svf-tools 1.0.479 → 1.0.482

package/include/MemoryModel/SVFVariables.h

@@ -58,7 +58,6 @@ public:
     /// GepValNode: tempory gep obj node for field sensitivity
     /// FIObjNode: for field insensitive analysis
     /// DummyValNode and DummyObjNode: for non-llvm-value node
-    /// Clone*Node: objects created by TBHC.
     enum PNODEK
     {
         ValNode,
@@ -70,9 +69,6 @@ public:
         FIObjNode,
         DummyValNode,
         DummyObjNode,
-        CloneGepObjNode,   // NOTE: only used for TBHC.
-        CloneFIObjNode,    // NOTE: only used for TBHC.
-        CloneDummyObjNode  // NOTE: only used for TBHC.
     };
 
 
@@ -327,20 +323,14 @@ public:
         return node->getNodeKind() == SVFVar::ObjNode ||
                node->getNodeKind() == SVFVar::GepObjNode ||
                node->getNodeKind() == SVFVar::FIObjNode ||
-               node->getNodeKind() == SVFVar::DummyObjNode ||
-               node->getNodeKind() == SVFVar::CloneGepObjNode ||
-               node->getNodeKind() == SVFVar::CloneFIObjNode ||
-               node->getNodeKind() == SVFVar::CloneDummyObjNode;
+               node->getNodeKind() == SVFVar::DummyObjNode;
     }
     static inline bool classof(const GenericPAGNodeTy *node)
     {
         return node->getNodeKind() == SVFVar::ObjNode ||
                node->getNodeKind() == SVFVar::GepObjNode ||
                node->getNodeKind() == SVFVar::FIObjNode ||
-               node->getNodeKind() == SVFVar::DummyObjNode ||
-               node->getNodeKind() == SVFVar::CloneGepObjNode ||
-               node->getNodeKind() == SVFVar::CloneFIObjNode ||
-               node->getNodeKind() == SVFVar::CloneDummyObjNode;
+               node->getNodeKind() == SVFVar::DummyObjNode;
     }
     //@}
 
@@ -448,18 +438,15 @@ public:
     }
     static inline bool classof(const ObjVar * node)
     {
-        return node->getNodeKind() == SVFVar::GepObjNode
-               || node->getNodeKind() == SVFVar::CloneGepObjNode;
+        return node->getNodeKind() == SVFVar::GepObjNode;
     }
     static inline bool classof(const SVFVar *node)
     {
-        return node->getNodeKind() == SVFVar::GepObjNode
-               || node->getNodeKind() == SVFVar::CloneGepObjNode;
+        return node->getNodeKind() == SVFVar::GepObjNode;
     }
     static inline bool classof(const GenericPAGNodeTy *node)
     {
-        return node->getNodeKind() == SVFVar::GepObjNode
-               || node->getNodeKind() == SVFVar::CloneGepObjNode;
+        return node->getNodeKind() == SVFVar::GepObjNode;
     }
     //@}
 
@@ -527,18 +514,15 @@ public:
     }
     static inline bool classof(const ObjVar * node)
     {
-        return node->getNodeKind() == SVFVar::FIObjNode
-               || node->getNodeKind() == SVFVar::CloneFIObjNode;
+        return node->getNodeKind() == SVFVar::FIObjNode;
     }
     static inline bool classof(const SVFVar *node)
     {
-        return node->getNodeKind() == SVFVar::FIObjNode
-               || node->getNodeKind() == SVFVar::CloneFIObjNode;
+        return node->getNodeKind() == SVFVar::FIObjNode;
     }
     static inline bool classof(const GenericPAGNodeTy *node)
     {
-        return node->getNodeKind() == SVFVar::FIObjNode
-               || node->getNodeKind() == SVFVar::CloneFIObjNode;
+        return node->getNodeKind() == SVFVar::FIObjNode;
     }
     //@}
 
@@ -705,18 +689,15 @@ public:
     }
     static inline bool classof(const SVFVar *node)
     {
-        return node->getNodeKind() == SVFVar::DummyObjNode
-               || node->getNodeKind() == SVFVar::CloneDummyObjNode;
+        return node->getNodeKind() == SVFVar::DummyObjNode;
     }
     static inline bool classof(const ObjVar *node)
     {
-        return node->getNodeKind() == SVFVar::DummyObjNode
-               || node->getNodeKind() == SVFVar::CloneDummyObjNode;
+        return node->getNodeKind() == SVFVar::DummyObjNode;
     }
     static inline bool classof(const GenericPAGNodeTy *node)
     {
-        return node->getNodeKind() == SVFVar::DummyObjNode
-               || node->getNodeKind() == SVFVar::CloneDummyObjNode;
+        return node->getNodeKind() == SVFVar::DummyObjNode;
     }
     //@}
 
@@ -735,116 +716,6 @@ public:
     virtual const std::string toString() const;
 };
 
-/*
- * Clone object node for dummy objects.
- */
-class CloneDummyObjVar: public DummyObjVar
-{
-public:
-    //@{ Methods to support type inquiry through isa, cast, and dyn_cast:
-    static inline bool classof(const CloneDummyObjVar *)
-    {
-        return true;
-    }
-    static inline bool classof(const SVFVar *node)
-    {
-        return node->getNodeKind() == SVFVar::CloneDummyObjNode;
-    }
-    static inline bool classof(const GenericPAGNodeTy *node)
-    {
-        return node->getNodeKind() == SVFVar::CloneDummyObjNode;
-    }
-    //@}
-
-    /// Constructor
-    CloneDummyObjVar(NodeID i, const MemObj* m, PNODEK ty = CloneDummyObjNode)
-        : DummyObjVar(i, m, ty)
-    {
-    }
-
-    /// Return name of this node
-    inline const std::string getValueName() const
-    {
-        return "clone of " + ObjVar::getValueName();
-    }
-
-    virtual const std::string toString() const;
-};
-
-/*
- * Clone object for GEP objects.
- */
-class CloneGepObjVar : public GepObjVar
-{
-public:
-    //@{ Methods to support type inquiry through isa, cast, and dyn_cast:
-    static inline bool classof(const CloneGepObjVar *)
-    {
-        return true;
-    }
-    static inline bool classof(const SVFVar *node)
-    {
-        return node->getNodeKind() == SVFVar::CloneGepObjNode;
-    }
-    static inline bool classof(const GenericPAGNodeTy *node)
-    {
-        return node->getNodeKind() == SVFVar::CloneGepObjNode;
-    }
-    //@}
-
-    /// Constructor
-    CloneGepObjVar(const MemObj* mem, NodeID i, const LocationSet& l, PNODEK ty = CloneGepObjNode) :
-        GepObjVar(mem, i, l, ty)
-    {
-    }
-
-    /// Return name of this node
-    inline const std::string getValueName() const
-    {
-        return "clone (gep) of " + GepObjVar::getValueName();
-    }
-
-    virtual const std::string toString() const;
-};
-
-/*
- * Clone object for FI objects.
- */
-class CloneFIObjVar : public FIObjVar
-{
-public:
-    //@{ Methods to support type inquiry through isa, cast, and dyn_cast:
-    static inline bool classof(const CloneFIObjVar *)
-    {
-        return true;
-    }
-    static inline bool classof(const SVFVar *node)
-    {
-        return node->getNodeKind() == SVFVar::CloneFIObjNode;
-    }
-    static inline bool classof(const GenericPAGNodeTy *node)
-    {
-        return node->getNodeKind() == SVFVar::CloneFIObjNode;
-    }
-    //@}
-
-    /// Constructor
-    CloneFIObjVar(const Value* val, NodeID i, const MemObj* mem, PNODEK ty = CloneFIObjNode) :
-        FIObjVar(val, i, mem, ty)
-    {
-    }
-
-    /// Return name of this node
-    inline const std::string getValueName() const
-    {
-        return "clone (FI) of " + FIObjVar::getValueName();
-    }
-
-    virtual const std::string toString() const;
-};
-
 } // End namespace SVF
 
-
-
 #endif /* OBJECTANDSYMBOL_H_ */

package/include/SVF-FE/LLVMModule.h

@@ -208,30 +208,6 @@ public:
         return getModuleNum() == 0;
     }
 
-    /// Returns true if all LLVM modules are compiled with ctir.
-    bool allCTir(void) const
-    {
-        // Iterate over all modules. If a single module does not have the correct ctir module flag,
-        // short-circuit and return false.
-        for (u32_t i = 0; i < getModuleNum(); ++i)
-        {
-            llvm::Metadata *ctirModuleFlag = llvmModuleSet->getModule(i)->getModuleFlag(cppUtil::ctir::derefMDName);
-            if (ctirModuleFlag == nullptr)
-            {
-                return false;
-            }
-
-            llvm::ConstantAsMetadata *flagConstMetadata = SVFUtil::dyn_cast<llvm::ConstantAsMetadata>(ctirModuleFlag);
-            ConstantInt *flagConstInt = SVFUtil::dyn_cast<ConstantInt>(flagConstMetadata->getValue());
-            if (flagConstInt->getZExtValue() != cppUtil::ctir::moduleFlagValue)
-            {
-                return false;
-            }
-        }
-
-        return true;
-    }
-
 private:
     void loadModules(const std::vector<std::string> &moduleNameVec);
     void addSVFMain();

package/include/Util/ExtAPI.h

@@ -40,54 +40,66 @@
 #include <map>
 
 #define EXTAPI_JSON_PATH "/lib/Util/ExtAPI.json"
+#define JSON_OPT_OVERWRITE "overwrite_app_function"
+#define JSON_OPT_FUNCTIONTYPE "type"
 
 namespace SVF
 {
 
 /*
 
-    Specifications in ExtAPI.json
-
-    Specification language: The specification language of external function includes:
-    1. the name of the function,
-    2. the type of the function,
-    3. the operations of the function.
-
-    Funtion type: Funtion type represents some property of the function.
-    For example,
-    ”EFT_ALLOC“, represents if this external function allocates a new object and assigns it to one of its arguments,
-    For the selection of Function type and a more detailed explanation, please refer to enum extf_t in ExtAPI.h.
-
-    Function operations: Function operations indicates the relationship between input and output,
-    mainly the relationship between function parameters, or between parameters and return values after function is executed.
-    For example,
-    "copy": ["A2", "L"], indicates that after this external function is executed, the value of the 2th parameter is copied into the return value.
-    For the selection of Function type and a more detailed explanation, please refer to enum extType in ExtAPI.h.
-
-    For operands of function operation, e.g., "A2", "L", there are the following options:
-    "A": represents an parameter;
-    "N": represents a number;
-    "R": represents a reference;
-    "L": represents a return value;
-    "V": represents a dummy node;
-
-    Among them, parameter may have multiple forms, because there may be multiple parameters, and parameter may be a reference or complex structure,
-
-    Here we use regular expressions "(AN)(R|RN)^*" to represent parameter, for example,
-    "A0":    represents the 1th parameter;
-    "A2R":   represents that the 3th parameter is a reference;
-    "A1R2":  represents the 3th substructure of 2th parameter "A1R", where "A1R" is a complex structure;
-    "A2R3R": represents the 4th substructure of 3th parameter "A2R" is a reference, where "A2R" is a complex structure;
-
-
-    Specification format:
-    "functionName": {
-        "type": "functional type",
-        "function operation_1": [ operand_1, operand_2, ... , operand_n],
-        "function operation_2": [ operand_1, operand_2, ... , operand_n],
-        ...
-        "function operation_n": [ operand_1, operand_2, ... , operand_n]
-    }
+** Specifications in ExtAPI.json
+
+*** [1] Overview of the Specification Language
+The specification language of external functions is based on the JSON format. And every function defined by the Specification Language is an object that represents the specification rules. These Specification Language objects for functions contain four parts:
+1. the name of the function,
+2. the switch that controls whether the specification rules defined in the ExtAPI.json overwrite the functions defined in the user code,
+3. the type of the function,
+4. the operations conducted by the function.
+
+*** [2] Overwriting the user-defined functions
+The switch *overwrite_app_function* controls whether the specification rules defined in the ExtAPI.json overwrite the functions defined in the user code (e.g., CPP files). When the switch *overwrite_app_function* is set to a value of 1, SVF will use the specification rules in ExtAPI.json to conduct the analysis and ignore the user-defined functions in the input CPP/bc files.
+overwrite_app_function = 0: Analyze the user-defined functions.
+overwrite_app_function = 1: Use specifications in ExtAPI.json to overwrite the user-defined functions.
+
+*** [3] Function types
+Function type represents the properties of the function.
+For example,
+"EFT_ALLOC" represents if this external function allocates a new object and assigns it to one of its arguments,
+For the selection of function type and a more detailed explanation, please refer to the definition of enum *extf_t* in ExtAPI.h.
+
+*** [4] Function operations
+Function operations indicate the relationships between input and output,
+mainly between function parameters or between parameters and return values after the execution.
+For example,
+"copy": ["A2", "L"] indicates that after this external function is executed, the value of the 2nd parameter is copied into the return value.
+For the selection of function type and a more detailed explanation, please refer to the definition of enum *extType* in ExtAPI.h.
+
+For operands of function operation, e.g., "A2", "L", there are the following options:
+"A": represents a parameter;
+"N": represents a number;
+"R": represents a reference;
+"L": represents a return value;
+"V": represents a dummy node;
+
+Among them, a parameter may have multiple forms because there may be various parameters, and the parameter may be a reference or complex structure,
+
+Here we use regular expressions "(AN)(R|RN)^*" to represent parameters, for example,
+"A0": represents the 1st parameter;
+"A2R": represents that the 3rd parameter is a reference;
+"A1R2": represents the 3rd substructure of the 2nd parameter "A1R", where "A1R" is a complex structure;
+"A2R3R": represents the 4th substructure of the 3rd parameter "A2R" is a reference, where "A2R" is a complex structure;
+
+
+** Specification format:
+"functionName": {
+"type": "functional type",
+"overwrite_app_function:" 0/1,
+"function operation_1": [ operand_1, operand_2, ... , operand_n],
+"function operation_2": [ operand_1, operand_2, ... , operand_n],
+...
+"function operation_n": [ operand_1, operand_2, ... , operand_n]
+}
 */
 
 
@@ -233,6 +245,11 @@ public:
     // Get property of the operation, e.g. "EFT_A1R_A0R"
     extType get_type(const SVF::SVFFunction *callee);
 
+    // Get priority of he function, return value
+    // 0: Apply user-defined functions
+    // 1: Apply function specification in ExtAPI.json
+    u32_t isOverwrittenAppFunction(const SVF::SVFFunction *callee);
+
     // Does (F) have a static var X (unavailable to us) that its return points to?
     bool has_static(const SVFFunction *F);
 

package/include/Util/Options.h

@@ -237,13 +237,6 @@ public:
     static const llvm::cl::opt<bool> PtsDiff;
     static const llvm::cl::opt<bool> MergePWC;
 
-    // FlowSensitive.cpp
-    static const llvm::cl::opt<bool> CTirAliasEval;
-
-    //FlowSensitiveTBHC.cpp
-    static const llvm::cl::opt<bool> TBHCStoreReuse;
-    static const llvm::cl::opt<bool> TBHCAllReuse;
-
     // WPAPass.cpp
     static const llvm::cl::opt<bool> AnderSVFG;
     static const llvm::cl::opt<bool> SABERFULLSVFG;

package/include/WPA/FlowSensitive.h

@@ -240,10 +240,6 @@ protected:
     /// Return TRUE if this is a strong update STORE statement.
     bool isStrongUpdate(const SVFGNode* node, NodeID& singleton);
 
-    /// Prints some easily parseable stats on aliasing of relevant CTir TL PTS.
-    /// Format: eval-ctir-aliases #TOTAL_TESTS #MAY_ALIAS #NO_ALIAS
-    virtual void printCTirAliasStats(void);
-
     /// Fills may/noAliases for the location/pointer pairs in cmp.
     virtual void countAliases(Set<std::pair<NodeID, NodeID>> cmp, unsigned *mayAliases, unsigned *noAliases);
 

package/lib/MemoryModel/PointerAnalysis.cpp

@@ -42,7 +42,6 @@
 #include "MemoryModel/PTAStat.h"
 #include "Graphs/ThreadCallGraph.h"
 #include "Graphs/ICFG.h"
-#include "WPA/FlowSensitiveTBHC.h"
 
 #include <iomanip>
 #include <iostream>
@@ -117,20 +116,10 @@ void PointerAnalysis::initialize()
     assert(pag && "SVFIR has not been built!");
     if (chgraph == nullptr)
     {
-        if (LLVMModuleSet::getLLVMModuleSet()->allCTir())
-        {
-            DCHGraph *dchg = new DCHGraph(pag->getModule());
-            // TODO: we might want to have an option for extending.
-            dchg->buildCHG(true);
-            chgraph = dchg;
-        }
-        else
-        {
-            CHGraph *chg = new CHGraph(pag->getModule());
-            CHGBuilder builder(chg);
-            builder.buildCHG();
-            chgraph = chg;
-        }
+        CHGraph *chg = new CHGraph(pag->getModule());
+        CHGBuilder builder(chg);
+        builder.buildCHG();
+        chgraph = chg;
     }
 
     svfMod = pag->getModule();
@@ -209,8 +198,6 @@ void PointerAnalysis::finalize()
     /// Print statistics
     dumpStat();
 
-    SVFIR* pag = SVFIR::getPAG();
-
     /// Dump results
     if (Options::PTSPrint)
     {
@@ -233,11 +220,6 @@ void PointerAnalysis::finalize()
     if (Options::CallGraphDotGraph)
         getPTACallGraph()->dump("callgraph_final");
 
-    // FSTBHC has its own TBHC-specific test validation.
-    if(!pag->isBuiltFromFile() && alias_validation
-            && !SVFUtil::isa<FlowSensitiveTBHC>(this))
-        validateTests();
-
     if (!Options::UsePreCompFieldSensitive)
         resetObjFieldSensitive();
 }

package/lib/MemoryModel/PointerAnalysisImpl.cpp

@@ -43,7 +43,7 @@ BVDataPTAImpl::BVDataPTAImpl(SVFIR* p, PointerAnalysis::PTATY type, bool alias_c
         else if (Options::ptDataBacking == PTBackingType::Persistent) ptD = new PersDiffPTDataTy(getPtCache(), false);
         else assert(false && "BVDataPTAImpl::BVDataPTAImpl: unexpected points-to backing type!");
     }
-    else if (type == FSSPARSE_WPA || type == FSTBHC_WPA)
+    else if (type == FSSPARSE_WPA)
     {
         if (Options::INCDFPTData)
         {

package/lib/MemoryModel/SVFVariables.cpp

@@ -41,7 +41,7 @@ using namespace SVFUtil;
 SVFVar::SVFVar(const Value* val, NodeID i, PNODEK k) :
     GenericPAGNodeTy(i,k), value(val)
 {
-    assert( ValNode <= k && k <= CloneDummyObjNode && "new SVFIR node kind?");
+    assert( ValNode <= k && k <= DummyObjNode && "new SVFIR node kind?");
     switch (k)
     {
     case ValNode:
@@ -67,9 +67,6 @@ SVFVar::SVFVar(const Value* val, NodeID i, PNODEK k) :
     case GepObjNode:
     case FIObjNode:
     case DummyObjNode:
-    case CloneGepObjNode:
-    case CloneFIObjNode:
-    case CloneDummyObjNode:
     {
         isPtr = true;
         if(val)
@@ -202,30 +199,6 @@ const std::string DummyObjVar::toString() const
     return rawstr.str();
 }
 
-const std::string CloneDummyObjVar::toString() const
-{
-    std::string str;
-    raw_string_ostream rawstr(str);
-    rawstr << "CloneDummyObjVar ID: " << getId();
-    return rawstr.str();
-}
-
-const std::string CloneGepObjVar::toString() const
-{
-    std::string str;
-    raw_string_ostream rawstr(str);
-    rawstr << "CloneGepObjVar ID: " << getId();
-    return rawstr.str();
-}
-
-const std::string CloneFIObjVar::toString() const
-{
-    std::string str;
-    raw_string_ostream rawstr(str);
-    rawstr << "CloneFIObjVar ID: " << getId();
-    return rawstr.str();
-}
-
 /// Whether it is constant data, i.e., "0", "1.001", "str"
 /// or llvm's metadata, i.e., metadata !4087
 bool SVFVar::isConstantData() const

package/lib/SVF-FE/CPPUtil.cpp

@@ -263,13 +263,6 @@ bool cppUtil::isVirtualCallSite(CallSite cs)
     if (cs.getCalledFunction() != nullptr || cs.arg_empty())
         return false;
 
-    // When compiled with ctir, we'd be using the DCHG which has its own
-    // virtual annotations.
-    if (LLVMModuleSet::getLLVMModuleSet()->allCTir())
-    {
-        return cs.getInstruction()->getMetadata(cppUtil::ctir::derefMDName) != nullptr;
-    }
-
     const Value *vfunc = cs.getCalledValue();
     if (const LoadInst *vfuncloadinst = SVFUtil::dyn_cast<LoadInst>(vfunc))
     {

package/lib/SVF-FE/SVFIRBuilder.cpp

@@ -1207,9 +1207,9 @@ void SVFIRBuilder::handleExtCall(CallSite cs, const SVFFunction *callee)
             // The external function exists in ExtAPI.json
             if (item != nullptr)
             {
-                //  Get the first operation of the function
                 cJSON *obj = item->child;
-                obj = obj -> next;
+                //  Get the first operation of the function
+                obj = obj -> next -> next;
                 while (obj)
                 {
                     std::string op = obj->string;

package/lib/SVF-FE/SymbolTableBuilder.cpp

@@ -114,6 +114,10 @@ void SymbolTableBuilder::buildMemModel(SVFModule* svfModule)
             {
                 collectSym(ld->getPointerOperand());
             }
+            else if (const AllocaInst *alloc = SVFUtil::dyn_cast<AllocaInst>(inst))
+            {
+                collectSym(alloc->getArraySize());
+            }
             else if (const PHINode *phi = SVFUtil::dyn_cast<PHINode>(inst))
             {
                 for (u32_t i = 0; i < phi->getNumIncomingValues(); ++i)

package/lib/Util/ExtAPI.cpp

@@ -138,7 +138,7 @@ ExtAPI::extType ExtAPI::get_type(const SVF::SVFFunction *F)
     {
         //  Get the first operation of the function
         cJSON *obj = item->child;
-        if (strcmp(obj->string, "type") == 0)
+        if (strcmp(obj->string, JSON_OPT_FUNCTIONTYPE) == 0)
             type = obj->valuestring;
         else
             assert(false && "The function operation format is illegal!");
@@ -150,6 +150,25 @@ ExtAPI::extType ExtAPI::get_type(const SVF::SVFFunction *F)
         return it->second;
 }
 
+// Get priority of he function, return value
+// 0: Apply user-defined functions
+// 1: Apply function specification in ExtAPI.json
+u32_t ExtAPI::isOverwrittenAppFunction(const SVF::SVFFunction *callee)
+{
+    std::string funName = get_name(callee);
+    cJSON *item = get_FunJson(funName);
+    if (item != nullptr)
+    {
+        cJSON *obj = item->child;
+        obj = obj->next;
+        if (strcmp(obj->string, JSON_OPT_OVERWRITE) == 0)
+            return obj->valueint;
+        else
+            assert(false && "The function operation format is illegal!");
+    }
+    return 0;
+}
+
 // Does (F) have a static var X (unavailable to us) that its return points to?
 bool ExtAPI::has_static(const SVFFunction *F)
 {
@@ -240,7 +259,20 @@ bool ExtAPI::is_ext(const SVFFunction *F)
     else
     {
         ExtAPI::extType t = get_type(F);
-        res = t == EFT_ALLOC || t == EFT_REALLOC || t == EFT_NOSTRUCT_ALLOC || t == EFT_NOOP || t == EFT_FREE;
+        if (t != EFT_NULL)
+        {
+            u32_t overwrittenAppFunction = isOverwrittenAppFunction(F);
+            // overwrittenAppFunction = 1: Execute function specification in ExtAPI.json
+            // F is considered as external function
+            if (overwrittenAppFunction == 1)
+                res = 1;
+            // overwrittenAppFunction = 0: Execute user-defined functions
+            // F is not considered as external function
+            else
+                res = 0;
+        }
+        else
+            res = 0;
     }
     return res;
 }