svf-tools 1.0.974 → 1.0.976
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +1 -1
- package/svf/include/AE/Svfexe/AbstractInterpretation.h +9 -8
- package/svf/include/AE/Svfexe/BufOverflowChecker.h +3 -3
- package/svf/include/DDA/ContextDDA.h +2 -2
- package/svf/include/DDA/DDAVFSolver.h +5 -5
- package/svf/include/DDA/FlowDDA.h +1 -1
- package/svf/include/Graphs/{PTACallGraph.h → CallGraph.h} +41 -41
- package/svf/include/Graphs/ICFG.h +2 -2
- package/svf/include/Graphs/ThreadCallGraph.h +24 -24
- package/svf/include/Graphs/VFG.h +4 -4
- package/svf/include/Graphs/WTO.h +4 -4
- package/svf/include/MSSA/MemRegion.h +4 -4
- package/svf/include/MTA/LockAnalysis.h +1 -1
- package/svf/include/MTA/MHP.h +2 -2
- package/svf/include/MTA/PCG.h +3 -3
- package/svf/include/MTA/TCT.h +7 -7
- package/svf/include/MemoryModel/PointerAnalysis.h +13 -13
- package/svf/include/SABER/SaberSVFGBuilder.h +1 -1
- package/svf/include/SABER/SrcSnkDDA.h +7 -7
- package/svf/include/Util/CallGraphBuilder.h +5 -5
- package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp +71 -82
- package/svf/lib/CFL/CFLSVFGBuilder.cpp +1 -1
- package/svf/lib/DDA/ContextDDA.cpp +9 -9
- package/svf/lib/DDA/DDAClient.cpp +3 -3
- package/svf/lib/DDA/DDAPass.cpp +4 -4
- package/svf/lib/DDA/FlowDDA.cpp +2 -2
- package/svf/lib/Graphs/{PTACallGraph.cpp → CallGraph.cpp} +66 -66
- package/svf/lib/Graphs/ICFG.cpp +6 -6
- package/svf/lib/Graphs/SVFG.cpp +7 -7
- package/svf/lib/Graphs/SVFGReadWrite.cpp +6 -6
- package/svf/lib/Graphs/SVFGStat.cpp +1 -1
- package/svf/lib/Graphs/ThreadCallGraph.cpp +17 -17
- package/svf/lib/Graphs/VFG.cpp +1 -1
- package/svf/lib/MSSA/MemRegion.cpp +7 -7
- package/svf/lib/MTA/LockAnalysis.cpp +18 -18
- package/svf/lib/MTA/MHP.cpp +19 -19
- package/svf/lib/MTA/MTA.cpp +1 -1
- package/svf/lib/MTA/PCG.cpp +12 -12
- package/svf/lib/MTA/TCT.cpp +23 -23
- package/svf/lib/MemoryModel/PointerAnalysis.cpp +12 -12
- package/svf/lib/SABER/LeakChecker.cpp +4 -4
- package/svf/lib/SABER/SaberSVFGBuilder.cpp +4 -4
- package/svf/lib/SABER/SrcSnkDDA.cpp +1 -1
- package/svf/lib/Util/CallGraphBuilder.cpp +2 -2
- package/svf/lib/Util/PTAStat.cpp +7 -7
- package/svf/lib/WPA/VersionedFlowSensitive.cpp +2 -2
- package/svf-llvm/include/SVF-LLVM/SVFIRBuilder.h +1 -1
- package/svf-llvm/lib/SVFIRBuilder.cpp +5 -5
- package/svf-llvm/tools/AE/ae.cpp +1 -1
- package/svf-llvm/tools/Example/svf-ex.cpp +1 -1
- package/svf-llvm/tools/MTA/LockResultValidator.cpp +2 -2
|
@@ -339,7 +339,7 @@ private:
|
|
|
339
339
|
void handleIntra(const CxtStmt& cts);
|
|
340
340
|
|
|
341
341
|
/// Handle call relations
|
|
342
|
-
void handleCallRelation(CxtLockProc& clp, const
|
|
342
|
+
void handleCallRelation(CxtLockProc& clp, const CallGraphEdge* cgEdge, CallSite call);
|
|
343
343
|
|
|
344
344
|
/// Return true it a lock matches an unlock
|
|
345
345
|
bool isAliasedLocks(const CxtLock& cl1, const CxtLock& cl2)
|
package/svf/include/MTA/MHP.h
CHANGED
|
@@ -140,7 +140,7 @@ public:
|
|
|
140
140
|
|
|
141
141
|
private:
|
|
142
142
|
|
|
143
|
-
inline const
|
|
143
|
+
inline const CallGraph::FunctionSet& getCallee(const SVFInstruction* inst, CallGraph::FunctionSet& callees)
|
|
144
144
|
{
|
|
145
145
|
tcg->getCallees(getCBN(inst), callees);
|
|
146
146
|
return callees;
|
|
@@ -501,7 +501,7 @@ private:
|
|
|
501
501
|
{
|
|
502
502
|
return getTCG()->getThreadAPI()->getJoinedThread(call);
|
|
503
503
|
}
|
|
504
|
-
inline const
|
|
504
|
+
inline const CallGraph::FunctionSet& getCallee(const SVFInstruction* inst, CallGraph::FunctionSet& callees)
|
|
505
505
|
{
|
|
506
506
|
getTCG()->getCallees(getCBN(inst), callees);
|
|
507
507
|
return callees;
|
package/svf/include/MTA/PCG.h
CHANGED
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
#define PCG_H_
|
|
32
32
|
|
|
33
33
|
#include "Util/ThreadAPI.h"
|
|
34
|
-
#include "Graphs/
|
|
34
|
+
#include "Graphs/CallGraph.h"
|
|
35
35
|
#include "Util/WorkList.h"
|
|
36
36
|
#include "WPA/Andersen.h"
|
|
37
37
|
#include <set>
|
|
@@ -62,7 +62,7 @@ private:
|
|
|
62
62
|
FunSet spawnees;
|
|
63
63
|
FunSet followers;
|
|
64
64
|
FunSet mhpfuns;
|
|
65
|
-
|
|
65
|
+
CallGraph* callgraph;
|
|
66
66
|
SVFModule* mod;
|
|
67
67
|
PointerAnalysis* pta;
|
|
68
68
|
ThreadAPI* tdAPI;
|
|
@@ -134,7 +134,7 @@ public:
|
|
|
134
134
|
{
|
|
135
135
|
mod = pta->getModule();
|
|
136
136
|
tdAPI=ThreadAPI::getThreadAPI();
|
|
137
|
-
callgraph = pta->
|
|
137
|
+
callgraph = pta->getCallGraph();
|
|
138
138
|
}
|
|
139
139
|
|
|
140
140
|
/// We start the pass here
|
package/svf/include/MTA/TCT.h
CHANGED
|
@@ -142,19 +142,19 @@ public:
|
|
|
142
142
|
typedef Set<const SVFFunction*> FunSet;
|
|
143
143
|
typedef std::vector<const SVFInstruction*> InstVec;
|
|
144
144
|
typedef Set<const SVFInstruction*> InstSet;
|
|
145
|
-
typedef Set<const
|
|
145
|
+
typedef Set<const CallGraphNode*> PTACGNodeSet;
|
|
146
146
|
typedef Map<CxtThread,TCTNode*> CxtThreadToNodeMap;
|
|
147
147
|
typedef Map<CxtThread,CallStrCxt> CxtThreadToForkCxt;
|
|
148
148
|
typedef Map<CxtThread,const SVFFunction*> CxtThreadToFun;
|
|
149
149
|
typedef Map<const SVFInstruction*, LoopBBs> InstToLoopMap;
|
|
150
150
|
typedef FIFOWorkList<CxtThreadProc> CxtThreadProcVec;
|
|
151
151
|
typedef Set<CxtThreadProc> CxtThreadProcSet;
|
|
152
|
-
typedef SCCDetection<
|
|
152
|
+
typedef SCCDetection<CallGraph*> ThreadCallGraphSCC;
|
|
153
153
|
|
|
154
154
|
/// Constructor
|
|
155
155
|
TCT(PointerAnalysis* p) :pta(p),TCTNodeNum(0),TCTEdgeNum(0),MaxCxtSize(0)
|
|
156
156
|
{
|
|
157
|
-
tcg = SVFUtil::cast<ThreadCallGraph>(pta->
|
|
157
|
+
tcg = SVFUtil::cast<ThreadCallGraph>(pta->getCallGraph());
|
|
158
158
|
tcg->updateCallGraph(pta);
|
|
159
159
|
//tcg->updateJoinEdge(pta);
|
|
160
160
|
tcgSCC = pta->getCallGraphSCC();
|
|
@@ -261,9 +261,9 @@ public:
|
|
|
261
261
|
//@}
|
|
262
262
|
|
|
263
263
|
/// Whether it is a candidate function for indirect call
|
|
264
|
-
inline bool isCandidateFun(const
|
|
264
|
+
inline bool isCandidateFun(const CallGraph::FunctionSet& callees) const
|
|
265
265
|
{
|
|
266
|
-
for(
|
|
266
|
+
for(CallGraph::FunctionSet::const_iterator cit = callees.begin(),
|
|
267
267
|
ecit = callees.end(); cit!=ecit; cit++)
|
|
268
268
|
{
|
|
269
269
|
if(candidateFuncSet.find((*cit))!=candidateFuncSet.end())
|
|
@@ -276,7 +276,7 @@ public:
|
|
|
276
276
|
return candidateFuncSet.find(fun)!=candidateFuncSet.end();
|
|
277
277
|
}
|
|
278
278
|
/// Whether two functions in the same callgraph scc
|
|
279
|
-
inline bool inSameCallGraphSCC(const
|
|
279
|
+
inline bool inSameCallGraphSCC(const CallGraphNode* src,const CallGraphNode* dst)
|
|
280
280
|
{
|
|
281
281
|
return (tcgSCC->repNode(src->getId()) == tcgSCC->repNode(dst->getId()));
|
|
282
282
|
}
|
|
@@ -479,7 +479,7 @@ private:
|
|
|
479
479
|
//@}
|
|
480
480
|
|
|
481
481
|
/// Handle call relations
|
|
482
|
-
void handleCallRelation(CxtThreadProc& ctp, const
|
|
482
|
+
void handleCallRelation(CxtThreadProc& ctp, const CallGraphEdge* cgEdge, CallSite call);
|
|
483
483
|
|
|
484
484
|
/// Get or create a tct node based on CxtThread
|
|
485
485
|
//@{
|
|
@@ -34,7 +34,7 @@
|
|
|
34
34
|
#include <signal.h>
|
|
35
35
|
|
|
36
36
|
#include "Graphs/CHG.h"
|
|
37
|
-
#include "Graphs/
|
|
37
|
+
#include "Graphs/CallGraph.h"
|
|
38
38
|
#include "Graphs/SCC.h"
|
|
39
39
|
#include "MemoryModel/AbstractPointsToDS.h"
|
|
40
40
|
#include "MemoryModel/ConditionalPT.h"
|
|
@@ -103,7 +103,7 @@ public:
|
|
|
103
103
|
typedef SVFIR::CallSiteToFunPtrMap CallSiteToFunPtrMap;
|
|
104
104
|
typedef Set<const SVFFunction*> FunctionSet;
|
|
105
105
|
typedef OrderedMap<const CallICFGNode*, FunctionSet> CallEdgeMap;
|
|
106
|
-
typedef SCCDetection<
|
|
106
|
+
typedef SCCDetection<CallGraph*> CallGraphSCC;
|
|
107
107
|
typedef Set<const SVFGlobalValue*> VTableSet;
|
|
108
108
|
typedef Set<const SVFFunction*> VFunSet;
|
|
109
109
|
//@}
|
|
@@ -148,7 +148,7 @@ protected:
|
|
|
148
148
|
/// Statistics
|
|
149
149
|
PTAStat* stat;
|
|
150
150
|
/// Call graph used for pointer analysis
|
|
151
|
-
|
|
151
|
+
CallGraph* callgraph;
|
|
152
152
|
/// SCC for CallGraph
|
|
153
153
|
CallGraphSCC* callGraphSCC;
|
|
154
154
|
/// Interprocedural control-flow graph
|
|
@@ -165,12 +165,12 @@ public:
|
|
|
165
165
|
/// Return number of resolved indirect call edges
|
|
166
166
|
inline u32_t getNumOfResolvedIndCallEdge() const
|
|
167
167
|
{
|
|
168
|
-
return
|
|
168
|
+
return getCallGraph()->getNumOfResolvedIndCallEdge();
|
|
169
169
|
}
|
|
170
170
|
/// Return call graph
|
|
171
|
-
inline
|
|
171
|
+
inline CallGraph* getCallGraph() const
|
|
172
172
|
{
|
|
173
|
-
return
|
|
173
|
+
return callgraph;
|
|
174
174
|
}
|
|
175
175
|
/// Return call graph SCC
|
|
176
176
|
inline CallGraphSCC* getCallGraphSCC() const
|
|
@@ -367,15 +367,15 @@ public:
|
|
|
367
367
|
//@{
|
|
368
368
|
inline CallEdgeMap& getIndCallMap()
|
|
369
369
|
{
|
|
370
|
-
return
|
|
370
|
+
return getCallGraph()->getIndCallMap();
|
|
371
371
|
}
|
|
372
372
|
inline bool hasIndCSCallees(const CallICFGNode* cs) const
|
|
373
373
|
{
|
|
374
|
-
return
|
|
374
|
+
return getCallGraph()->hasIndCSCallees(cs);
|
|
375
375
|
}
|
|
376
376
|
inline const FunctionSet& getIndCSCallees(const CallICFGNode* cs) const
|
|
377
377
|
{
|
|
378
|
-
return
|
|
378
|
+
return getCallGraph()->getIndCSCallees(cs);
|
|
379
379
|
}
|
|
380
380
|
//@}
|
|
381
381
|
|
|
@@ -388,7 +388,7 @@ public:
|
|
|
388
388
|
inline void callGraphSCCDetection()
|
|
389
389
|
{
|
|
390
390
|
if(callGraphSCC==nullptr)
|
|
391
|
-
callGraphSCC = new CallGraphSCC(
|
|
391
|
+
callGraphSCC = new CallGraphSCC(callgraph);
|
|
392
392
|
|
|
393
393
|
callGraphSCC->find();
|
|
394
394
|
}
|
|
@@ -400,13 +400,13 @@ public:
|
|
|
400
400
|
/// Return TRUE if this edge is inside a CallGraph SCC, i.e., src node and dst node are in the same SCC on the SVFG.
|
|
401
401
|
inline bool inSameCallGraphSCC(const SVFFunction* fun1,const SVFFunction* fun2)
|
|
402
402
|
{
|
|
403
|
-
const
|
|
404
|
-
const
|
|
403
|
+
const CallGraphNode* src = callgraph->getCallGraphNode(fun1);
|
|
404
|
+
const CallGraphNode* dst = callgraph->getCallGraphNode(fun2);
|
|
405
405
|
return (getCallGraphSCCRepNode(src->getId()) == getCallGraphSCCRepNode(dst->getId()));
|
|
406
406
|
}
|
|
407
407
|
inline bool isInRecursion(const SVFFunction* fun) const
|
|
408
408
|
{
|
|
409
|
-
return callGraphSCC->isInCycle(
|
|
409
|
+
return callGraphSCC->isInCycle(callgraph->getCallGraphNode(fun)->getId());
|
|
410
410
|
}
|
|
411
411
|
/// Whether a local variable is in function recursions
|
|
412
412
|
bool isLocalVarInRecursiveFun(NodeID id) const;
|
|
@@ -89,7 +89,7 @@ protected:
|
|
|
89
89
|
|
|
90
90
|
/// Add actual parameter SVFGNode for 1st argument of a deallocation like external function
|
|
91
91
|
/// In order to path sensitive leak detection
|
|
92
|
-
virtual void AddExtActualParmSVFGNodes(
|
|
92
|
+
virtual void AddExtActualParmSVFGNodes(CallGraph* callgraph);
|
|
93
93
|
|
|
94
94
|
/// Collect memory pointed global pointers,
|
|
95
95
|
/// note that this collection is recursively performed, for example gp-->obj-->obj'
|
|
@@ -76,13 +76,13 @@ private:
|
|
|
76
76
|
protected:
|
|
77
77
|
SaberSVFGBuilder memSSA;
|
|
78
78
|
SVFG* svfg;
|
|
79
|
-
|
|
79
|
+
CallGraph* callgraph;
|
|
80
80
|
SVFBugReport report; /// Bug Reporter
|
|
81
81
|
|
|
82
82
|
public:
|
|
83
83
|
|
|
84
84
|
/// Constructor
|
|
85
|
-
SrcSnkDDA() : _curSlice(nullptr), svfg(nullptr),
|
|
85
|
+
SrcSnkDDA() : _curSlice(nullptr), svfg(nullptr), callgraph(nullptr)
|
|
86
86
|
{
|
|
87
87
|
saberCondAllocator = std::make_unique<SaberCondAllocator>();
|
|
88
88
|
}
|
|
@@ -95,9 +95,9 @@ public:
|
|
|
95
95
|
_curSlice = nullptr;
|
|
96
96
|
|
|
97
97
|
/// the following shared by multiple checkers, thus can not be released.
|
|
98
|
-
//if (
|
|
99
|
-
// delete
|
|
100
|
-
//
|
|
98
|
+
//if (callgraph != nullptr)
|
|
99
|
+
// delete callgraph;
|
|
100
|
+
//callgraph = nullptr;
|
|
101
101
|
|
|
102
102
|
//if(pathCondAllocator)
|
|
103
103
|
// delete pathCondAllocator;
|
|
@@ -129,9 +129,9 @@ public:
|
|
|
129
129
|
}
|
|
130
130
|
|
|
131
131
|
/// Get Callgraph
|
|
132
|
-
inline
|
|
132
|
+
inline CallGraph* getCallgraph() const
|
|
133
133
|
{
|
|
134
|
-
return
|
|
134
|
+
return callgraph;
|
|
135
135
|
}
|
|
136
136
|
|
|
137
137
|
/// Whether this svfg node may access global variable
|
|
@@ -31,7 +31,7 @@
|
|
|
31
31
|
#ifndef INCLUDE_SVF_FE_CALLGRAPHBUILDER_H_
|
|
32
32
|
#define INCLUDE_SVF_FE_CALLGRAPHBUILDER_H_
|
|
33
33
|
|
|
34
|
-
#include "Graphs/
|
|
34
|
+
#include "Graphs/CallGraph.h"
|
|
35
35
|
#include "Graphs/ThreadCallGraph.h"
|
|
36
36
|
|
|
37
37
|
namespace SVF
|
|
@@ -43,15 +43,15 @@ class CallGraphBuilder
|
|
|
43
43
|
{
|
|
44
44
|
|
|
45
45
|
protected:
|
|
46
|
-
|
|
46
|
+
CallGraph* callgraph;
|
|
47
47
|
ICFG* icfg;
|
|
48
48
|
public:
|
|
49
|
-
CallGraphBuilder(
|
|
49
|
+
CallGraphBuilder(CallGraph* cg, ICFG* i): callgraph(cg),icfg(i)
|
|
50
50
|
{
|
|
51
51
|
}
|
|
52
52
|
|
|
53
53
|
/// Build normal callgraph
|
|
54
|
-
|
|
54
|
+
CallGraph* buildCallGraph(SVFModule* svfModule);
|
|
55
55
|
|
|
56
56
|
};
|
|
57
57
|
|
|
@@ -64,7 +64,7 @@ public:
|
|
|
64
64
|
}
|
|
65
65
|
|
|
66
66
|
/// Build thread-aware callgraph
|
|
67
|
-
|
|
67
|
+
CallGraph* buildThreadCallGraph(SVFModule* svfModule);
|
|
68
68
|
|
|
69
69
|
};
|
|
70
70
|
|
|
@@ -131,7 +131,7 @@ void AbstractInterpretation::initWTO()
|
|
|
131
131
|
// Detect if the call graph has cycles by finding its strongly connected components (SCC)
|
|
132
132
|
Andersen::CallGraphSCC* callGraphScc = ander->getCallGraphSCC();
|
|
133
133
|
callGraphScc->find();
|
|
134
|
-
auto callGraph = ander->
|
|
134
|
+
auto callGraph = ander->getCallGraph();
|
|
135
135
|
|
|
136
136
|
// Iterate through the call graph
|
|
137
137
|
for (auto it = callGraph->begin(); it != callGraph->end(); it++)
|
|
@@ -167,10 +167,9 @@ void AbstractInterpretation::analyse()
|
|
|
167
167
|
/// handle global node
|
|
168
168
|
void AbstractInterpretation::handleGlobalNode()
|
|
169
169
|
{
|
|
170
|
-
AbstractState as;
|
|
171
170
|
const ICFGNode* node = _icfg->getGlobalICFGNode();
|
|
172
|
-
|
|
173
|
-
|
|
171
|
+
_abstractTrace[node] = AbstractState();
|
|
172
|
+
_abstractTrace[node][SymbolTableInfo::NullPtr] = AddressValue();
|
|
174
173
|
// Global Node, we just need to handle addr, load, store, copy and gep
|
|
175
174
|
for (const SVFStmt *stmt: node->getSVFStmts())
|
|
176
175
|
{
|
|
@@ -181,18 +180,18 @@ void AbstractInterpretation::handleGlobalNode()
|
|
|
181
180
|
/// get execution state by merging states of predecessor blocks
|
|
182
181
|
/// Scenario 1: preblock -----(intraEdge)----> block, join the preES of inEdges
|
|
183
182
|
/// Scenario 2: preblock -----(callEdge)----> block
|
|
184
|
-
bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode *
|
|
183
|
+
bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode * icfgNode)
|
|
185
184
|
{
|
|
186
185
|
std::vector<AbstractState> workList;
|
|
187
|
-
AbstractState
|
|
188
|
-
for (auto& edge:
|
|
186
|
+
AbstractState preAs;
|
|
187
|
+
for (auto& edge: icfgNode->getInEdges())
|
|
189
188
|
{
|
|
190
|
-
if (
|
|
189
|
+
if (_abstractTrace.find(edge->getSrcNode()) != _abstractTrace.end())
|
|
191
190
|
{
|
|
192
191
|
const IntraCFGEdge *intraCfgEdge = SVFUtil::dyn_cast<IntraCFGEdge>(edge);
|
|
193
192
|
if (intraCfgEdge && intraCfgEdge->getCondition())
|
|
194
193
|
{
|
|
195
|
-
AbstractState tmpEs =
|
|
194
|
+
AbstractState tmpEs = _abstractTrace[edge->getSrcNode()];
|
|
196
195
|
if (isBranchFeasible(intraCfgEdge, tmpEs))
|
|
197
196
|
{
|
|
198
197
|
workList.push_back(tmpEs);
|
|
@@ -204,7 +203,7 @@ bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode *block)
|
|
|
204
203
|
}
|
|
205
204
|
else
|
|
206
205
|
{
|
|
207
|
-
workList.push_back(
|
|
206
|
+
workList.push_back(_abstractTrace[edge->getSrcNode()]);
|
|
208
207
|
}
|
|
209
208
|
}
|
|
210
209
|
else
|
|
@@ -212,7 +211,6 @@ bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode *block)
|
|
|
212
211
|
|
|
213
212
|
}
|
|
214
213
|
}
|
|
215
|
-
_preAbsTrace[block].clear();
|
|
216
214
|
if (workList.size() == 0)
|
|
217
215
|
{
|
|
218
216
|
return false;
|
|
@@ -221,9 +219,12 @@ bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode *block)
|
|
|
221
219
|
{
|
|
222
220
|
while (!workList.empty())
|
|
223
221
|
{
|
|
224
|
-
|
|
222
|
+
preAs.joinWith(workList.back());
|
|
225
223
|
workList.pop_back();
|
|
226
224
|
}
|
|
225
|
+
// Has ES on the in edges - Feasible block
|
|
226
|
+
// update post as
|
|
227
|
+
_abstractTrace[icfgNode] = preAs;
|
|
227
228
|
return true;
|
|
228
229
|
}
|
|
229
230
|
}
|
|
@@ -526,20 +527,8 @@ bool AbstractInterpretation::isBranchFeasible(const IntraCFGEdge* intraEdge,
|
|
|
526
527
|
/// handle instructions in svf basic blocks
|
|
527
528
|
void AbstractInterpretation::handleSingletonWTO(const ICFGSingletonWTO *icfgSingletonWto)
|
|
528
529
|
{
|
|
529
|
-
const ICFGNode* node = icfgSingletonWto->
|
|
530
|
+
const ICFGNode* node = icfgSingletonWto->getICFGNode();
|
|
530
531
|
_stat->getBlockTrace()++;
|
|
531
|
-
// Get execution states from in edges
|
|
532
|
-
if (!mergeStatesFromPredecessors(node))
|
|
533
|
-
{
|
|
534
|
-
// No ES on the in edges - Infeasible block
|
|
535
|
-
return;
|
|
536
|
-
}
|
|
537
|
-
else
|
|
538
|
-
{
|
|
539
|
-
// Has ES on the in edges - Feasible block
|
|
540
|
-
// Get execution state from in edges
|
|
541
|
-
_postAbsTrace[node] = _preAbsTrace[node];
|
|
542
|
-
}
|
|
543
532
|
|
|
544
533
|
std::deque<const ICFGNode*> worklist;
|
|
545
534
|
|
|
@@ -573,20 +562,27 @@ void AbstractInterpretation::handleWTOComponents(const std::list<const ICFGWTOCo
|
|
|
573
562
|
{
|
|
574
563
|
for (const ICFGWTOComp* wtoNode : wtoComps)
|
|
575
564
|
{
|
|
576
|
-
|
|
577
|
-
|
|
565
|
+
handleWTOComponent(wtoNode);
|
|
566
|
+
}
|
|
567
|
+
}
|
|
568
|
+
|
|
569
|
+
void AbstractInterpretation::handleWTOComponent(const SVF::ICFGWTOComp* wtoNode)
|
|
570
|
+
{
|
|
571
|
+
if (const ICFGSingletonWTO* node = SVFUtil::dyn_cast<ICFGSingletonWTO>(wtoNode))
|
|
572
|
+
{
|
|
573
|
+
if (mergeStatesFromPredecessors(node->getICFGNode()))
|
|
578
574
|
handleSingletonWTO(node);
|
|
579
|
-
|
|
580
|
-
|
|
581
|
-
|
|
582
|
-
|
|
575
|
+
}
|
|
576
|
+
// Handle WTO cycles
|
|
577
|
+
else if (const ICFGCycleWTO* cycle = SVFUtil::dyn_cast<ICFGCycleWTO>(wtoNode))
|
|
578
|
+
{
|
|
579
|
+
if (mergeStatesFromPredecessors(cycle->head()->getICFGNode()))
|
|
583
580
|
handleCycleWTO(cycle);
|
|
584
|
-
|
|
585
|
-
|
|
586
|
-
|
|
587
|
-
|
|
588
|
-
|
|
589
|
-
}
|
|
581
|
+
}
|
|
582
|
+
// Assert false for unknown WTO types
|
|
583
|
+
else
|
|
584
|
+
{
|
|
585
|
+
assert(false && "unknown WTO type!");
|
|
590
586
|
}
|
|
591
587
|
}
|
|
592
588
|
|
|
@@ -656,7 +652,7 @@ void AbstractInterpretation::recursiveCallPass(const SVF::CallICFGNode *callNode
|
|
|
656
652
|
}
|
|
657
653
|
}
|
|
658
654
|
}
|
|
659
|
-
|
|
655
|
+
_abstractTrace[retNode] = as;
|
|
660
656
|
}
|
|
661
657
|
|
|
662
658
|
bool AbstractInterpretation::isDirectCall(const SVF::CallICFGNode *callNode)
|
|
@@ -670,7 +666,7 @@ void AbstractInterpretation::directCallFunPass(const SVF::CallICFGNode *callNode
|
|
|
670
666
|
const SVFFunction *callfun = SVFUtil::getCallee(callNode->getCallSite());
|
|
671
667
|
_callSiteStack.push_back(callNode);
|
|
672
668
|
|
|
673
|
-
|
|
669
|
+
_abstractTrace[callNode] = as;
|
|
674
670
|
|
|
675
671
|
ICFGWTO* wto = _funcToWTO[callfun];
|
|
676
672
|
handleWTOComponents(wto->getWTOComponents());
|
|
@@ -679,7 +675,7 @@ void AbstractInterpretation::directCallFunPass(const SVF::CallICFGNode *callNode
|
|
|
679
675
|
// handle Ret node
|
|
680
676
|
const RetICFGNode *retNode = callNode->getRetICFGNode();
|
|
681
677
|
// resume ES to callnode
|
|
682
|
-
|
|
678
|
+
_abstractTrace[retNode] = _abstractTrace[callNode];
|
|
683
679
|
}
|
|
684
680
|
|
|
685
681
|
bool AbstractInterpretation::isIndirectCall(const SVF::CallICFGNode *callNode)
|
|
@@ -704,14 +700,14 @@ void AbstractInterpretation::indirectCallFunPass(const SVF::CallICFGNode *callNo
|
|
|
704
700
|
if (callfun)
|
|
705
701
|
{
|
|
706
702
|
_callSiteStack.push_back(callNode);
|
|
707
|
-
|
|
703
|
+
_abstractTrace[callNode] = as;
|
|
708
704
|
|
|
709
705
|
ICFGWTO* wto = _funcToWTO[callfun];
|
|
710
706
|
handleWTOComponents(wto->getWTOComponents());
|
|
711
707
|
_callSiteStack.pop_back();
|
|
712
708
|
// handle Ret node
|
|
713
709
|
const RetICFGNode *retNode = callNode->getRetICFGNode();
|
|
714
|
-
|
|
710
|
+
_abstractTrace[retNode] = _abstractTrace[callNode];
|
|
715
711
|
}
|
|
716
712
|
}
|
|
717
713
|
|
|
@@ -720,54 +716,47 @@ void AbstractInterpretation::indirectCallFunPass(const SVF::CallICFGNode *callNo
|
|
|
720
716
|
/// handle wto cycle (loop)
|
|
721
717
|
void AbstractInterpretation::handleCycleWTO(const ICFGCycleWTO*cycle)
|
|
722
718
|
{
|
|
723
|
-
|
|
724
|
-
|
|
725
|
-
|
|
726
|
-
|
|
727
|
-
|
|
728
|
-
{
|
|
729
|
-
|
|
730
|
-
|
|
731
|
-
|
|
732
|
-
|
|
733
|
-
|
|
734
|
-
|
|
735
|
-
|
|
736
|
-
if (
|
|
719
|
+
const ICFGNode* cycle_head = cycle->head()->getICFGNode();
|
|
720
|
+
// Flag to indicate if we are in the increasing phase
|
|
721
|
+
bool increasing = true;
|
|
722
|
+
// Infinite loop until a fixpoint is reached,
|
|
723
|
+
for (u32_t cur_iter = 0;; cur_iter++)
|
|
724
|
+
{
|
|
725
|
+
// Start widening or narrowing if cur_iter >= widen threshold (widen delay)
|
|
726
|
+
if (cur_iter >= Options::WidenDelay())
|
|
727
|
+
{
|
|
728
|
+
// Widen or narrow after processing cycle head node
|
|
729
|
+
AbstractState prev_head_state = _abstractTrace[cycle_head];
|
|
730
|
+
handleWTOComponent(cycle->head());
|
|
731
|
+
AbstractState cur_head_state = _abstractTrace[cycle_head];
|
|
732
|
+
if (increasing)
|
|
737
733
|
{
|
|
738
|
-
//
|
|
739
|
-
|
|
740
|
-
|
|
741
|
-
AbstractState cur_head_state = _postAbsTrace[cycle_head];
|
|
742
|
-
if (increasing)
|
|
743
|
-
{
|
|
744
|
-
// Widening phase
|
|
745
|
-
_postAbsTrace[cycle_head] = prev_head_state.widening(cur_head_state);
|
|
746
|
-
if (_postAbsTrace[cycle_head] == prev_head_state)
|
|
747
|
-
{
|
|
748
|
-
increasing = false;
|
|
749
|
-
continue;
|
|
750
|
-
}
|
|
751
|
-
}
|
|
752
|
-
else
|
|
734
|
+
// Widening phase
|
|
735
|
+
_abstractTrace[cycle_head] = prev_head_state.widening(cur_head_state);
|
|
736
|
+
if (_abstractTrace[cycle_head] == prev_head_state)
|
|
753
737
|
{
|
|
754
|
-
|
|
755
|
-
|
|
756
|
-
if (_postAbsTrace[cycle_head] == prev_head_state)
|
|
757
|
-
{
|
|
758
|
-
// Narrowing's fixpoint reached in the narrowing phase, exit loop
|
|
759
|
-
break;
|
|
760
|
-
}
|
|
738
|
+
increasing = false;
|
|
739
|
+
continue;
|
|
761
740
|
}
|
|
762
741
|
}
|
|
763
742
|
else
|
|
764
743
|
{
|
|
765
|
-
//
|
|
766
|
-
|
|
744
|
+
// Widening's fixpoint reached in the widening phase, switch to narrowing
|
|
745
|
+
_abstractTrace[cycle_head] = prev_head_state.narrowing(cur_head_state);
|
|
746
|
+
if (_abstractTrace[cycle_head] == prev_head_state)
|
|
747
|
+
{
|
|
748
|
+
// Narrowing's fixpoint reached in the narrowing phase, exit loop
|
|
749
|
+
break;
|
|
750
|
+
}
|
|
767
751
|
}
|
|
768
|
-
// Handle the cycle body
|
|
769
|
-
handleWTOComponents(cycle->getWTOComponents());
|
|
770
752
|
}
|
|
753
|
+
else
|
|
754
|
+
{
|
|
755
|
+
// Handle the cycle head
|
|
756
|
+
handleSingletonWTO(cycle->head());
|
|
757
|
+
}
|
|
758
|
+
// Handle the cycle body
|
|
759
|
+
handleWTOComponents(cycle->getWTOComponents());
|
|
771
760
|
}
|
|
772
761
|
}
|
|
773
762
|
|
|
@@ -63,7 +63,7 @@ void ContextDDA::initialize()
|
|
|
63
63
|
{
|
|
64
64
|
CondPTAImpl<ContextCond>::initialize();
|
|
65
65
|
buildSVFG(pag);
|
|
66
|
-
setCallGraph(
|
|
66
|
+
setCallGraph(getCallGraph());
|
|
67
67
|
setCallGraphSCC(getCallGraphSCC());
|
|
68
68
|
stat = setDDAStat(new DDAStat(this));
|
|
69
69
|
flowDDA->initialize();
|
|
@@ -219,9 +219,9 @@ CallSiteID ContextDDA::getCSIDAtCall(CxtLocDPItem&, const SVFGEdge* edge)
|
|
|
219
219
|
const CallICFGNode* cbn = getSVFG()->getCallSite(svfg_csId);
|
|
220
220
|
const SVFFunction* callee = edge->getDstNode()->getFun();
|
|
221
221
|
|
|
222
|
-
if(
|
|
222
|
+
if(getCallGraph()->hasCallSiteID(cbn,callee))
|
|
223
223
|
{
|
|
224
|
-
return
|
|
224
|
+
return getCallGraph()->getCallSiteID(cbn,callee);
|
|
225
225
|
}
|
|
226
226
|
|
|
227
227
|
return 0;
|
|
@@ -243,9 +243,9 @@ CallSiteID ContextDDA::getCSIDAtRet(CxtLocDPItem&, const SVFGEdge* edge)
|
|
|
243
243
|
const CallICFGNode* cbn = getSVFG()->getCallSite(svfg_csId);
|
|
244
244
|
const SVFFunction* callee = edge->getSrcNode()->getFun();
|
|
245
245
|
|
|
246
|
-
if(
|
|
246
|
+
if(getCallGraph()->hasCallSiteID(cbn,callee))
|
|
247
247
|
{
|
|
248
|
-
return
|
|
248
|
+
return getCallGraph()->getCallSiteID(cbn,callee);
|
|
249
249
|
}
|
|
250
250
|
|
|
251
251
|
return 0;
|
|
@@ -265,8 +265,8 @@ bool ContextDDA::handleBKCondition(CxtLocDPItem& dpm, const SVFGEdge* edge)
|
|
|
265
265
|
|
|
266
266
|
if(isEdgeInRecursion(csId))
|
|
267
267
|
{
|
|
268
|
-
DBOUT(DDDA,outs() << "\t\t call edge " <<
|
|
269
|
-
"=>" <<
|
|
268
|
+
DBOUT(DDDA,outs() << "\t\t call edge " << getCallGraph()->getCallerOfCallSite(csId)->getName() <<
|
|
269
|
+
"=>" << getCallGraph()->getCalleeOfCallSite(csId)->getName() << "in recursion \n");
|
|
270
270
|
popRecursiveCallSites(dpm);
|
|
271
271
|
}
|
|
272
272
|
else
|
|
@@ -293,8 +293,8 @@ bool ContextDDA::handleBKCondition(CxtLocDPItem& dpm, const SVFGEdge* edge)
|
|
|
293
293
|
|
|
294
294
|
if(isEdgeInRecursion(csId))
|
|
295
295
|
{
|
|
296
|
-
DBOUT(DDDA,outs() << "\t\t return edge " <<
|
|
297
|
-
"=>" <<
|
|
296
|
+
DBOUT(DDDA,outs() << "\t\t return edge " << getCallGraph()->getCalleeOfCallSite(csId)->getName() <<
|
|
297
|
+
"=>" << getCallGraph()->getCallerOfCallSite(csId)->getName() << "in recursion \n");
|
|
298
298
|
popRecursiveCallSites(dpm);
|
|
299
299
|
}
|
|
300
300
|
else
|
|
@@ -115,7 +115,7 @@ void FunptrDDAClient::performStat(PointerAnalysis* pta)
|
|
|
115
115
|
const PointsTo& ddaPts = pta->getPts(vtptr);
|
|
116
116
|
const PointsTo& anderPts = ander->getPts(vtptr);
|
|
117
117
|
|
|
118
|
-
|
|
118
|
+
CallGraph* callgraph = ander->getCallGraph();
|
|
119
119
|
const CallICFGNode* cbn = nIter->second;
|
|
120
120
|
|
|
121
121
|
if(!callgraph->hasIndCSCallees(cbn))
|
|
@@ -124,7 +124,7 @@ void FunptrDDAClient::performStat(PointerAnalysis* pta)
|
|
|
124
124
|
continue;
|
|
125
125
|
}
|
|
126
126
|
|
|
127
|
-
const
|
|
127
|
+
const CallGraph::FunctionSet& callees = callgraph->getIndCSCallees(cbn);
|
|
128
128
|
totalCallsites++;
|
|
129
129
|
if(callees.size() == 0)
|
|
130
130
|
zeroTargetCallsites++;
|
|
@@ -162,7 +162,7 @@ void FunptrDDAClient::performStat(PointerAnalysis* pta)
|
|
|
162
162
|
outs() << "=================================================\n";
|
|
163
163
|
outs() << "Total virtual callsites: " << vtableToCallSiteMap.size() << "\n";
|
|
164
164
|
outs() << "Total analyzed virtual callsites: " << totalCallsites << "\n";
|
|
165
|
-
outs() << "Indirect call map size: " << ander->
|
|
165
|
+
outs() << "Indirect call map size: " << ander->getCallGraph()->getIndCallMap().size() << "\n";
|
|
166
166
|
outs() << "Precise callsites: " << morePreciseCallsites << "\n";
|
|
167
167
|
outs() << "Zero target callsites: " << zeroTargetCallsites << "\n";
|
|
168
168
|
outs() << "One target callsites: " << oneTargetCallsites << "\n";
|