svf-tools 1.0.418 → 1.0.421

package/include/Util/Conditions.h

@@ -36,280 +36,386 @@
 #include "CUDD/cuddInt.h"
 #include "z3++.h"
 
-namespace SVF
-{
+namespace SVF {
 
-class CondExpr{
+class CondExpr {
 public:
 
-    enum CondExprKind
-    {
-        BranchK
+    enum CondExprKind {
+        BDDK, Z3K
     };
 
-    CondExpr(const z3::expr &_e, CondExprKind _k) : e(_e), condExprK(_k) {
+    CondExpr(CondExprKind _k) : condExprK(_k) {
     }
-    virtual ~CondExpr(){
 
-    }
-    const z3::expr& getExpr() const{
-        return e;
-    }
-
-    /// get ctx
-    inline z3::context& getContext() const {
-        return getExpr().ctx();
-    }
+    virtual ~CondExpr() {
 
-    /// get id
-    inline u32_t getId() const {
-        return getExpr().id();
     }
 
     /// get Condition kind
-    inline CondExprKind getCondKind() const{
+    inline CondExprKind getCondKind() const {
         return condExprK;
     }
 
 private:
-    z3::expr e;
     CondExprKind condExprK;
 };
 
-class BranchCondExpr: public CondExpr{
-
+class Z3Expr : public CondExpr {
 public:
-    typedef DdNode BranchCond;
-    BranchCondExpr(const z3::expr& _e, BranchCond* _branchCond): CondExpr(_e, BranchK), branchCond(_branchCond){
+    typedef z3::expr Z3Cond;
+
+    Z3Expr(const z3::expr &_e) : CondExpr(Z3K), e(_e) {
+    }
+
+    virtual ~Z3Expr() {
+
+    }
+
+    const Z3Cond &getExpr() const {
+        return e;
+    }
+
+    /// get ctx
+    inline z3::context &getContext() const {
+        return getExpr().ctx();
     }
 
-    /// get branch condition
-    BranchCond* getBranchCond() const{
-        return branchCond;
+    /// get id
+    inline NodeID getId() const {
+        return getExpr().id();
     }
 
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const BranchCondExpr *)
-    {
+    static inline bool classof(const Z3Expr *) {
         return true;
     }
 
-    static inline bool classof(const CondExpr *cond)
-    {
-        return cond->getCondKind() == BranchK;
+    static inline bool classof(const CondExpr *cond) {
+        return cond->getCondKind() == Z3K;
     }
     //@}
 
-
 private:
-    BranchCond* branchCond;
+    Z3Cond e;
 
 };
 
+class BDDExpr : public CondExpr {
 
-/**
- * Branch Condition Manager
- */
-class BranchCondManager
-{
 public:
-    typedef BranchCondExpr::BranchCond BranchCond;
-    /// Constructor
-    BranchCondManager()
-    {
-        m_bdd_mgr = Cudd_Init(0, 0, CUDD_UNIQUE_SLOTS, CUDD_CACHE_SLOTS, 0);
-    }
+    typedef DdNode BDDCond;
 
-    /// Destructor
-    ~BranchCondManager()
-    {
-        Cudd_Quit(m_bdd_mgr);
+    BDDExpr(BDDCond *_bddCond) : CondExpr(BDDK), bddCond(_bddCond) {
     }
 
-    BranchCond* createCond(u32_t i)
-    {
-        return Cudd_bddIthVar(m_bdd_mgr, i);
-    }
-    inline BranchCond* getTrueCond() const
-    {
-        return BddOne();
-    }
-    inline BranchCond* getFalseCond() const
-    {
-        return BddZero();
+    /// get BDD condition
+    BDDCond *getBDDCond() const {
+        return bddCond;
     }
 
-    inline std::string getMemUsage()
-    {
-        return std::to_string(Cudd_ReadMemoryInUse(m_bdd_mgr));
+    /// Methods for support type inquiry through isa, cast, and dyn_cast:
+    //@{
+    static inline bool classof(const BDDExpr *) {
+        return true;
     }
-    inline u32_t getCondNumber()
-    {
-        return Cudd_ReadNodeCount(m_bdd_mgr);
+
+    static inline bool classof(const CondExpr *cond) {
+        return cond->getCondKind() == BDDK;
     }
-    /// Operations on conditions.
-    //@{
-    BranchCond* AND(BranchCond* lhs, BranchCond* rhs);
-    BranchCond* OR(BranchCond* lhs, BranchCond* rhs);
-    BranchCond* NEG(BranchCond* lhs);
     //@}
 
-    /**
-     * Utilities for dumping conditions. These methods use global functions from CUDD
-     * package and they can be removed outside this class scope to be used by others.
-     */
-    void ddClearFlag(BranchCond * f) const;
-    void BddSupportStep( BranchCond * f,  NodeBS &support) const;
-    void extractSubConds( BranchCond * f,  NodeBS &support) const;
-    void dump(BranchCond* lhs, OutStream & O);
-    std::string dumpStr(BranchCond* lhs) const;
 
 private:
-    inline BranchCond* BddOne() const
-    {
-        return Cudd_ReadOne(m_bdd_mgr);
-    }
-    inline BranchCond* BddZero() const
-    {
-        return Cudd_ReadLogicZero(m_bdd_mgr);
-    }
+    BDDCond *bddCond;
 
-    DdManager *m_bdd_mgr;
 };
 
-class CondManager{
+class CondManager {
+
+public:
+    enum CondMgrKind {
+        BDDMgrK, Z3MgrK
+    };
 
 private:
-    static CondManager* condMgr;
+    static CondManager *condMgr;
 
+protected:
     /// Constructor
-    CondManager();
+    CondManager() {}
 
 public:
-    typedef BranchCondExpr::BranchCond BranchCond;
-    typedef Map<const CondExpr*, const Instruction* > CondToTermInstMap;	// map a condition to its branch instruction
+    typedef Map<const CondExpr *, const Instruction *> CondToTermInstMap;    // map a condition to its branch instruction
     static u32_t totalCondNum; // a counter for fresh condition
     /// Singleton design here to make sure we only have one instance during any analysis
     //@{
-    static inline CondManager* getCondMgr()
-    {
-        if (condMgr == nullptr)
-        {
-            condMgr = new CondManager();
-        }
-        return condMgr;
-    }
-    static void releaseCondMgr()
-    {
+    static CondManager *getCondMgr(CondMgrKind _condMgrKind);
+
+    static void releaseCondMgr() {
         delete condMgr;
         condMgr = nullptr;
     }
     //@}
 
-    typedef Map<u32_t, CondExpr*> IDToCondExprMap;
-    typedef Map<BranchCond*, CondExpr*> BranchCondToCondExprMap;
-
     /// Destructor
-    ~CondManager();
+    virtual ~CondManager() {};
 
     /// Create a fresh condition to encode each program branch
-    CondExpr* createFreshBranchCond(const Instruction* inst);
-
-    /// Get or add a single branch condition, e.g., when doing condition conjunction
-    CondExpr* getOrAddBranchCond(const z3::expr& e, BranchCond* branchCond);
+    virtual CondExpr *createFreshBranchCond(const Instruction *inst) = 0;
 
     /// Return the number of condition expressions
-    u32_t getCondNumber();
+    virtual u32_t getCondNumber() = 0;
 
     /// Return the unique true condition
-    inline CondExpr* getTrueCond() const
-    {
+    inline CondExpr *getTrueCond() const {
         return trueCond;
     }
+
     /// Return the unique false condition
-    inline CondExpr* getFalseCond() const
-    {
+    inline CondExpr *getFalseCond() const {
         return falseCond;
     }
 
-    /// Preprocess the condition, e.g., Compressing using And-Inverter-Graph
-    z3::expr simplify(const z3::expr& expr) const;
     /// Operations on conditions.
     //@{
-    CondExpr* AND(CondExpr* lhs, CondExpr* rhs);
-    CondExpr* OR(CondExpr* lhs, CondExpr* rhs);
-    CondExpr* NEG(CondExpr* lhs);
-    //@}
+    virtual CondExpr *AND(CondExpr *lhs, CondExpr *rhs) = 0;
 
-    /// Return memory usage for this condition manager
-    std::string getMemUsage();
+    virtual CondExpr *OR(CondExpr *lhs, CondExpr *rhs) = 0;
 
-    /// Dump out all expressions
-    void printModel();
-
-    /// Print out one particular expression
-    void printDbg(const CondExpr* e);
+    virtual CondExpr *NEG(CondExpr *lhs) = 0;
+    //@}
 
-    /// Return string format of this expression
-    std::string dumpStr(const CondExpr* e) const;
-
-    /// Extract sub conditions of this expression
-    void extractSubConds(const CondExpr* cond,  NodeBS &support) const;
+    virtual bool isNegCond(const CondExpr *cond) const = 0;
 
     /// Whether the condition is satisfiable
-    bool isSatisfiable(const CondExpr* cond);
+    virtual bool isSatisfiable(const CondExpr *cond) = 0;
 
     /// Whether lhs and rhs are equivalent branch conditions
-    inline bool isEquivalentBranchCond(const CondExpr* lhs, const CondExpr* rhs) const{
-        return SVFUtil::dyn_cast<BranchCondExpr>(lhs)->getBranchCond() ==
-               SVFUtil::dyn_cast<BranchCondExpr>(rhs)->getBranchCond();
-    }
+    virtual bool isEquivalentBranchCond(const CondExpr *lhs, const CondExpr *rhs) = 0;
+
     /// Whether **All Paths** are reachable
-    bool isAllPathReachable(const CondExpr* e);
+    bool isAllPathReachable(const CondExpr *e);
 
     /// Get condition using condition id (z3 ast id)
-    inline CondExpr* getCond(u32_t id) const {
-        const IDToCondExprMap::const_iterator it = allocatedConds.find(id);
-        assert(it!=allocatedConds.end() && "condition not found!");
-        return it->second;
-    }
+    virtual CondExpr *getCond(u32_t id) const = 0;
 
     /// Get/Set llvm conditional expression
     //{@
-    inline const Instruction* getCondInst(const CondExpr* cond) const
-    {
+    inline const Instruction *getCondInst(const CondExpr *cond) const {
         CondToTermInstMap::const_iterator it = condToInstMap.find(cond);
-        assert(it!=condToInstMap.end() && "this should be a fresh condition");
+        assert(it != condToInstMap.end() && "this should be a fresh condition");
         return it->second;
     }
-    inline void setCondInst(const CondExpr* cond, const Instruction* inst){
-        assert(condToInstMap.find(cond)==condToInstMap.end() && "this should be a fresh condition");
+
+    inline void setCondInst(const CondExpr *cond, const Instruction *inst) {
+        assert(condToInstMap.find(cond) == condToInstMap.end() && "this should be a fresh condition");
         condToInstMap[cond] = inst;
     }
+    //@}
+
+    /// Return memory usage for this condition manager
+    virtual std::string getMemUsage() = 0;
+
+    /// Return string format of this expression
+    virtual std::string dumpStr(const CondExpr *e) const = 0;
+
+    /// Extract sub conditions of this expression
+    virtual void extractSubConds(const CondExpr *cond, NodeBS &support) const = 0;
+
+protected:
+    static CondExpr *trueCond;
+    static CondExpr *falseCond;
+
+private:
+
+    CondToTermInstMap condToInstMap; ///< map condition to llvm instruction
+
+};
+
+/**
+* Z3 Condition Manager
+*/
+class Z3Manager : public CondManager {
+    friend class CondManager;
+
+public:
+    typedef Z3Expr::Z3Cond Z3Cond;
+    typedef Map<u32_t, Z3Expr *> IDToCondExprMap;
+
+private:
+    /// Constructor
+    Z3Manager();
+
+    IDToCondExprMap idToCondExprMap;
+    z3::context cxt;
+    z3::solver sol;
+    NodeBS negConds;
+
+public:
+
+    /// Destructor
+    virtual ~Z3Manager();
+
+
+    inline u32_t getCondNumber() override {
+        return sol.get_model().size();
+    }
+
+    /// Preprocess the condition, e.g., Compressing using And-Inverter-Graph
+    z3::expr simplify(const z3::expr &expr) const;
+
+    /// Given an id, get its condition
+    CondExpr *getCond(u32_t i) const override {
+        auto it = idToCondExprMap.find(i);
+        assert(it != idToCondExprMap.end() && "condition not found!");
+        return it->second;
+    }
+
+    CondExpr *createFreshBranchCond(const Instruction *inst) override;
+
+    Z3Expr *getOrAddZ3Cond(const Z3Cond &z3Cond);
+
+    /// Operations on conditions.
+    //@{
+    CondExpr *AND(CondExpr *lhs, CondExpr *rhs) override;
+
+    CondExpr *OR(CondExpr *lhs, CondExpr *rhs) override;
+
+    CondExpr *NEG(CondExpr *lhs) override;
+    //@}
+
+    bool isSatisfiable(const CondExpr *cond) override;
+
+    bool isEquivalentBranchCond(const CondExpr *lhs, const CondExpr *rhs) override;
 
     inline void setNegCondInst(const CondExpr *cond, const Instruction *inst) {
         setCondInst(cond, inst);
-        negConds.set(cond->getId());
+        const Z3Expr *z3CondExpr = SVFUtil::dyn_cast<Z3Expr>(cond);
+        assert(z3CondExpr && "not z3 condition.");
+        negConds.set(z3CondExpr->getId());
     }
 
-    inline bool isNegCond(const CondExpr *cond) const {
-        return negConds.test(cond->getId());
+    bool isNegCond(const CondExpr *cond) const override {
+        const Z3Expr *z3CondExpr = SVFUtil::dyn_cast<Z3Expr>(cond);
+        assert(z3CondExpr && "not z3 condition.");
+        return negConds.test(z3CondExpr->getId());
     }
-    //@}
+
+    void extractSubConds(const CondExpr *f, NodeBS &support) const override;
+
+    std::string dumpStr(const CondExpr *e) const override;
+
+    inline std::string getMemUsage() override {
+        return "";
+    }
+
+    /// Print out one particular expression
+    void printDbg(const CondExpr *e);
+
+    /// Dump out all expressions
+    void printModel();
+};
+
+
+/**
+* BDD Condition Manager
+*/
+class BDDManager : public CondManager {
+    friend class CondManager;
+
+public:
+    typedef BDDExpr::BDDCond BDDCond;
+    typedef Map<BDDCond *, BDDExpr *> BDDToBDDCondExpr;
+    typedef Map<u32_t, BDDCond *> IndexToBDDCond;
 
 private:
-    z3::context cxt;
-    z3::solver sol;
-    static CondExpr* trueCond;
-    static CondExpr* falseCond;
-    IDToCondExprMap allocatedConds; ///< map condition id (z3 ast id) to its Condition wrapper
-    BranchCondToCondExprMap branchCondToCondExpr; ///< map branch condition to its Condition wrapper
-    CondToTermInstMap condToInstMap; ///< map condition to llvm instruction
-    BranchCondManager branchCondManager; ///< branch condition manager
-    NodeBS negConds;
+
+    /// Constructor
+    BDDManager();
+
+    inline BDDCond *BddOne() const {
+        return Cudd_ReadOne(m_bdd_mgr);
+    }
+
+    inline BDDCond *BddZero() const {
+        return Cudd_ReadLogicZero(m_bdd_mgr);
+    }
+
+    DdManager *m_bdd_mgr;
+    BDDToBDDCondExpr bddToBddCondExprMap;
+    IndexToBDDCond indexToBddCondMap;
+
+public:
+
+    /// Destructor
+    virtual ~BDDManager();
+
+    BDDCond *createCond(u32_t i) {
+        assert(indexToBddCondMap.find(i) == indexToBddCondMap.end() &&
+               "This should be fresh index to create new BDD");
+        BDDCond *bddCond = Cudd_bddIthVar(m_bdd_mgr, i);
+        return indexToBddCondMap.emplace(i, bddCond).first->second;
+    }
+
+    /// Given an index, get its condition
+    CondExpr *getCond(u32_t i) const override {
+        auto it = indexToBddCondMap.find(i);
+        assert(it != indexToBddCondMap.end() && "condition not found!");
+        auto it2 = bddToBddCondExprMap.find(it->second);
+        assert(it2 != bddToBddCondExprMap.end() && "condition not found!");
+        return it2->second;
+    }
+
+    CondExpr *createFreshBranchCond(const Instruction *inst) override;
+
+    inline u32_t getCondNumber() override {
+        return Cudd_ReadNodeCount(m_bdd_mgr);
+    }
+
+    BDDExpr *getOrAddBranchCond(BDDCond *bddCond);
+
+    /// Operations on conditions.
+    //@{
+    CondExpr *AND(CondExpr *lhs, CondExpr *rhs) override;
+
+    CondExpr *OR(CondExpr *lhs, CondExpr *rhs) override;
+
+    CondExpr *NEG(CondExpr *lhs) override;
+    //@}
+
+    bool isNegCond(const CondExpr *cond) const override {
+        return false;
+    }
+
+    bool isEquivalentBranchCond(const CondExpr *lhs, const CondExpr *rhs) override {
+        return lhs == rhs;
+    }
+
+    bool isSatisfiable(const CondExpr *cond) override;
+
+    /**
+     * Utilities for dumping conditions. These methods use global functions from CUDD
+     * package and they can be removed outside this class scope to be used by others.
+     */
+    void ddClearFlag(BDDCond *f) const;
+
+    void BddSupportStep(BDDCond *f, NodeBS &support) const;
+
+    void extractSubConds(const CondExpr *f, NodeBS &support) const override;
+
+    void dump(const CondExpr *lhs, OutStream &O);
+
+    std::string dumpStr(const CondExpr *e) const override;
+
+    inline std::string getMemUsage() override {
+        return std::to_string(Cudd_ReadMemoryInUse(m_bdd_mgr));
+    }
+
 };
 
+
 } // End namespace SVF
 
 #endif /* BITVECTORCOND_H_ */

package/include/Util/Options.h

@@ -10,6 +10,7 @@
 #include "Util/NodeIDAllocator.h"
 #include "MSSA/MemSSA.h"
 #include "WPA/WPAPass.h"
+#include "Util/Conditions.h"
 
 namespace SVF
 {
@@ -253,6 +254,9 @@ public:
 
     // DOTGraphTraits
     static const llvm::cl::opt<bool> ShowHiddenNode;
+
+    // Conditions
+    static const llvm::cl::opt<CondManager::CondMgrKind> ConditionType;
 };
 }  // namespace SVF
 

package/index.html

@@ -25,6 +25,8 @@
 
 <p><a href="https://github.com/svf-tools/SVF">SVF</a> is a static tool that enables scalable and precise interprocedural dependence analysis for C and C++ programs. SVF allows value-flow construction and pointer analysis to be performed iteratively, thereby providing increasingly improved precision for both. </p>
 
+For a pointer analysis framework that works for Java, we refer to <a href="https://qilinpta.github.io/"> Qilin</a>.
+
 <h2>
 <a id="what-kind-of-analyses-does-svf-provide" class="anchor" href="#what-kind-of-analyses-does-svf-provide" aria-hidden="true"><span class="octicon octicon-link"></span></a>What kind of analyses does SVF provide?</h2>
 

package/lib/SABER/PathCondAllocator.cpp

@@ -45,6 +45,9 @@ u32_t ContextCond::maximumPathLen = 0;
 u32_t ContextCond::maximumPath = 0;
 
 
+PathCondAllocator::PathCondAllocator() : condMgr(CondManager::getCondMgr(Options::ConditionType)) {
+
+}
 /*!
  * Allocate path condition for each branch
  */