Static Value-Flow Analysis
FlowDDA.h
Go to the documentation of this file.
1 //===- FlowDDA.h -- Flow-sensitive demand-driven analysis -------------//
2 //
3 // SVF: Static Value-Flow Analysis
4 //
5 // Copyright (C) <2013-> <Yulei Sui>
6 //
7 
8 // This program is free software: you can redistribute it and/or modify
9 // it under the terms of the GNU Affero General Public License as published by
10 // the Free Software Foundation, either version 3 of the License, or
11 // (at your option) any later version.
12 
13 // This program is distributed in the hope that it will be useful,
14 // but WITHOUT ANY WARRANTY; without even the implied warranty of
15 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 // GNU Affero General Public License for more details.
17 
18 // You should have received a copy of the GNU Affero General Public License
19 // along with this program. If not, see <http://www.gnu.org/licenses/>.
20 //
21 //===----------------------------------------------------------------------===//
22 
23 /*
24  * FlowDDA.h
25  *
26  * Created on: Jun 30, 2014
27  * Author: Yulei Sui, Sen Ye
28  *
29  * The implementation is based on
30  * (1) Yulei Sui and Jingling Xue. "On-Demand Strong Update Analysis via Value-Flow Refinement".
31  * ACM SIGSOFT International Symposium on the Foundation of Software Engineering (FSE'16)
32  *
33  * (2) Yulei Sui and Jingling Xue. "Value-Flow-Based Demand-Driven Pointer Analysis for C and C++".
34  * IEEE Transactions on Software Engineering (TSE'18)
35  */
36 
37 #ifndef FlowDDA_H_
38 #define FlowDDA_H_
39 
41 #include "Util/DPItem.h"
42 #include "DDA/DDAVFSolver.h"
43 
44 namespace SVF
45 {
46 
47 class DDAClient;
49 
53 class FlowDDA : public BVDataPTAImpl, public DDAVFSolver<NodeID,PointsTo,LocDPItem>
54 {
55 
56 public:
63  _client(client)
64  {
65  }
67  inline virtual ~FlowDDA()
68  {
69  }
71  virtual void analyze() override {}
72 
74  void computeDDAPts(NodeID id) override;
75 
77  void handleOutOfBudgetDpm(const LocDPItem& dpm);
78 
80  virtual bool handleBKCondition(LocDPItem& dpm, const SVFGEdge* edge) override;
81 
83  bool testIndCallReachability(LocDPItem& dpm, const SVFFunction* callee, CallSiteID csId);
84 
86  inline virtual void initialize() override
87  {
89  buildSVFG(pag);
92  stat = setDDAStat(new DDAStat(this));
93  }
94 
96  inline virtual void finalize() override
97  {
99  }
100 
106  virtual bool isHeapCondMemObj(const NodeID& var, const StoreSVFGNode* store) override;
107 
109  virtual inline PointsTo getConservativeCPts(const LocDPItem& dpm) override
110  {
111  return getAndersenAnalysis()->getPts(dpm.getCurNodeID());
112  }
114  virtual inline NodeID getPtrNodeID(const NodeID& var) const override
115  {
116  return var;
117  }
119  virtual inline void handleAddr(PointsTo& pts,const LocDPItem& dpm,const AddrSVFGNode* addr) override
120  {
121  NodeID srcID = addr->getPAGSrcNodeID();
123  if (isFieldInsensitive(srcID))
124  srcID = getFIObjVar(srcID);
125 
126  addDDAPts(pts,srcID);
127  DBOUT(DDDA, SVFUtil::outs() << "\t add points-to target " << srcID << " to dpm ");
128  DBOUT(DDDA, dpm.dump());
129  }
131  virtual PointsTo processGepPts(const GepSVFGNode* gep, const PointsTo& srcPts) override;
132 
134 
135  virtual void updateCallGraphAndSVFG(const LocDPItem& dpm,const CallICFGNode* cs,SVFGEdgeSet& svfgEdges) override
136  {
137  CallEdgeMap newEdges;
138  resolveIndCalls(cs, getCachedPointsTo(dpm), newEdges);
139  for (CallEdgeMap::const_iterator iter = newEdges.begin(),eiter = newEdges.end(); iter != eiter; iter++)
140  {
141  const CallICFGNode* newcs = iter->first;
142  const FunctionSet & functions = iter->second;
143  for (FunctionSet::const_iterator func_iter = functions.begin(); func_iter != functions.end(); func_iter++)
144  {
145  const SVFFunction* func = *func_iter;
146  getSVFG()->connectCallerAndCallee(newcs, func, svfgEdges);
147  }
148  }
149  }
151 
153 
154  virtual inline const PointsTo& getCachedTLPointsTo(const LocDPItem& dpm) override
155  {
156  return getPts(dpm.getCurNodeID());
157  }
159 
161  bool unionDDAPts(LocDPItem dpm, const PointsTo& targetPts) override
162  {
163  if (isTopLevelPtrStmt(dpm.getLoc())) return unionPts(dpm.getCurNodeID(), targetPts);
164  else return dpmToADCPtSetMap[dpm] |= targetPts;
165  }
166 
167  virtual const std::string PTAName() const override
168  {
169  return "FlowSensitive DDA";
170  }
171 
172 private:
174 };
175 
176 } // End namespace SVF
177 
178 #endif /* FlowDDA_H_ */
#define DBOUT(TYPE, X)
LLVM debug macros, define type of your DBUG model of each pass.
Definition: SVFType.h:484
#define DDDA
Definition: SVFType.h:496
const char *const string
Definition: cJSON.h:172
virtual const PointsTo & getPts(NodeID id)
Operation of points-to set.
Definition: Andersen.h:239
void finalize() override
Finalization of pointer analysis, and normalize points-to information to Bit Vector representation.
const PointsTo & getPts(NodeID id) override
virtual bool unionPts(NodeID id, const PointsTo &target)
DPImToCPtSetMap dpmToADCPtSetMap
points-to caching map for address-taken vars
Definition: DDAVFSolver.h:783
virtual void addDDAPts(PointsTo &pts, const NodeID &var)
Add pts.
Definition: DDAVFSolver.h:113
bool isTopLevelPtrStmt(const SVFGNode *stmt)
Whether this is a top-level pointer statement.
Definition: DDAVFSolver.h:583
void setCallGraphSCC(CallGraphSCC *scc)
Set callgraphSCC.
Definition: DDAVFSolver.h:632
AndersenWaveDiff * getAndersenAnalysis() const
Return Andersen's analysis.
Definition: DDAVFSolver.h:717
DDAStat * setDDAStat(DDAStat *s)
Set DDAStat.
Definition: DDAVFSolver.h:747
virtual const PointsTo & getCachedPointsTo(const LocDPItem &dpm)
Points-to Caching for top-level pointers and address-taken objects.
Definition: DDAVFSolver.h:556
virtual void buildSVFG(SVFIR *pag)
Build SVFG.
Definition: DDAVFSolver.h:317
void setCallGraph(PTACallGraph *cg)
Set callgraph.
Definition: DDAVFSolver.h:627
NodeID getCurNodeID() const
Definition: DPItem.h:77
virtual PointsTo getConservativeCPts(const LocDPItem &dpm) override
Override parent method.
Definition: FlowDDA.h:109
DDAClient * _client
DDA client.
Definition: FlowDDA.h:173
void computeDDAPts(NodeID id) override
Compute points-to set for all top variable.
Definition: FlowDDA.cpp:43
virtual void handleAddr(PointsTo &pts, const LocDPItem &dpm, const AddrSVFGNode *addr) override
Handle Address SVFGNode to add proper points-to.
Definition: FlowDDA.h:119
virtual ~FlowDDA()
Destructor.
Definition: FlowDDA.h:67
BVDataPTAImpl::CallEdgeMap CallEdgeMap
Definition: FlowDDA.h:58
virtual void finalize() override
Finalize analysis.
Definition: FlowDDA.h:96
BVDataPTAImpl::CallSiteSet CallSiteSet
Definition: FlowDDA.h:57
void handleOutOfBudgetDpm(const LocDPItem &dpm)
Handle out-of-budget dpm.
Definition: FlowDDA.cpp:72
virtual const PointsTo & getCachedTLPointsTo(const LocDPItem &dpm) override
Override parent class functions to get/add cached points-to directly via PAGNode ID.
Definition: FlowDDA.h:154
virtual NodeID getPtrNodeID(const NodeID &var) const override
Override parent method.
Definition: FlowDDA.h:114
virtual void analyze() override
dummy analyze method
Definition: FlowDDA.h:71
FlowDDA(SVFIR *_pag, DDAClient *client)
Constructor.
Definition: FlowDDA.h:61
virtual const std::string PTAName() const override
Return PTA name.
Definition: FlowDDA.h:167
virtual PointsTo processGepPts(const GepSVFGNode *gep, const PointsTo &srcPts) override
processGep node
Definition: FlowDDA.cpp:141
bool unionDDAPts(LocDPItem dpm, const PointsTo &targetPts) override
Union pts.
Definition: FlowDDA.h:161
virtual bool handleBKCondition(LocDPItem &dpm, const SVFGEdge *edge) override
Handle condition for flow analysis (backward analysis)
Definition: FlowDDA.cpp:102
BVDataPTAImpl::FunctionSet FunctionSet
Definition: FlowDDA.h:59
bool testIndCallReachability(LocDPItem &dpm, const SVFFunction *callee, CallSiteID csId)
refine indirect call edge
Definition: FlowDDA.cpp:81
virtual void updateCallGraphAndSVFG(const LocDPItem &dpm, const CallICFGNode *cs, SVFGEdgeSet &svfgEdges) override
Update call graph.
Definition: FlowDDA.h:135
virtual void initialize() override
Initialization of the analysis.
Definition: FlowDDA.h:86
virtual bool isHeapCondMemObj(const NodeID &var, const StoreSVFGNode *store) override
Definition: FlowDDA.cpp:177
@ FlowS_DDA
Flow sensitive DDA.
CallGraphSCC * getCallGraphSCC() const
Return call graph SCC.
bool isFieldInsensitive(NodeID id) const
OrderedMap< const CallICFGNode *, FunctionSet > CallEdgeMap
virtual void initialize()
Initialization of a pointer analysis, including building symbol table and SVFIR etc.
Set< const CallICFGNode * > CallSiteSet
Indirect call edges type, map a callsite to a set of callees.
PTAStat * stat
Statistics.
NodeID getFIObjVar(NodeID id)
PTACallGraph * getCallGraph() const
Return call graph.
virtual void resolveIndCalls(const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
Resolve indirect call edges.
Set< const SVFFunction * > FunctionSet
static SVFIR * pag
SVFIR.
virtual void connectCallerAndCallee(const CallICFGNode *cs, const SVFFunction *callee, SVFGEdgeSetTy &edges)
Connect SVFG nodes between caller and callee for indirect call site.
Definition: SVFG.cpp:658
const LocCond * getLoc() const
Get context.
Definition: DPItem.h:153
void dump() const
Definition: DPItem.h:197
NodeID getPAGSrcNodeID() const
Definition: VFGNode.h:152
std::ostream & outs()
Overwrite llvm::outs()
Definition: SVFUtil.h:50
for isBitcode
Definition: BasicTypes.h:68
unsigned CallSiteID
Definition: GeneralType.h:58
u32_t NodeID
Definition: GeneralType.h:55
StmtDPItem< SVFGNode > LocDPItem
Definition: FlowDDA.h:47