Static Value-Flow Analysis
Loading...
Searching...
No Matches
FlowDDA.h
Go to the documentation of this file.
1//===- FlowDDA.h -- Flow-sensitive demand-driven analysis -------------//
2//
3// SVF: Static Value-Flow Analysis
4//
5// Copyright (C) <2013-> <Yulei Sui>
6//
7
8// This program is free software: you can redistribute it and/or modify
9// it under the terms of the GNU Affero General Public License as published by
10// the Free Software Foundation, either version 3 of the License, or
11// (at your option) any later version.
12
13// This program is distributed in the hope that it will be useful,
14// but WITHOUT ANY WARRANTY; without even the implied warranty of
15// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16// GNU Affero General Public License for more details.
17
18// You should have received a copy of the GNU Affero General Public License
19// along with this program. If not, see <http://www.gnu.org/licenses/>.
20//
21//===----------------------------------------------------------------------===//
22
23/*
24 * FlowDDA.h
25 *
26 * Created on: Jun 30, 2014
27 * Author: Yulei Sui, Sen Ye
28 *
29 * The implementation is based on
30 * (1) Yulei Sui and Jingling Xue. "On-Demand Strong Update Analysis via Value-Flow Refinement".
31 * ACM SIGSOFT International Symposium on the Foundation of Software Engineering (FSE'16)
32 *
33 * (2) Yulei Sui and Jingling Xue. "Value-Flow-Based Demand-Driven Pointer Analysis for C and C++".
34 * IEEE Transactions on Software Engineering (TSE'18)
35 */
36
37#ifndef FlowDDA_H_
38#define FlowDDA_H_
39
41#include "Util/DPItem.h"
42#include "DDA/DDAVFSolver.h"
43
44namespace SVF
45{
46
47class DDAClient;
49
53class FlowDDA : public BVDataPTAImpl, public DDAVFSolver<NodeID,PointsTo,LocDPItem>
54{
55
56public:
67 inline virtual ~FlowDDA()
68 {
69 }
71 virtual void analyze() override {}
72
74 void computeDDAPts(NodeID id) override;
75
78
80 virtual bool handleBKCondition(LocDPItem& dpm, const SVFGEdge* edge) override;
81
84
86 inline virtual void initialize() override
87 {
92 stat = setDDAStat(new DDAStat(this));
93 }
94
96 inline virtual void finalize() override
97 {
99 }
100
106 virtual bool isHeapCondMemObj(const NodeID& var, const StoreSVFGNode* store) override;
107
109 virtual inline PointsTo getConservativeCPts(const LocDPItem& dpm) override
110 {
111 return getAndersenAnalysis()->getPts(dpm.getCurNodeID());
112 }
114 virtual inline NodeID getPtrNodeID(const NodeID& var) const override
115 {
116 return var;
117 }
119 virtual inline void handleAddr(PointsTo& pts,const LocDPItem& dpm,const AddrSVFGNode* addr) override
120 {
121 NodeID srcID = addr->getPAGSrcNodeID();
125
127 DBOUT(DDDA, SVFUtil::outs() << "\t add points-to target " << srcID << " to dpm ");
128 DBOUT(DDDA, dpm.dump());
129 }
131 virtual PointsTo processGepPts(const GepSVFGNode* gep, const PointsTo& srcPts) override;
132
134
135 virtual void updateCallGraphAndSVFG(const LocDPItem& dpm,const CallICFGNode* cs,SVFGEdgeSet& svfgEdges) override
136 {
139 for (CallEdgeMap::const_iterator iter = newEdges.begin(),eiter = newEdges.end(); iter != eiter; iter++)
140 {
141 const CallICFGNode* newcs = iter->first;
142 const FunctionSet & functions = iter->second;
143 for (FunctionSet::const_iterator func_iter = functions.begin(); func_iter != functions.end(); func_iter++)
144 {
145 const SVFFunction* func = *func_iter;
147 }
148 }
149 }
151
153
154 virtual inline const PointsTo& getCachedTLPointsTo(const LocDPItem& dpm) override
155 {
156 return getPts(dpm.getCurNodeID());
157 }
159
162 {
163 if (isTopLevelPtrStmt(dpm.getLoc())) return unionPts(dpm.getCurNodeID(), targetPts);
164 else return dpmToADCPtSetMap[dpm] |= targetPts;
165 }
166
167 virtual const std::string PTAName() const override
168 {
169 return "FlowSensitive DDA";
170 }
171
172private:
174};
175
176} // End namespace SVF
177
178#endif /* FlowDDA_H_ */
#define DBOUT(TYPE, X)
LLVM debug macros, define type of your DBUG model of each pass.
Definition SVFType.h:484
#define DDDA
Definition SVFType.h:496
virtual const PointsTo & getPts(NodeID id)
Operation of points-to set.
Definition Andersen.h:239
void finalize() override
Finalization of pointer analysis, and normalize points-to information to Bit Vector representation.
const PointsTo & getPts(NodeID id) override
virtual bool unionPts(NodeID id, const PointsTo &target)
DPImToCPtSetMap dpmToADCPtSetMap
points-to caching map for address-taken vars
AndersenWaveDiff * getAndersenAnalysis() const
Return Andersen's analysis.
virtual void addDDAPts(PointsTo &pts, const NodeID &var)
Add pts.
bool isTopLevelPtrStmt(const SVFGNode *stmt)
Whether this is a top-level pointer statement.
void setCallGraphSCC(CallGraphSCC *scc)
Set callgraphSCC.
virtual const PointsTo & getCachedPointsTo(const LocDPItem &dpm)
Points-to Caching for top-level pointers and address-taken objects.
virtual void buildSVFG(SVFIR *pag)
Build SVFG.
DDAStat * setDDAStat(DDAStat *s)
Set DDAStat.
void setCallGraph(PTACallGraph *cg)
Set callgraph.
virtual PointsTo getConservativeCPts(const LocDPItem &dpm) override
Override parent method.
Definition FlowDDA.h:109
DDAClient * _client
DDA client.
Definition FlowDDA.h:173
void computeDDAPts(NodeID id) override
Compute points-to set for all top variable.
Definition FlowDDA.cpp:43
virtual void handleAddr(PointsTo &pts, const LocDPItem &dpm, const AddrSVFGNode *addr) override
Handle Address SVFGNode to add proper points-to.
Definition FlowDDA.h:119
virtual ~FlowDDA()
Destructor.
Definition FlowDDA.h:67
BVDataPTAImpl::CallEdgeMap CallEdgeMap
Definition FlowDDA.h:58
virtual void finalize() override
Finalize analysis.
Definition FlowDDA.h:96
BVDataPTAImpl::CallSiteSet CallSiteSet
Definition FlowDDA.h:57
void handleOutOfBudgetDpm(const LocDPItem &dpm)
Handle out-of-budget dpm.
Definition FlowDDA.cpp:72
virtual NodeID getPtrNodeID(const NodeID &var) const override
Override parent method.
Definition FlowDDA.h:114
virtual void analyze() override
dummy analyze method
Definition FlowDDA.h:71
FlowDDA(SVFIR *_pag, DDAClient *client)
Constructor.
Definition FlowDDA.h:61
virtual const std::string PTAName() const override
Return PTA name.
Definition FlowDDA.h:167
virtual const PointsTo & getCachedTLPointsTo(const LocDPItem &dpm) override
Override parent class functions to get/add cached points-to directly via PAGNode ID.
Definition FlowDDA.h:154
virtual PointsTo processGepPts(const GepSVFGNode *gep, const PointsTo &srcPts) override
processGep node
Definition FlowDDA.cpp:141
bool unionDDAPts(LocDPItem dpm, const PointsTo &targetPts) override
Union pts.
Definition FlowDDA.h:161
virtual bool handleBKCondition(LocDPItem &dpm, const SVFGEdge *edge) override
Handle condition for flow analysis (backward analysis)
Definition FlowDDA.cpp:102
BVDataPTAImpl::FunctionSet FunctionSet
Definition FlowDDA.h:59
bool testIndCallReachability(LocDPItem &dpm, const SVFFunction *callee, CallSiteID csId)
refine indirect call edge
Definition FlowDDA.cpp:81
virtual void updateCallGraphAndSVFG(const LocDPItem &dpm, const CallICFGNode *cs, SVFGEdgeSet &svfgEdges) override
Update call graph.
Definition FlowDDA.h:135
virtual void initialize() override
Initialization of the analysis.
Definition FlowDDA.h:86
virtual bool isHeapCondMemObj(const NodeID &var, const StoreSVFGNode *store) override
Definition FlowDDA.cpp:177
@ FlowS_DDA
Flow sensitive DDA.
bool isFieldInsensitive(NodeID id) const
OrderedMap< const CallICFGNode *, FunctionSet > CallEdgeMap
virtual void initialize()
Initialization of a pointer analysis, including building symbol table and SVFIR etc.
Set< const CallICFGNode * > CallSiteSet
Indirect call edges type, map a callsite to a set of callees.
PTAStat * stat
Statistics.
NodeID getFIObjVar(NodeID id)
virtual void resolveIndCalls(const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
Resolve indirect call edges.
PTACallGraph * getCallGraph() const
Return call graph.
Set< const SVFFunction * > FunctionSet
static SVFIR * pag
SVFIR.
CallGraphSCC * getCallGraphSCC() const
Return call graph SCC.
virtual void connectCallerAndCallee(const CallICFGNode *cs, const SVFFunction *callee, SVFGEdgeSetTy &edges)
Connect SVFG nodes between caller and callee for indirect call site.
Definition SVFG.cpp:658
std::ostream & outs()
Overwrite llvm::outs()
Definition SVFUtil.h:50
for isBitcode
Definition BasicTypes.h:68
unsigned CallSiteID
Definition GeneralType.h:58
u32_t NodeID
Definition GeneralType.h:55
llvm::IRBuilder IRBuilder
Definition BasicTypes.h:74
StmtDPItem< SVFGNode > LocDPItem
Definition FlowDDA.h:48