svf-tools 1.0.569 → 1.0.571

package/lib/CFL/CFLStat.cpp

@@ -0,0 +1,269 @@
+//===- CFLStat.cpp -- Statistics of CFL Reachability's analysis------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * CFLStat.cpp
+ *
+ *  Created on: 17 Sep, 2022
+ *      Author: Pei Xu
+ */
+
+#include "CFL/CFLStat.h"
+
+using namespace SVF;
+using namespace SVFUtil;
+using namespace std;
+
+u32_t CFLStat::_MaxPtsSize = 0;
+u32_t CFLStat::_NumOfCycles = 0;
+u32_t CFLStat::_NumOfPWCCycles = 0;
+u32_t CFLStat::_NumOfNodesInCycles = 0;
+u32_t CFLStat::_MaxNumOfNodesInSCC = 0;
+
+const char* CFLStat::CollapseTime = "CollapseTime";
+
+/*!
+ * Constructor
+ */
+CFLStat::CFLStat(CFLAlias* p): PTAStat(p),pta(p)
+{
+    _NumOfNullPtr = 0;
+    _NumOfConstantPtr= 0;
+    _NumOfBlackholePtr = 0;
+    startClk();
+}
+
+/*!
+ * Collect CFLGraph information
+ */
+void  CFLStat::collectCFLInfo(CFLGraph* CFLGraph)
+{
+    _NumOfCycles = 0;
+    _NumOfPWCCycles = 0;
+    _NumOfNodesInCycles = 0;
+    NodeSet repNodes;
+    repNodes.clear();
+}
+
+
+
+/*!
+ * Collect cycle information
+ */
+void  CFLStat::collectCycleInfo(ConstraintGraph* consCG)
+{
+    _NumOfCycles = 0;
+    _NumOfPWCCycles = 0;
+    _NumOfNodesInCycles = 0;
+    NodeSet repNodes;
+    repNodes.clear();
+    for(ConstraintGraph::iterator it = consCG->begin(), eit = consCG->end(); it!=eit; ++it)
+    {
+        // sub nodes have been removed from the constraint graph, only rep nodes are left.
+        NodeID repNode = consCG->sccRepNode(it->first);
+        NodeBS& subNodes = consCG->sccSubNodes(repNode);
+        NodeBS clone = subNodes;
+        for (NodeBS::iterator it = subNodes.begin(), eit = subNodes.end(); it != eit; ++it)
+        {
+            NodeID nodeId = *it;
+            PAGNode* pagNode = pta->getPAG()->getGNode(nodeId);
+            if (SVFUtil::isa<ObjVar>(pagNode) && pta->isFieldInsensitive(nodeId))
+            {
+                NodeID baseId = consCG->getBaseObjVar(nodeId);
+                clone.reset(nodeId);
+                clone.set(baseId);
+            }
+        }
+        u32_t num = clone.count();
+        if (num > 1)
+        {
+            if(repNodes.insert(repNode).second)
+            {
+                _NumOfNodesInCycles += num;
+                if(consCG->isPWCNode(repNode))
+                    _NumOfPWCCycles ++;
+            }
+            if( num > _MaxNumOfNodesInSCC)
+                _MaxNumOfNodesInSCC = num;
+        }
+    }
+    _NumOfCycles += repNodes.size();
+}
+
+void CFLStat::constraintGraphStat()
+{
+
+
+    u32_t numOfCopys = 0;
+    u32_t numOfGeps = 0;
+
+    u32_t totalNodeNumber = 0;
+    u32_t cgNodeNumber = 0;
+    u32_t objNodeNumber = 0;
+    u32_t addrtotalIn = 0;
+    u32_t addrmaxIn = 0;
+    u32_t addrmaxOut = 0;
+    u32_t copytotalIn = 0;
+    u32_t copymaxIn = 0;
+    u32_t copymaxOut = 0;
+    u32_t loadtotalIn = 0;
+    u32_t loadmaxIn = 0;
+    u32_t loadmaxOut = 0;
+    u32_t storetotalIn = 0;
+    u32_t storemaxIn = 0;
+    u32_t storemaxOut = 0;
+
+    double storeavgIn = (double)storetotalIn/cgNodeNumber;
+    double loadavgIn = (double)loadtotalIn/cgNodeNumber;
+    double copyavgIn = (double)copytotalIn/cgNodeNumber;
+    double addravgIn = (double)addrtotalIn/cgNodeNumber;
+    double avgIn = (double)(addrtotalIn + copytotalIn + loadtotalIn + storetotalIn)/cgNodeNumber;
+
+
+    PTNumStatMap["NumOfCGNode"] = totalNodeNumber;
+    PTNumStatMap["TotalValidNode"] = cgNodeNumber;
+    PTNumStatMap["TotalValidObjNode"] = objNodeNumber;
+    PTNumStatMap["NumOfCopys"] = numOfCopys;
+    PTNumStatMap["NumOfGeps"] =  numOfGeps;
+    PTNumStatMap["MaxInCopyEdge"] = copymaxIn;
+    PTNumStatMap["MaxOutCopyEdge"] = copymaxOut;
+    PTNumStatMap["MaxInLoadEdge"] = loadmaxIn;
+    PTNumStatMap["MaxOutLoadEdge"] = loadmaxOut;
+    PTNumStatMap["MaxInStoreEdge"] = storemaxIn;
+    PTNumStatMap["MaxOutStoreEdge"] = storemaxOut;
+    PTNumStatMap["AvgIn/OutStoreEdge"] = storeavgIn;
+    PTNumStatMap["MaxInAddrEdge"] = addrmaxIn;
+    PTNumStatMap["MaxOutAddrEdge"] = addrmaxOut;
+    timeStatMap["AvgIn/OutCopyEdge"] = copyavgIn;
+    timeStatMap["AvgIn/OutLoadEdge"] = loadavgIn;
+    timeStatMap["AvgIn/OutAddrEdge"] = addravgIn;
+    timeStatMap["AvgIn/OutEdge"] = avgIn;
+
+    PTAStat::printStat("CFL Graph Stats");
+}
+/*!
+ * Stat null pointers
+ */
+void CFLStat::statNullPtr()
+{
+
+    _NumOfNullPtr = 0;
+    for (SVFIR::iterator iter = pta->getPAG()->begin(), eiter = pta->getPAG()->end();
+            iter != eiter; ++iter)
+    {
+        NodeID pagNodeId = iter->first;
+        PAGNode* pagNode = iter->second;
+        if (SVFUtil::isa<ValVar>(pagNode) == false)
+            continue;
+        SVFStmt::SVFStmtSetTy& inComingStore = pagNode->getIncomingEdges(SVFStmt::Store);
+        SVFStmt::SVFStmtSetTy& outGoingLoad = pagNode->getOutgoingEdges(SVFStmt::Load);
+        if (inComingStore.empty()==false || outGoingLoad.empty()==false)
+        {
+            ///TODO: change the condition here to fetch the points-to set
+            const PointsTo& pts = pta->getPts(pagNodeId);
+            if (pta->containBlackHoleNode(pts))
+                _NumOfBlackholePtr++;
+
+            if (pta->containConstantNode(pts))
+                _NumOfConstantPtr++;
+
+            if(pts.empty())
+            {
+                std::string str;
+                raw_string_ostream rawstr(str);
+                if (!SVFUtil::isa<DummyValVar>(pagNode) && !SVFUtil::isa<DummyObjVar>(pagNode) )
+                {
+                    // if a pointer is in dead function, we do not care
+                    if(SymbolTableInfo::isPtrInUncalledFunction(pagNode->getValue()) == false)
+                    {
+                        _NumOfNullPtr++;
+                        rawstr << "##Null Pointer : (NodeID " << pagNode->getId()
+                               << ") PtrName:" << pagNode->getValue()->getName();
+                        writeWrnMsg(rawstr.str());
+                        //pagNode->getValue()->dump();
+                    }
+                }
+                else
+                {
+                    _NumOfNullPtr++;
+                    rawstr << "##Null Pointer : (NodeID " << pagNode->getId() << ")";
+                    writeWrnMsg(rawstr.str());
+                }
+            }
+        }
+    }
+
+}
+
+/*!
+ * Start here
+ */
+void CFLStat::performStat()
+{
+
+    assert(SVFUtil::isa<CFLAlias>(pta) && "not an CFLAlias pass!! what else??");
+    endClk();
+    // SVFIR* pag = pta->getPAG();
+    CFLGraph* CFLGraph = pta->getCFLGraph();
+    // collect cfl graph infor
+    collectCFLInfo(CFLGraph);
+    // delete CFLGraph;
+    // collect constraint graph cycles
+    // collectCycleInfo(consCG);
+
+    // stat null ptr number
+    statNullPtr();
+
+    u32_t totalPointers = 0;
+    u32_t totalTopLevPointers = 0;
+    u32_t totalPtsSize = 0;
+    u32_t totalTopLevPtsSize = 0;
+    for (SVFIR::iterator iter = pta->getPAG()->begin(), eiter = pta->getPAG()->end();
+            iter != eiter; ++iter)
+    {
+        NodeID node = iter->first;
+        const PointsTo& pts = pta->getPts(node);
+        u32_t size = pts.count();
+        totalPointers++;
+        totalPtsSize+=size;
+
+        if(pta->getPAG()->isValidTopLevelPtr(pta->getPAG()->getGNode(node)))
+        {
+            totalTopLevPointers++;
+            totalTopLevPtsSize+=size;
+        }
+
+        if(size > _MaxPtsSize )
+            _MaxPtsSize = size;
+    }
+
+
+    PTAStat::performStat();
+
+    constraintGraphStat();
+
+    PTNumStatMap["PointsToConstPtr"] = _NumOfConstantPtr;
+    PTNumStatMap["PointsToBlkPtr"] = _NumOfBlackholePtr;
+
+    PTAStat::printStat("CFL Alias Analysis Stats");
+}
+

package/lib/CFL/CFLVF.cpp

@@ -0,0 +1,89 @@
+//===----- CFLVF.cpp -- CFL Value Flow Client--------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * CFLAlias.cpp
+ *
+ *  Created on: September 7 , 2022
+ *      Author: Pei Xu
+ */
+
+#include "CFL/CFLVF.h"
+#include "Util/SVFBasicTypes.h"
+#include "WPA/Andersen.h"
+
+using namespace SVF;
+using namespace cppUtil;
+using namespace SVFUtil;
+
+
+
+void CFLVF::analyze()
+{
+    GrammarBuilder grammarBuilder = GrammarBuilder(Options::GrammarFilename);
+    CFGNormalizer normalizer = CFGNormalizer();
+    VFCFLGraphBuilder cflGraphBuilder = VFCFLGraphBuilder();
+    CFLGramGraphChecker cflChecker = CFLGramGraphChecker();
+    if (Options::CFLGraph.empty())
+    {
+        PointerAnalysis::initialize();
+        GrammarBase *grammarBase = grammarBuilder.build();
+        AndersenWaveDiff* ander = AndersenWaveDiff::createAndersenWaveDiff(pag);
+        svfg =  memSSA.buildPTROnlySVFG(ander);
+        ConstraintGraph *consCG = new ConstraintGraph(svfir);
+        if (Options::PEGTransfer)
+        {
+            graph = cflGraphBuilder.buildBiPEGgraph(consCG, grammarBase->getStartKind(), grammarBase, svfir);
+        }
+        else
+        {
+            graph = cflGraphBuilder.buildBigraph(svfg, grammarBase->getStartKind(), grammarBase);
+        }
+
+        cflChecker.check(grammarBase, &cflGraphBuilder, graph);
+        grammar = normalizer.normalize(grammarBase);
+        cflChecker.check(grammar, &cflGraphBuilder, graph);
+        delete consCG;
+        delete grammarBase;
+    }
+    else
+    {
+        GrammarBase *grammarBase = grammarBuilder.build();
+        graph = cflGraphBuilder.buildFromDot(Options::CFLGraph, grammarBase);
+        cflChecker.check(grammarBase, &cflGraphBuilder, graph);
+        grammar = normalizer.normalize(grammarBase);
+        cflChecker.check(grammar, &cflGraphBuilder, graph);
+        delete grammarBase;
+    }
+    solver = new CFLSolver(graph, grammar);
+    solver->solve();
+    if(Options::PrintCFL == true)
+    {
+        svfir->dump("IR");
+        grammar->dump("Grammar");
+        graph->dump("CFLGraph");
+    }
+    if (Options::CFLGraph.empty())
+    {
+        PointerAnalysis::finalize();
+    }
+}

package/lib/MemoryModel/PointerAnalysisImpl.cpp

@@ -50,7 +50,7 @@ BVDataPTAImpl::BVDataPTAImpl(SVFIR* p, PointerAnalysis::PTATY type, bool alias_c
 {
     if (type == Andersen_BASE || type == Andersen_WPA || type == AndersenWaveDiff_WPA
             || type == TypeCPP_WPA || type == FlowS_DDA
-            || type == AndersenSCD_WPA || type == AndersenSFR_WPA || type == CFLFICI_WPA )
+            || type == AndersenSCD_WPA || type == AndersenSFR_WPA || type == CFLFICI_WPA || type == CFLFSCS_WPA)
     {
         // Only maintain reverse points-to when the analysis is field-sensitive, as objects turning
         // field-insensitive is all it is used for.

package/lib/Util/Options.cpp

@@ -811,6 +811,12 @@ const llvm::cl::opt<bool> Options::PEGTransfer(
     llvm::cl::desc("When explicit to true, cfl graph builder will transfer PAG load and store edges to copy and addr.")
 );
 
+const llvm::cl::opt<bool> Options::CFLSVFG(
+    "cflsvfg",
+    llvm::cl::init(false),
+    llvm::cl::desc("When explicit to true, cfl graph builder will transfer SVFG to CFL Reachability.")
+);
+
 
 const llvm::cl::opt<bool> Options::LoopAnalysis(
     "loop-analysis",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.569",
+  "version": "1.0.571",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/tools/CFL/cfl.cpp

@@ -28,8 +28,9 @@
 
 
 #include "SVF-FE/LLVMUtil.h"
-#include "CFL/CFLAlias.h"
 #include "Util/Options.h"
+#include "CFL/CFLAlias.h"
+#include "CFL/CFLVF.h"
 #include "SVF-FE/SVFIRBuilder.h"
 #include "CFL/CFGNormalizer.h"
 
@@ -64,9 +65,18 @@ int main(int argc, char ** argv)
         /// Build Program Assignment Graph (SVFIR)
         SVFIRBuilder builder;
         SVFIR* svfir = builder.build(svfModule);
-        CFLAlias* cflaa = new CFLAlias(svfir);
-        cflaa->analyze();
-        delete cflaa;
+        if (Options::CFLSVFG)
+        {
+            CFLVF* cflvf = new CFLVF(svfir);
+            cflvf->analyze();
+            delete cflvf;
+        }
+        else
+        {
+            CFLAlias* cflaa = new CFLAlias(svfir);
+            cflaa->analyze();
+            delete cflaa;
+        }
     }
     else
     {