svf-tools 1.0.438 → 1.0.441

package/include/Util/ExeState.h

@@ -0,0 +1,177 @@
+//===- ExeState.h -- Execution State ----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * ExeState.h
+ *
+ *  Created on: April 29, 2022
+ *      Author: Xiao
+ */
+
+#ifndef SVF_EXESTATE_H
+#define SVF_EXESTATE_H
+#include "Util/Z3Expr.h"
+#include "MemoryModel/SVFVariables.h"
+
+namespace SVF {
+
+#define AddressMask 0x7f000000
+#define FlippedAddressMask (AddressMask^0xffffffff)
+
+class ExeState {
+public:
+    typedef Map<u32_t, Z3Expr> VarToValMap;
+    typedef VarToValMap LocToValMap;
+
+protected:
+    VarToValMap varToVal;
+    LocToValMap locToVal;
+    Z3Expr pathConstraint;
+
+public:
+    ExeState() : pathConstraint(getContext().bool_val(true)) {}
+
+    ExeState(const Z3Expr &_pc, VarToValMap &_varToValMap, LocToValMap &_locToValMap) : varToVal(_varToValMap),
+                                                                                        locToVal(_locToValMap),
+                                                                                        pathConstraint(_pc) {}
+
+    ExeState(const ExeState &rhs) : varToVal(rhs.getVarToVal()), locToVal(rhs.getLocToVal()),
+                                    pathConstraint(rhs.getPathConstraint()) {
+
+    }
+
+    virtual ~ExeState() = default;
+
+    ExeState &operator=(const ExeState &rhs);
+
+    /// Overloading Operator==
+    bool operator==(const ExeState &rhs) const;
+
+    /// Overloading Operator!=
+    inline bool operator!=(const ExeState &rhs) const {
+        return !(*this == rhs);
+    }
+
+    /// Overloading Operator==
+    bool operator<(const ExeState &rhs) const;
+
+
+
+    z3::context &getContext() {
+        return Z3Expr::getContext();
+    }
+
+    const VarToValMap &getVarToVal() const {
+        return varToVal;
+    }
+
+    const LocToValMap &getLocToVal() const {
+        return locToVal;
+    }
+
+    const Z3Expr &getPathConstraint() const {
+        return pathConstraint;
+    }
+
+    void setPathConstraint(const Z3Expr &pc) {
+        pathConstraint = pc.simplify();
+    }
+
+    inline Z3Expr &operator[](u32_t varId) {
+        return getZ3Expr(varId);
+    }
+
+    /// Init Z3Expr for ValVar
+    void initValVar(const ValVar *valVar, Z3Expr &e);
+
+    /// Init Z3Expr for ObjVar
+    void initObjVar(const ObjVar *objVar, Z3Expr &e);
+
+    /// Return Z3 expression based on SVFVar ID
+    Z3Expr &getZ3Expr(u32_t varId);
+
+    /// Store value to location
+    void store(const Z3Expr &loc, const Z3Expr &value);
+
+    /// Load value at location
+    Z3Expr &load(const Z3Expr &loc);
+
+    /// The physical address starts with 0x7f...... + idx
+    inline u32_t getVirtualMemAddress(u32_t idx) const {
+        return AddressMask + idx;
+    }
+
+    /// Check bit value of val start with 0x7F000000, filter by 0xFF000000
+    inline bool isVirtualMemAddress(u32_t val) {
+        return (val & 0xff000000) == AddressMask;
+    }
+
+    /// Return the internal index if idx is an address otherwise return the value of idx
+    inline u32_t getInternalID(u32_t idx) const {
+        return (idx & FlippedAddressMask);
+    }
+
+    /// Return int value from an expression if it is a numeral, otherwise return an approximate value
+    inline s32_t z3Expr2NumValue(const Z3Expr &e) {
+        assert(e.is_numeral() && "not numeral?");
+        return e.get_numeral_int64();
+    }
+
+    /// Print values of all expressions
+    void printExprValues();
+
+private:
+    bool eqVarToValMap(const VarToValMap &lhs, const VarToValMap &rhs) const;
+    bool lessThanVarToValMap(const VarToValMap &lhs, const VarToValMap &rhs) const;
+protected:
+    inline void store(u32_t objId, const Z3Expr &z3Expr) {
+        locToVal[objId] = z3Expr.simplify();
+    }
+
+    inline Z3Expr &load(u32_t objId) {
+        return locToVal[objId];
+    }
+};
+}
+
+template<>
+struct std::hash<SVF::ExeState> {
+    size_t operator()(const SVF::ExeState &exeState) const {
+
+        size_t h = exeState.getVarToVal().size() * 2;
+        SVF::Hash<SVF::u32_t> hf;
+        for (const auto &t: exeState.getVarToVal()) {
+            h ^= hf(t.first) + 0x9e3779b9 + (h << 6) + (h >> 2);
+            h ^= hf(t.second.id()) + 0x9e3779b9 + (h << 6) + (h >> 2);
+        }
+
+        size_t h2 = exeState.getVarToVal().size() * 2;
+
+        for (const auto &t: exeState.getLocToVal()) {
+            h2 ^= hf(t.first) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
+            h2 ^= hf(t.second.id()) + 0x9e3779b9 + (h2 << 6) + (h2 >> 2);
+        }
+        SVF::Hash<std::pair<SVF::u32_t, SVF::u32_t>> pairH;
+
+        return pairH(make_pair(pairH(make_pair(h, h2)), exeState.getPathConstraint().id()));
+    }
+};
+#endif //SVF_EXESTATE_H

package/include/Util/Options.h

@@ -10,7 +10,6 @@
 #include "Util/NodeIDAllocator.h"
 #include "MSSA/MemSSA.h"
 #include "WPA/WPAPass.h"
-#include "Util/Conditions.h"
 
 namespace SVF
 {
@@ -255,8 +254,6 @@ public:
     // DOTGraphTraits
     static const llvm::cl::opt<bool> ShowHiddenNode;
 
-    // Conditions
-    static const llvm::cl::opt<CondManager::CondMgrKind> ConditionType;
 };
 }  // namespace SVF
 

package/include/Util/Z3Expr.h

@@ -0,0 +1,235 @@
+//===- Z3Expr.h -- Z3 conditions----------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+/*
+ * Z3Expr.h
+ *
+ *  Created on: April 29, 2022
+ *      Author: Xiao
+ */
+
+#ifndef Z3_EXAMPLE_Z3EXPR_H
+#define Z3_EXAMPLE_Z3EXPR_H
+
+#include "z3++.h"
+#include "Util/SVFBasicTypes.h"
+
+namespace SVF {
+
+    class Z3Expr {
+    public:
+        static z3::context *ctx;
+
+    private:
+        z3::expr e;
+
+        Z3Expr(float f); // placeholder don't support floating point expression
+        Z3Expr(double f); // placeholder don't support floating point expression
+
+    public:
+
+        Z3Expr() : e(nullExpr()) {
+        }
+
+        Z3Expr(const z3::expr &_e) : e(_e) {
+        }
+
+        Z3Expr(int i) : e(getContext().int_val(i)) {
+        }
+
+        Z3Expr(const Z3Expr &z3Expr) : e(z3Expr.getExpr()) {
+        }
+
+        virtual ~Z3Expr() = default;
+
+        inline Z3Expr &operator=(const Z3Expr &rhs) {
+            if (this->id() != rhs.id()) {
+                e = rhs.getExpr();
+            }
+            return *this;
+        }
+
+        const z3::expr &getExpr() const {
+            return e;
+        }
+
+        /// Get z3 context, singleton design here to make sure we only have one context
+        static z3::context &getContext() {
+            if (ctx == nullptr) {
+                ctx = new z3::context();
+            }
+            return *ctx;
+        }
+
+        /// release z3 context
+        static void releaseContext() {
+            delete ctx;
+            ctx = nullptr;
+        }
+
+        /// null expression
+        static z3::expr nullExpr() {
+            return getContext().int_const("null");
+        }
+
+        /// get id
+        inline u32_t id() const {
+            return e.id();
+        }
+
+        inline const std::string to_string() const {
+            return e.to_string();
+        }
+
+        inline bool is_numeral() const {
+            return e.is_numeral();
+        }
+
+        inline bool is_bool() const {
+            return e.is_bool();
+        }
+
+        inline Z3Expr simplify() const {
+            return e.simplify();
+        }
+
+        inline int64_t get_numeral_int64() const {
+            return e.get_numeral_int64();
+        }
+
+        inline int get_numeral_int() const {
+            return e.get_numeral_int();
+        }
+
+        //{% reload operator
+        friend Z3Expr operator==(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() == rhs.getExpr();
+        }
+
+        friend Z3Expr operator!=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() != rhs.getExpr();
+        }
+
+        friend Z3Expr operator>(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() > rhs.getExpr();
+        }
+
+        friend Z3Expr operator<(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() < rhs.getExpr();
+        }
+
+        friend Z3Expr operator<=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() <= rhs.getExpr();
+        }
+
+        friend Z3Expr operator>=(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() >= rhs.getExpr();
+        }
+
+        friend Z3Expr operator+(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() + rhs.getExpr();
+        }
+
+        friend Z3Expr operator-(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() - rhs.getExpr();
+        }
+
+        friend Z3Expr operator*(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() * rhs.getExpr();
+        }
+
+        friend Z3Expr operator/(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() / rhs.getExpr();
+        }
+
+        friend Z3Expr operator%(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() % rhs.getExpr();
+        }
+
+        friend Z3Expr operator^(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() ^ rhs.getExpr();
+        }
+
+        friend Z3Expr operator&(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() & rhs.getExpr();
+        }
+
+        friend Z3Expr operator|(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() | rhs.getExpr();
+        }
+
+        friend Z3Expr ashr(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return ashr(lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend Z3Expr shl(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return shl(lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend Z3Expr int2bv(u32_t n, const Z3Expr &e) {
+            return int2bv(n, e.getExpr());
+        }
+
+        friend Z3Expr bv2int(const Z3Expr &e, bool isSigned) {
+            return z3::bv2int(e.getExpr(), isSigned);
+        }
+
+        friend Z3Expr operator&&(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() && rhs.getExpr();
+        }
+
+        friend Z3Expr operator||(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return lhs.getExpr() || rhs.getExpr();
+        }
+
+        friend Z3Expr operator!(const Z3Expr &lhs) {
+            return !lhs.getExpr();
+        }
+
+        friend Z3Expr ite(const Z3Expr& cond, const Z3Expr& lhs, const Z3Expr& rhs) {
+            return ite(cond.getExpr(), lhs.getExpr(), rhs.getExpr());
+        }
+
+        friend std::ostream &operator<<(std::ostream &out, const Z3Expr &expr) {
+            out << expr.getExpr();
+            return out;
+        }
+
+        friend bool eq(const Z3Expr &lhs, const Z3Expr &rhs) {
+            return eq(lhs.getExpr(), rhs.getExpr());
+        }
+
+        z3::sort get_sort() const {
+            return getExpr().get_sort();
+        }
+        //%}
+    };
+}
+
+/// Specialise hash for AbsCxtDPItem.
+template<>
+struct std::hash<SVF::Z3Expr> {
+    size_t operator()(const SVF::Z3Expr &z3Expr) const {
+        return z3Expr.id();
+    }
+};
+
+#endif //Z3_EXAMPLE_Z3EXPR_H

package/include/WPA/FlowSensitiveTBHC.h

@@ -13,7 +13,7 @@
 #include "SVF-FE/DCHG.h"
 #include "Graphs/SVFGOPT.h"
 #include "MSSA/SVFGBuilder.h"
-#include "Util/TypeBasedHeapCloning.h"
+#include "TypeBasedHeapCloning.h"
 #include "WPA/FlowSensitive.h"
 #include "MemoryModel/PointsTo.h"
 

package/lib/MemoryModel/PointerAnalysisImpl.cpp

@@ -10,7 +10,7 @@
 #include "SVF-FE/CPPUtil.h"
 #include "SVF-FE/DCHG.h"
 #include "Util/Options.h"
-#include "Util/IRAnnotator.h"
+#include "SVF-FE/IRAnnotator.h"
 #include <fstream>
 #include <sstream>
 

package/lib/SABER/PathCondAllocator.cpp

@@ -45,7 +45,7 @@ u32_t ContextCond::maximumPathLen = 0;
 u32_t ContextCond::maximumPath = 0;
 
 
-PathCondAllocator::PathCondAllocator() : condMgr(CondManager::getCondMgr(Options::ConditionType)) {
+PathCondAllocator::PathCondAllocator() : condMgr(BDDExprManager::getBDDExprMgr()) {
 
 }
 /*!

package/lib/Util/BDDExpr.cpp

@@ -0,0 +1,206 @@
+//===- BDDExpr.cpp -- Context/path conditions in the form of BDDs----------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+
+/*
+ * Conditions.cpp
+ *
+ *  Created on: Oct 19, 2021
+ *      Author: Yulei and Xiao
+ */
+
+#include "Util/Options.h"
+#include "Util/BDDExpr.h"
+
+using namespace SVF;
+using namespace SVFUtil;
+
+
+BDDExprManager::BDDExpr *BDDExprManager::trueCond = nullptr;
+BDDExprManager::BDDExpr *BDDExprManager::falseCond = nullptr;
+BDDExprManager *BDDExprManager::bddExprMgr = nullptr;
+u32_t BDDExprManager::totalCondNum = 0;
+
+BDDExprManager::BDDExprManager() {
+    m_bdd_mgr = Cudd_Init(0, 0, CUDD_UNIQUE_SLOTS, CUDD_CACHE_SLOTS, 0);
+    trueCond = BddOne();
+    falseCond = BddZero();
+}
+
+BDDExprManager::~BDDExprManager() {
+    Cudd_Quit(m_bdd_mgr);
+}
+
+BDDExprManager *BDDExprManager::getBDDExprMgr() {
+    if (bddExprMgr == nullptr) {
+        bddExprMgr = new BDDExprManager();
+    }
+    return bddExprMgr;
+}
+
+BDDExprManager::BDDExpr *BDDExprManager::createFreshBranchCond(const Instruction *inst) {
+    u32_t condCountIdx = totalCondNum++;
+    BDDExpr *bddCond = createCond(condCountIdx);
+    setCondInst(bddCond, inst);
+    auto *negCond = NEG(bddCond);
+    setCondInst(negCond, inst);
+    return bddCond;
+}
+
+/// Operations on conditions.
+//@{
+/// use Cudd_bddAndLimit interface to avoid bdds blow up
+BDDExprManager::BDDExpr *BDDExprManager::AND(BDDExpr *lhs, BDDExpr *rhs) {
+    if (lhs == getFalseCond() || rhs == getFalseCond())
+        return getFalseCond();
+    else if (lhs == getTrueCond())
+        return rhs;
+    else if (rhs == getTrueCond())
+        return lhs;
+    else {
+        BDDExpr *tmp = Cudd_bddAndLimit(m_bdd_mgr, lhs, rhs, Options::MaxBddSize);
+        if (tmp == nullptr) {
+            SVFUtil::writeWrnMsg("exceeds max bdd size \n");
+            ///drop the rhs condition
+            return lhs;
+        } else {
+            Cudd_Ref(tmp);
+            return tmp;
+        }
+    }
+}
+
+/*!
+ * Use Cudd_bddOrLimit interface to avoid bdds blow up
+ */
+BDDExprManager::BDDExpr *BDDExprManager::OR(BDDExpr *lhs, BDDExpr *rhs) {
+    if (lhs == getTrueCond() || rhs == getTrueCond())
+        return getTrueCond();
+    else if (lhs == getFalseCond())
+        return rhs;
+    else if (rhs == getFalseCond())
+        return lhs;
+    else {
+        BDDExpr *tmp = Cudd_bddOrLimit(m_bdd_mgr, lhs, rhs, Options::MaxBddSize);
+        if (tmp == nullptr) {
+            SVFUtil::writeWrnMsg("exceeds max bdd size \n");
+            /// drop the two conditions here
+            return getTrueCond();
+        } else {
+            Cudd_Ref(tmp);
+            return tmp;
+        }
+    }
+}
+
+BDDExprManager::BDDExpr *BDDExprManager::NEG(BDDExpr *lhs) {
+
+    if (lhs == getTrueCond())
+        return getFalseCond();
+    else if (lhs == getFalseCond())
+        return getTrueCond();
+    else
+        return Cudd_Not(lhs);
+}
+//@}
+
+/*!
+ * Whether **All Paths** are reachable
+ */
+bool BDDExprManager::isAllPathReachable(const BDDExpr *e) {
+    return isEquivalentBranchCond(e, getTrueCond());
+}
+
+/*!
+ * Utilities for dumping conditions. These methods use global functions from CUDD
+ * package and they can be removed outside this class scope to be used by others.
+ */
+void BDDExprManager::ddClearFlag(BDDExpr *f) const {
+    if (!Cudd_IsComplement(f->next))
+        return;
+    /* Clear visited flag. */
+    f->next = Cudd_Regular(f->next);
+    if (cuddIsConstant(f))
+        return;
+    ddClearFlag(cuddT(f));
+    ddClearFlag(Cudd_Regular(cuddE(f)));
+    return;
+}
+
+void BDDExprManager::BddSupportStep(BDDExpr *f, NodeBS &support) const {
+    if (cuddIsConstant(f) || Cudd_IsComplement(f->next))
+        return;
+
+    support.set(f->index);
+
+    BddSupportStep(cuddT(f), support);
+    BddSupportStep(Cudd_Regular(cuddE(f)), support);
+    /* Mark as visited. */
+    f->next = Cudd_Complement(f->next);
+}
+
+void BDDExprManager::extractSubConds(const BDDExpr *f, NodeBS &support) const {
+    BddSupportStep(Cudd_Regular(f), support);
+    ddClearFlag(Cudd_Regular(f));
+}
+
+/*!
+ * Dump BDD
+ */
+void BDDExprManager::dump(const BDDExpr *lhs, OutStream &O) {
+    if (lhs == getTrueCond())
+        O << "T";
+    else {
+        NodeBS support;
+        extractSubConds(lhs, support);
+        for (NodeBS::iterator iter = support.begin(); iter != support.end();
+             ++iter) {
+            unsigned rid = *iter;
+            O << rid << " ";
+        }
+    }
+}
+
+
+/*!
+ * Dump BDD
+ */
+std::string BDDExprManager::dumpStr(const BDDExpr *e) const {
+    std::string str;
+    if (e == getTrueCond())
+        str += "T";
+    else {
+        NodeBS support;
+        extractSubConds(e, support);
+        for (NodeBS::iterator iter = support.begin(); iter != support.end();
+             ++iter) {
+            unsigned rid = *iter;
+            char int2str[16];
+            sprintf(int2str, "%d", rid);
+            str += int2str;
+            str += " ";
+        }
+    }
+    return str;
+}
+
+