svf-tools 1.0.771 → 1.0.773
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SVF-doxygen/html/html/BoundedZ3Expr_8cpp_source.html +10 -9
- package/SVF-doxygen/html/html/BoundedZ3Expr_8h_source.html +380 -380
- package/SVF-doxygen/html/html/ConsExeState_8cpp_source.html +1 -1
- package/SVF-doxygen/html/html/IntervalExeState_8h_source.html +2 -2
- package/SVF-doxygen/html/html/IntervalValue_8h_source.html +35 -35
- package/SVF-doxygen/html/html/NumericLiteral_8h_source.html +19 -18
- package/SVF-doxygen/html/html/RelationSolver_8cpp_source.html +3 -3
- package/SVF-doxygen/html/html/SVFIR2ItvExeState_8cpp_source.html +784 -766
- package/SVF-doxygen/html/html/SVFIR2ItvExeState_8h_source.html +25 -25
- package/SVF-doxygen/html/html/SingleAbsValue_8h_source.html +3 -3
- package/SVF-doxygen/html/html/classSVF_1_1BoundedZ3Expr-members.html +3 -3
- package/SVF-doxygen/html/html/classSVF_1_1BoundedZ3Expr.html +306 -305
- package/SVF-doxygen/html/html/classSVF_1_1ConsExeState.html +1 -1
- package/SVF-doxygen/html/html/classSVF_1_1IntervalValue-members.html +3 -3
- package/SVF-doxygen/html/html/classSVF_1_1IntervalValue.html +28 -27
- package/SVF-doxygen/html/html/classSVF_1_1NumericLiteral-members.html +2 -2
- package/SVF-doxygen/html/html/classSVF_1_1NumericLiteral.html +25 -25
- package/SVF-doxygen/html/html/classSVF_1_1RelationSolver.html +3 -3
- package/SVF-doxygen/html/html/classSVF_1_1SVFIR2ItvExeState-members.html +5 -5
- package/SVF-doxygen/html/html/classSVF_1_1SVFIR2ItvExeState.html +791 -773
- package/SVF-doxygen/html/html/classSVF_1_1SingleAbsValue-members.html +3 -3
- package/SVF-doxygen/html/html/classSVF_1_1SingleAbsValue.html +10 -10
- package/SVF-doxygen/html/html/functions_b.html +1 -1
- package/SVF-doxygen/html/html/functions_func_b.html +1 -1
- package/SVF-doxygen/html/html/functions_func_g.html +8 -8
- package/SVF-doxygen/html/html/functions_g.html +8 -8
- package/SVF-doxygen/html/html/namespaceSVF.html +9 -9
- package/SVF-doxygen/html/html/search/all_2.js +2 -2
- package/SVF-doxygen/html/html/search/all_7.js +6 -6
- package/SVF-doxygen/html/html/search/all_9.js +1 -1
- package/SVF-doxygen/html/html/search/all_e.js +1 -1
- package/SVF-doxygen/html/html/search/functions_2.js +2 -2
- package/SVF-doxygen/html/html/search/functions_7.js +6 -6
- package/SVF-doxygen/html/html/search/functions_9.js +1 -1
- package/SVF-doxygen/html/html/search/functions_e.js +1 -1
- package/SVF-doxygen/html/html/structstd_1_1hash_3_01SVF_1_1BoundedZ3Expr_01_4.html +5 -5
- package/package.json +1 -1
- package/svf/include/AbstractExecution/BoundedZ3Expr.h +4 -5
- package/svf/include/AbstractExecution/IntervalValue.h +19 -19
- package/svf/include/AbstractExecution/NumericLiteral.h +2 -2
- package/svf/include/AbstractExecution/SVFIR2ItvExeState.h +5 -5
- package/svf/lib/AbstractExecution/BoundedZ3Expr.cpp +5 -5
- package/svf/lib/AbstractExecution/SVFIR2ItvExeState.cpp +77 -61
|
@@ -86,7 +86,7 @@ Public Member Functions</h2></td></tr>
|
|
|
86
86
|
<a name="details" id="details"></a><h2 class="groupheader">Detailed Description</h2>
|
|
87
87
|
<div class="textblock"><p>Specialise hash for ConZ3Expr. </p>
|
|
88
88
|
|
|
89
|
-
<p class="definition">Definition at line <a class="el" href="BoundedZ3Expr_8h_source.html#
|
|
89
|
+
<p class="definition">Definition at line <a class="el" href="BoundedZ3Expr_8h_source.html#l00383">383</a> of file <a class="el" href="BoundedZ3Expr_8h_source.html">BoundedZ3Expr.h</a>.</p>
|
|
90
90
|
</div><h2 class="groupheader">Member Function Documentation</h2>
|
|
91
91
|
<a id="a232e38e5365af047f57631b121a04e66"></a>
|
|
92
92
|
<h2 class="memtitle"><span class="permalink"><a href="#a232e38e5365af047f57631b121a04e66">◆ </a></span>operator()()</h2>
|
|
@@ -112,10 +112,10 @@ Public Member Functions</h2></td></tr>
|
|
|
112
112
|
</table>
|
|
113
113
|
</div><div class="memdoc">
|
|
114
114
|
|
|
115
|
-
<p class="definition">Definition at line <a class="el" href="BoundedZ3Expr_8h_source.html#
|
|
116
|
-
<div class="fragment"><div class="line"><a name="
|
|
117
|
-
<div class="line"><a name="
|
|
118
|
-
<div class="line"><a name="
|
|
115
|
+
<p class="definition">Definition at line <a class="el" href="BoundedZ3Expr_8h_source.html#l00385">385</a> of file <a class="el" href="BoundedZ3Expr_8h_source.html">BoundedZ3Expr.h</a>.</p>
|
|
116
|
+
<div class="fragment"><div class="line"><a name="l00386"></a><span class="lineno"> 386</span>  {</div>
|
|
117
|
+
<div class="line"><a name="l00387"></a><span class="lineno"> 387</span>  <span class="keywordflow">return</span> z3Expr.<a class="code" href="classSVF_1_1Z3Expr.html#a631cb7cee0e1f9b7204b9293f4e516a9">hash</a>();</div>
|
|
118
|
+
<div class="line"><a name="l00388"></a><span class="lineno"> 388</span>  }</div>
|
|
119
119
|
</div><!-- fragment -->
|
|
120
120
|
</div>
|
|
121
121
|
</div>
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "svf-tools",
|
|
3
|
-
"version": "1.0.
|
|
3
|
+
"version": "1.0.773",
|
|
4
4
|
"description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"scripts": {
|
|
@@ -51,11 +51,10 @@ public:
|
|
|
51
51
|
|
|
52
52
|
BoundedZ3Expr(s32_t i) : Z3Expr(i) {}
|
|
53
53
|
|
|
54
|
-
BoundedZ3Expr(
|
|
54
|
+
BoundedZ3Expr(s64_t i) : Z3Expr(getContext().int_val((int64_t)i)) {}
|
|
55
55
|
|
|
56
56
|
BoundedZ3Expr(const BoundedZ3Expr &z3Expr) : Z3Expr(z3Expr) {}
|
|
57
57
|
|
|
58
|
-
|
|
59
58
|
inline BoundedZ3Expr &operator=(const BoundedZ3Expr &rhs)
|
|
60
59
|
{
|
|
61
60
|
Z3Expr::operator=(rhs);
|
|
@@ -347,13 +346,13 @@ public:
|
|
|
347
346
|
}
|
|
348
347
|
|
|
349
348
|
/// Return Numeral
|
|
350
|
-
inline
|
|
349
|
+
inline s64_t getNumeral() const
|
|
351
350
|
{
|
|
352
351
|
if (is_numeral())
|
|
353
352
|
{
|
|
354
353
|
int64_t i;
|
|
355
354
|
if (getExpr().is_numeral_i64(i))
|
|
356
|
-
return get_numeral_int64();
|
|
355
|
+
return (s64_t)get_numeral_int64();
|
|
357
356
|
else
|
|
358
357
|
{
|
|
359
358
|
return (getExpr() < 0).simplify().is_true() ? INT64_MIN : INT64_MAX;
|
|
@@ -374,7 +373,7 @@ public:
|
|
|
374
373
|
}
|
|
375
374
|
}
|
|
376
375
|
|
|
377
|
-
|
|
376
|
+
s64_t bvLen() const;
|
|
378
377
|
//%}
|
|
379
378
|
}; // end class ConZ3Expr
|
|
380
379
|
} // end namespace SVF
|
|
@@ -95,13 +95,13 @@ public:
|
|
|
95
95
|
explicit IntervalValue() : AbstractValue(AbstractValue::IntervalK), _lb(minus_infinity()), _ub(plus_infinity()) {}
|
|
96
96
|
|
|
97
97
|
/// Create the IntervalValue [n, n]
|
|
98
|
-
explicit IntervalValue(
|
|
98
|
+
explicit IntervalValue(s64_t n) : AbstractValue(AbstractValue::IntervalK), _lb(n), _ub(n) {}
|
|
99
99
|
|
|
100
|
-
explicit IntervalValue(s32_t n) : IntervalValue((
|
|
100
|
+
explicit IntervalValue(s32_t n) : IntervalValue((s64_t) n) {}
|
|
101
101
|
|
|
102
|
-
explicit IntervalValue(u32_t n) : IntervalValue((
|
|
102
|
+
explicit IntervalValue(u32_t n) : IntervalValue((s64_t) n) {}
|
|
103
103
|
|
|
104
|
-
explicit IntervalValue(double n) : IntervalValue((
|
|
104
|
+
explicit IntervalValue(double n) : IntervalValue((s64_t) n) {}
|
|
105
105
|
|
|
106
106
|
explicit IntervalValue(NumericLiteral n) : IntervalValue(n, n) {}
|
|
107
107
|
|
|
@@ -109,15 +109,15 @@ public:
|
|
|
109
109
|
explicit IntervalValue(NumericLiteral lb, NumericLiteral ub) : AbstractValue(AbstractValue::IntervalK),
|
|
110
110
|
_lb(std::move(lb)), _ub(std::move(ub)) {}
|
|
111
111
|
|
|
112
|
-
explicit IntervalValue(
|
|
112
|
+
explicit IntervalValue(s64_t lb, s64_t ub) : IntervalValue(NumericLiteral(lb), NumericLiteral(ub)) {}
|
|
113
113
|
|
|
114
|
-
explicit IntervalValue(double lb, double ub) : IntervalValue(NumericLiteral((
|
|
114
|
+
explicit IntervalValue(double lb, double ub) : IntervalValue(NumericLiteral((s64_t) lb), NumericLiteral((s64_t) ub)) {}
|
|
115
115
|
|
|
116
|
-
explicit IntervalValue(s32_t lb, s32_t ub) : IntervalValue((
|
|
116
|
+
explicit IntervalValue(s32_t lb, s32_t ub) : IntervalValue((s64_t) lb, (s64_t) ub) {}
|
|
117
117
|
|
|
118
|
-
explicit IntervalValue(u32_t lb, u32_t ub) : IntervalValue((
|
|
118
|
+
explicit IntervalValue(u32_t lb, u32_t ub) : IntervalValue((s64_t) lb, (s64_t) ub) {}
|
|
119
119
|
|
|
120
|
-
explicit IntervalValue(u64_t lb, u64_t ub) : IntervalValue((
|
|
120
|
+
explicit IntervalValue(u64_t lb, u64_t ub) : IntervalValue((s64_t) lb, (s64_t) ub) {}
|
|
121
121
|
|
|
122
122
|
/// Copy constructor
|
|
123
123
|
IntervalValue(const IntervalValue &) = default;
|
|
@@ -260,7 +260,7 @@ public:
|
|
|
260
260
|
}
|
|
261
261
|
|
|
262
262
|
/// Return
|
|
263
|
-
|
|
263
|
+
s64_t getNumeral() const
|
|
264
264
|
{
|
|
265
265
|
assert(is_numeral() && "this IntervalValue is not numeral");
|
|
266
266
|
return _lb.getNumeral();
|
|
@@ -800,15 +800,15 @@ inline IntervalValue operator&(const IntervalValue &lhs, const IntervalValue &rh
|
|
|
800
800
|
}
|
|
801
801
|
else if (lhs.lb().getNumeral() >= 0 && rhs.lb().getNumeral() >= 0)
|
|
802
802
|
{
|
|
803
|
-
return IntervalValue((
|
|
803
|
+
return IntervalValue((s64_t) 0, min(lhs.ub(), rhs.ub()));
|
|
804
804
|
}
|
|
805
805
|
else if (lhs.lb().getNumeral() >= 0)
|
|
806
806
|
{
|
|
807
|
-
return IntervalValue((
|
|
807
|
+
return IntervalValue((s64_t) 0, lhs.ub());
|
|
808
808
|
}
|
|
809
809
|
else if (rhs.lb().getNumeral() >= 0)
|
|
810
810
|
{
|
|
811
|
-
return IntervalValue((
|
|
811
|
+
return IntervalValue((s64_t) 0, rhs.ub());
|
|
812
812
|
}
|
|
813
813
|
else
|
|
814
814
|
{
|
|
@@ -835,9 +835,9 @@ inline IntervalValue operator|(const IntervalValue &lhs, const IntervalValue &rh
|
|
|
835
835
|
else if (lhs.lb().getNumeral() >= 0 && !lhs.ub().is_infinity() &&
|
|
836
836
|
rhs.lb().getNumeral() >= 0 && !rhs.ub().is_infinity())
|
|
837
837
|
{
|
|
838
|
-
|
|
839
|
-
|
|
840
|
-
return IntervalValue((
|
|
838
|
+
s64_t m = std::max(lhs.ub().getNumeral(), rhs.ub().getNumeral());
|
|
839
|
+
s64_t ub = next_power_of_2(s64_t(m+1));
|
|
840
|
+
return IntervalValue((s64_t) 0, (s64_t) ub);
|
|
841
841
|
}
|
|
842
842
|
else
|
|
843
843
|
{
|
|
@@ -864,9 +864,9 @@ inline IntervalValue operator^(const IntervalValue &lhs, const IntervalValue &rh
|
|
|
864
864
|
else if (lhs.lb().getNumeral() >= 0 && !lhs.ub().is_infinity() &&
|
|
865
865
|
rhs.lb().getNumeral() >= 0 && !rhs.ub().is_infinity())
|
|
866
866
|
{
|
|
867
|
-
|
|
868
|
-
|
|
869
|
-
return IntervalValue((
|
|
867
|
+
s64_t m = std::max(lhs.ub().getNumeral(), rhs.ub().getNumeral());
|
|
868
|
+
s64_t ub = next_power_of_2(s64_t(m+1));
|
|
869
|
+
return IntervalValue((s64_t) 0, (s64_t) ub);
|
|
870
870
|
}
|
|
871
871
|
else
|
|
872
872
|
{
|
|
@@ -54,7 +54,7 @@ public:
|
|
|
54
54
|
|
|
55
55
|
NumericLiteral(s32_t i) : _n(i) {}
|
|
56
56
|
|
|
57
|
-
NumericLiteral(
|
|
57
|
+
NumericLiteral(s64_t i) : _n(i) {}
|
|
58
58
|
|
|
59
59
|
NumericLiteral(BoundedZ3Expr z3Expr) : _n(std::move(z3Expr)) {}
|
|
60
60
|
|
|
@@ -117,7 +117,7 @@ public:
|
|
|
117
117
|
}
|
|
118
118
|
|
|
119
119
|
/// Return Numeral
|
|
120
|
-
inline
|
|
120
|
+
inline s64_t getNumeral() const
|
|
121
121
|
{
|
|
122
122
|
return _n.getNumeral();
|
|
123
123
|
}
|
|
@@ -71,23 +71,23 @@ public:
|
|
|
71
71
|
void narrowVAddrs(IntervalExeState &lhs, const IntervalExeState &rhs);
|
|
72
72
|
|
|
73
73
|
/// Return the field address given a pointer points to a struct object and an offset
|
|
74
|
-
VAddrs getGepObjAddress(u32_t pointer,
|
|
74
|
+
VAddrs getGepObjAddress(u32_t pointer, APOffset offset);
|
|
75
75
|
|
|
76
76
|
/// Return the byte offset from one gep param offset
|
|
77
|
-
std::pair<
|
|
77
|
+
std::pair<APOffset, APOffset> getBytefromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep, APOffset elem_bytesize);
|
|
78
78
|
|
|
79
79
|
/// Return the Index offset from one gep param offset
|
|
80
|
-
std::pair<
|
|
80
|
+
std::pair<APOffset, APOffset> getIndexfromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep);
|
|
81
81
|
|
|
82
82
|
/// Return the byte offset expression of a GepStmt
|
|
83
83
|
/// elemBytesize is the element byte size of an static alloc or heap alloc array
|
|
84
84
|
/// e.g. GepStmt* gep = **,
|
|
85
85
|
/// s32_t elemBytesize = LLVMUtil::SVFType2ByteSize(gep->getRHSVar()->getValue()->getType());
|
|
86
86
|
/// std::pair<s32_t, s32_t> byteOffset = getGepByteOffset(gep, elemBytesize);
|
|
87
|
-
std::pair<
|
|
87
|
+
std::pair<APOffset, APOffset> getGepByteOffset(const GepStmt *gep, APOffset elemBytesize);
|
|
88
88
|
|
|
89
89
|
/// Return the offset expression of a GepStmt
|
|
90
|
-
std::pair<
|
|
90
|
+
std::pair<APOffset, APOffset> getGepOffset(const GepStmt *gep);
|
|
91
91
|
|
|
92
92
|
|
|
93
93
|
static z3::context &getContext()
|
|
@@ -31,11 +31,11 @@
|
|
|
31
31
|
|
|
32
32
|
using namespace SVF;
|
|
33
33
|
|
|
34
|
-
|
|
34
|
+
s64_t BoundedZ3Expr::bvLen() const
|
|
35
35
|
{
|
|
36
|
-
if(is_infinite()) return Options::MaxBVLen();
|
|
36
|
+
if(is_infinite()) return (s64_t)Options::MaxBVLen();
|
|
37
37
|
// No overflow
|
|
38
|
-
if(getNumeral() != INT64_MIN && getNumeral() != INT64_MAX) return Options::MaxBVLen();
|
|
38
|
+
if(getNumeral() != INT64_MIN && getNumeral() != INT64_MAX) return (s64_t)Options::MaxBVLen();
|
|
39
39
|
// Create a symbolic variable
|
|
40
40
|
Z3Expr x = getContext().real_const("x");
|
|
41
41
|
Z3Expr y = getContext().real_const("y");
|
|
@@ -54,11 +54,11 @@ int64_t BoundedZ3Expr::bvLen() const
|
|
|
54
54
|
z3::model model = solver->get_model();
|
|
55
55
|
Z3Expr log2_x = model.eval(y.getExpr(), true);
|
|
56
56
|
Z3Expr::getSolver().pop();
|
|
57
|
-
return BoundedZ3Expr(log2_x + 1).simplify().getNumeral();
|
|
57
|
+
return (s64_t)BoundedZ3Expr(log2_x + 1).simplify().getNumeral();
|
|
58
58
|
}
|
|
59
59
|
else
|
|
60
60
|
{
|
|
61
61
|
Z3Expr::getSolver().pop();
|
|
62
|
-
return Options::MaxBVLen();
|
|
62
|
+
return (s64_t)Options::MaxBVLen();
|
|
63
63
|
}
|
|
64
64
|
}
|
|
@@ -152,7 +152,7 @@ void SVFIR2ItvExeState::narrowVAddrs(IntervalExeState &lhs, const IntervalExeSta
|
|
|
152
152
|
}
|
|
153
153
|
}
|
|
154
154
|
|
|
155
|
-
SVFIR2ItvExeState::VAddrs SVFIR2ItvExeState::getGepObjAddress(u32_t pointer,
|
|
155
|
+
SVFIR2ItvExeState::VAddrs SVFIR2ItvExeState::getGepObjAddress(u32_t pointer, APOffset offset)
|
|
156
156
|
{
|
|
157
157
|
assert(!getVAddrs(pointer).empty());
|
|
158
158
|
VAddrs &addrs = getVAddrs(pointer);
|
|
@@ -173,37 +173,53 @@ SVFIR2ItvExeState::VAddrs SVFIR2ItvExeState::getGepObjAddress(u32_t pointer, s32
|
|
|
173
173
|
return ret;
|
|
174
174
|
}
|
|
175
175
|
|
|
176
|
-
std::pair<
|
|
176
|
+
std::pair<APOffset, APOffset> SVFIR2ItvExeState::getBytefromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep, APOffset elemBytesize)
|
|
177
177
|
{
|
|
178
178
|
const SVFValue *value = gep_pair.first->getValue();
|
|
179
179
|
const SVFType *type = gep_pair.second;
|
|
180
180
|
const SVFConstantInt *op = SVFUtil::dyn_cast<SVFConstantInt>(value);
|
|
181
|
-
|
|
182
|
-
|
|
181
|
+
APOffset offsetLb = 0;
|
|
182
|
+
APOffset offsetUb = 0;
|
|
183
183
|
/// set largest byte offset is 0xFFFFFF in case of int32 overflow
|
|
184
|
-
|
|
184
|
+
APOffset maxByteLimit = 99999;
|
|
185
|
+
APOffset minByteLimit = -99999;
|
|
186
|
+
auto valueReshape = [&](s64_t offset)
|
|
187
|
+
{
|
|
188
|
+
if (offset < (s64_t)minByteLimit)
|
|
189
|
+
{
|
|
190
|
+
return minByteLimit;
|
|
191
|
+
}
|
|
192
|
+
else if (offset > (s64_t)maxByteLimit)
|
|
193
|
+
{
|
|
194
|
+
return maxByteLimit;
|
|
195
|
+
}
|
|
196
|
+
else
|
|
197
|
+
{
|
|
198
|
+
return offset;
|
|
199
|
+
}
|
|
200
|
+
};
|
|
185
201
|
/// offset is constant but stored in variable
|
|
186
202
|
if (op)
|
|
187
203
|
{
|
|
188
|
-
offsetLb = offsetUb = op->getSExtValue() >
|
|
189
|
-
|
|
204
|
+
offsetLb = offsetUb = op->getSExtValue() > maxByteLimit
|
|
205
|
+
? maxByteLimit
|
|
206
|
+
: op->getSExtValue();
|
|
190
207
|
}
|
|
191
208
|
else
|
|
192
209
|
{
|
|
193
210
|
u32_t idx = _svfir->getValueNode(value);
|
|
194
211
|
IntervalValue &idxVal = _es[idx];
|
|
195
212
|
if (idxVal.isBottom() || idxVal.isTop())
|
|
196
|
-
return std::make_pair(0,
|
|
213
|
+
return std::make_pair(0, maxByteLimit);
|
|
197
214
|
// if idxVal is a concrete value
|
|
198
215
|
if (idxVal.is_numeral())
|
|
199
216
|
{
|
|
200
|
-
offsetLb = offsetUb = idxVal.lb().getNumeral()
|
|
201
|
-
maxFieldLimit? maxFieldLimit: idxVal.lb().getNumeral();
|
|
217
|
+
offsetLb = offsetUb = valueReshape(idxVal.lb().getNumeral());
|
|
202
218
|
}
|
|
203
219
|
else
|
|
204
220
|
{
|
|
205
|
-
offsetLb = idxVal.lb().getNumeral()
|
|
206
|
-
offsetUb = idxVal.ub().getNumeral()
|
|
221
|
+
offsetLb = valueReshape(idxVal.lb().getNumeral());
|
|
222
|
+
offsetUb = valueReshape(idxVal.ub().getNumeral());
|
|
207
223
|
}
|
|
208
224
|
}
|
|
209
225
|
|
|
@@ -224,19 +240,34 @@ std::pair<s32_t, s32_t> SVFIR2ItvExeState::getBytefromGepTypePair(const AccessPa
|
|
|
224
240
|
}
|
|
225
241
|
|
|
226
242
|
|
|
227
|
-
std::pair<
|
|
243
|
+
std::pair<APOffset, APOffset> SVFIR2ItvExeState::getIndexfromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep)
|
|
228
244
|
{
|
|
229
245
|
const SVFValue *value = gep_pair.first->getValue();
|
|
230
246
|
const SVFType *type = gep_pair.second;
|
|
231
247
|
const SVFConstantInt *op = SVFUtil::dyn_cast<SVFConstantInt>(value);
|
|
232
|
-
|
|
233
|
-
|
|
234
|
-
|
|
248
|
+
APOffset offsetLb = 0;
|
|
249
|
+
APOffset offsetUb = 0;
|
|
250
|
+
APOffset maxFieldLimit = (APOffset)Options::MaxFieldLimit();
|
|
251
|
+
APOffset minFieldLimit = 0;
|
|
252
|
+
auto valueReshape = [&](s64_t offset)
|
|
253
|
+
{
|
|
254
|
+
if (offset < minFieldLimit)
|
|
255
|
+
{
|
|
256
|
+
return minFieldLimit;
|
|
257
|
+
}
|
|
258
|
+
else if (offset > maxFieldLimit)
|
|
259
|
+
{
|
|
260
|
+
return maxFieldLimit;
|
|
261
|
+
}
|
|
262
|
+
else
|
|
263
|
+
{
|
|
264
|
+
return offset;
|
|
265
|
+
}
|
|
266
|
+
};
|
|
235
267
|
/// offset is constant but stored in variable
|
|
236
268
|
if (op)
|
|
237
269
|
{
|
|
238
|
-
offsetLb = offsetUb = op->getSExtValue()
|
|
239
|
-
maxFieldLimit? maxFieldLimit: op->getSExtValue();
|
|
270
|
+
offsetLb = offsetUb = valueReshape(op->getSExtValue());
|
|
240
271
|
}
|
|
241
272
|
else
|
|
242
273
|
{
|
|
@@ -244,27 +275,16 @@ std::pair<s32_t, s32_t> SVFIR2ItvExeState::getIndexfromGepTypePair(const AccessP
|
|
|
244
275
|
//if (!inVarToIValTable(idx)) return std::make_pair(-1, -1);
|
|
245
276
|
IntervalValue &idxVal = _es[idx];
|
|
246
277
|
if (idxVal.isBottom() || idxVal.isTop())
|
|
247
|
-
return std::make_pair(0,
|
|
278
|
+
return std::make_pair(0, Options::MaxFieldLimit());
|
|
248
279
|
// if idxVal is a concrete value
|
|
249
280
|
if (idxVal.is_numeral())
|
|
250
281
|
{
|
|
251
|
-
offsetLb = offsetUb = idxVal.lb().getNumeral()
|
|
252
|
-
maxFieldLimit? maxFieldLimit: idxVal.lb().getNumeral();
|
|
282
|
+
offsetLb = offsetUb = valueReshape(idxVal.lb().getNumeral());
|
|
253
283
|
}
|
|
254
284
|
else
|
|
255
285
|
{
|
|
256
|
-
offsetLb = idxVal.lb().getNumeral()
|
|
257
|
-
|
|
258
|
-
: idxVal.lb().getNumeral();
|
|
259
|
-
offsetLb = idxVal.lb().getNumeral() > maxFieldLimit
|
|
260
|
-
? maxFieldLimit
|
|
261
|
-
: offsetLb;
|
|
262
|
-
offsetUb = idxVal.ub().getNumeral() < 0
|
|
263
|
-
? 0
|
|
264
|
-
: idxVal.ub().getNumeral();
|
|
265
|
-
offsetUb = idxVal.ub().getNumeral() > maxFieldLimit
|
|
266
|
-
? maxFieldLimit
|
|
267
|
-
: offsetUb;
|
|
286
|
+
offsetLb = valueReshape(idxVal.lb().getNumeral());
|
|
287
|
+
offsetUb = valueReshape(idxVal.ub().getNumeral());
|
|
268
288
|
}
|
|
269
289
|
}
|
|
270
290
|
|
|
@@ -280,8 +300,8 @@ std::pair<s32_t, s32_t> SVFIR2ItvExeState::getIndexfromGepTypePair(const AccessP
|
|
|
280
300
|
const std::vector<u32_t>& so = SymbolTableInfo::SymbolInfo()
|
|
281
301
|
->getTypeInfo(type)
|
|
282
302
|
->getFlattenedElemIdxVec();
|
|
283
|
-
if (so.empty() ||
|
|
284
|
-
|
|
303
|
+
if (so.empty() || offsetUb >= (APOffset)so.size() ||
|
|
304
|
+
offsetLb >= (APOffset)so.size())
|
|
285
305
|
{
|
|
286
306
|
offsetLb = 0;
|
|
287
307
|
offsetUb = maxFieldLimit;
|
|
@@ -301,26 +321,26 @@ std::pair<s32_t, s32_t> SVFIR2ItvExeState::getIndexfromGepTypePair(const AccessP
|
|
|
301
321
|
}
|
|
302
322
|
|
|
303
323
|
|
|
304
|
-
std::pair<
|
|
324
|
+
std::pair<APOffset, APOffset> SVFIR2ItvExeState::getGepByteOffset(const GepStmt *gep, APOffset elemBytesize)
|
|
305
325
|
{
|
|
306
326
|
/// for instant constant index, e.g. gep arr, 1
|
|
307
327
|
if (gep->getOffsetVarAndGepTypePairVec().empty())
|
|
308
328
|
return std::make_pair(gep->getConstantFieldIdx(), gep->getConstantFieldIdx());
|
|
309
|
-
|
|
310
|
-
|
|
329
|
+
APOffset totalOffsetLb = 0;
|
|
330
|
+
APOffset totalOffsetUb = 0;
|
|
311
331
|
/// default value of MaxFieldLimit is 512
|
|
312
|
-
|
|
332
|
+
APOffset maxFieldLimit = 0xFFFFFF;
|
|
313
333
|
for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
|
|
314
334
|
{
|
|
315
|
-
std::pair<
|
|
316
|
-
|
|
317
|
-
|
|
318
|
-
|
|
319
|
-
if (
|
|
335
|
+
std::pair<APOffset, APOffset> offsetIdx = getBytefromGepTypePair(
|
|
336
|
+
gep->getOffsetVarAndGepTypePairVec()[i], gep, elemBytesize);
|
|
337
|
+
APOffset offsetLb = offsetIdx.first;
|
|
338
|
+
APOffset offsetUb = offsetIdx.second;
|
|
339
|
+
if (totalOffsetLb + offsetLb > maxFieldLimit)
|
|
320
340
|
totalOffsetLb = maxFieldLimit;
|
|
321
341
|
else
|
|
322
342
|
totalOffsetLb += offsetLb;
|
|
323
|
-
if (
|
|
343
|
+
if (totalOffsetUb + offsetUb > maxFieldLimit)
|
|
324
344
|
totalOffsetUb = maxFieldLimit;
|
|
325
345
|
else
|
|
326
346
|
totalOffsetUb += offsetUb ;
|
|
@@ -329,21 +349,21 @@ std::pair<s32_t, s32_t> SVFIR2ItvExeState::getGepByteOffset(const GepStmt *gep,
|
|
|
329
349
|
}
|
|
330
350
|
|
|
331
351
|
|
|
332
|
-
std::pair<
|
|
352
|
+
std::pair<APOffset, APOffset> SVFIR2ItvExeState::getGepOffset(const GepStmt *gep)
|
|
333
353
|
{
|
|
334
354
|
/// for instant constant index, e.g. gep arr, 1
|
|
335
355
|
if (gep->getOffsetVarAndGepTypePairVec().empty())
|
|
336
356
|
return std::make_pair(gep->getConstantFieldIdx(), gep->getConstantFieldIdx());
|
|
337
|
-
|
|
338
|
-
|
|
357
|
+
APOffset totalOffsetLb = 0;
|
|
358
|
+
APOffset totalOffsetUb = 0;
|
|
339
359
|
/// default value of MaxFieldLimit is 512
|
|
340
|
-
|
|
360
|
+
APOffset maxFieldLimit = Options::MaxFieldLimit() - 1;
|
|
341
361
|
for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
|
|
342
362
|
{
|
|
343
|
-
std::pair<
|
|
344
|
-
|
|
345
|
-
|
|
346
|
-
|
|
363
|
+
std::pair<APOffset, APOffset> offsetIdx = getIndexfromGepTypePair(
|
|
364
|
+
gep->getOffsetVarAndGepTypePairVec()[i], gep);
|
|
365
|
+
APOffset offsetLb = offsetIdx.first;
|
|
366
|
+
APOffset offsetUb = offsetIdx.second;
|
|
347
367
|
if ((long long) (totalOffsetLb + offsetLb) > maxFieldLimit)
|
|
348
368
|
totalOffsetLb = maxFieldLimit;
|
|
349
369
|
else
|
|
@@ -612,10 +632,6 @@ void SVFIR2ItvExeState::translateCmp(const CmpStmt *cmp)
|
|
|
612
632
|
{
|
|
613
633
|
IntervalValue resVal;
|
|
614
634
|
VAddrs &lhs = getVAddrs(op0), &rhs = getVAddrs(op1);
|
|
615
|
-
// if (lhs.empty() || rhs.empty()) {
|
|
616
|
-
// outs() << "empty address cmp?\n";
|
|
617
|
-
// return;
|
|
618
|
-
// }
|
|
619
635
|
assert(!lhs.empty() && !rhs.empty() && "empty address?");
|
|
620
636
|
auto predicate = cmp->getPredicate();
|
|
621
637
|
switch (predicate)
|
|
@@ -842,7 +858,7 @@ void SVFIR2ItvExeState::translateGep(const GepStmt *gep)
|
|
|
842
858
|
assert(!getVAddrs(rhs).empty());
|
|
843
859
|
VAddrs &rhsVal = getVAddrs(rhs);
|
|
844
860
|
if (rhsVal.empty()) return;
|
|
845
|
-
std::pair<
|
|
861
|
+
std::pair<APOffset, APOffset> offsetPair = getGepOffset(gep);
|
|
846
862
|
if (offsetPair.first == -1 && offsetPair.second == -1) return;
|
|
847
863
|
if (!isVirtualMemAddress(*rhsVal.begin()))
|
|
848
864
|
{
|
|
@@ -851,12 +867,12 @@ void SVFIR2ItvExeState::translateGep(const GepStmt *gep)
|
|
|
851
867
|
else
|
|
852
868
|
{
|
|
853
869
|
VAddrs gepAddrs;
|
|
854
|
-
|
|
855
|
-
if (offsetPair.second >
|
|
870
|
+
APOffset ub = offsetPair.second;
|
|
871
|
+
if (offsetPair.second > Options::MaxFieldLimit() - 1)
|
|
856
872
|
{
|
|
857
873
|
ub = Options::MaxFieldLimit() - 1;
|
|
858
874
|
}
|
|
859
|
-
for (
|
|
875
|
+
for (APOffset i = offsetPair.first; i <= ub; i++)
|
|
860
876
|
{
|
|
861
877
|
gepAddrs.join_with(getGepObjAddress(rhs, i));
|
|
862
878
|
}
|