelArrays is disabled, any element index Array is modeled as the base
+            assert(SVFUtil::isa<ArrayType>(T) && "Only accept struct or array type if Options::ModelArrays is disabled!");
+            return 0;
+        }
+    }
 }
 
 const std::vector<FlattenedFieldInfo>& SymbolTableInfo::getFlattenedFieldInfoVec(const Type *T)
@@ -579,36 +609,13 @@ u32_t SymbolTableInfo::getTypeSizeInBytes(const StructType *sty, u32_t field_idx
 }
 
 
-
-/*!
- * Analyse types of heap and static objects
- */
-void ObjTypeInfo::analyzeHeapObjType(const Type*)
-{
-    // TODO: Heap and static objects are considered as pointers right now.
-    //       Refine this function to get more details about heap and static objects.
-    setFlag(HEAP_OBJ);
-    setFlag(HASPTR_OBJ);
-}
-
-/*!
- * Analyse types of heap and static objects
- */
-void ObjTypeInfo::analyzeStaticObjType(const Type*)
-{
-    // TODO: Heap and static objects are considered as pointers right now.
-    //       Refine this function to get more details about heap and static objects.
-    setFlag(STATIC_OBJ);
-    setFlag(HASPTR_OBJ);
-}
-
 /*!
  * Whether a location set is a pointer type or not
  */
 bool ObjTypeInfo::isNonPtrFieldObj(const LocationSet& ls)
 {
-    if (isHeap() || isStaticObj())
-        return false;
+    if (hasPtrObj() == false)
+        return true;
 
     const Type* ety = getType();
     while (const ArrayType *AT= SVFUtil::dyn_cast<ArrayType>(ety))
@@ -625,7 +632,7 @@ bool ObjTypeInfo::isNonPtrFieldObj(const LocationSet& ls)
         for (; it != eit; ++it)
         {
             const FlattenedFieldInfo& fieldLS = *it;
-            if (ls.intersects(LocationSet(fieldLS)))
+            if (ls.intersects(LocationSet(fieldLS.getFlattenFldIdx())))
             {
                 hasIntersection = true;
                 if (fieldLS.getFlattenElemTy()->isPointerTy())
@@ -637,28 +644,10 @@ bool ObjTypeInfo::isNonPtrFieldObj(const LocationSet& ls)
     }
     else
     {
-        if (isStaticObj() || isHeap())
-        {
-            // TODO: Objects which cannot find proper field for a certain offset including
-            //       arguments in main(), static objects allocated before main and heap
-            //       objects. Right now they're considered to have infinite fields and we
-            //       treat each field as pointers conservatively.
-            //       Try to model static and heap objects more accurately in the future.
-            return false;
-        }
-        else
-        {
-            // TODO: Using new memory model (locMM) may create objects with spurious offset
-            //       as we simply return new offset by mod operation without checking its
-            //       correctness in LocSymTableInfo::getModulusOffset(). So the following
-            //       assertion may fail. Try to refine the new memory model.
-            //assert(ls.getConstantFieldIdx() == 0 && "cannot get a field from a non-struct type");
-            return (hasPtrObj() == false);
-        }
+        return (hasPtrObj() == false);
     }
 }
 
-
 /*!
  * Set mem object to be field sensitive (up to maximum field limit)
  */

package/lib/SVF-FE/LLVMUtil.cpp

@@ -188,15 +188,15 @@ const Value * SVFUtil::stripConstantCasts(const Value *val)
 /*!
  * Strip all casts
  */
-Value * SVFUtil::stripAllCasts(Value *val)
+const Value * SVFUtil::stripAllCasts(const Value *val)
 {
     while (true)
     {
-        if (CastInst *ci = SVFUtil::dyn_cast<CastInst>(val))
+        if (const CastInst *ci = SVFUtil::dyn_cast<CastInst>(val))
         {
             val = ci->getOperand(0);
         }
-        else if (ConstantExpr *ce = SVFUtil::dyn_cast<ConstantExpr>(val))
+        else if (const ConstantExpr *ce = SVFUtil::dyn_cast<ConstantExpr>(val))
         {
             if(ce->isCast())
                 val = ce->getOperand(0);