Static Value-Flow Analysis
Loading...
Searching...
No Matches
FlowDDA.h
Go to the documentation of this file.
1//===- FlowDDA.h -- Flow-sensitive demand-driven analysis -------------//
2//
3// SVF: Static Value-Flow Analysis
4//
5// Copyright (C) <2013-> <Yulei Sui>
6//
7
8// This program is free software: you can redistribute it and/or modify
9// it under the terms of the GNU Affero General Public License as published by
10// the Free Software Foundation, either version 3 of the License, or
11// (at your option) any later version.
12
13// This program is distributed in the hope that it will be useful,
14// but WITHOUT ANY WARRANTY; without even the implied warranty of
15// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16// GNU Affero General Public License for more details.
17
18// You should have received a copy of the GNU Affero General Public License
19// along with this program. If not, see <http://www.gnu.org/licenses/>.
20//
21//===----------------------------------------------------------------------===//
22
23/*
24 * FlowDDA.h
25 *
26 * Created on: Jun 30, 2014
27 * Author: Yulei Sui, Sen Ye
28 *
29 * The implementation is based on
30 * (1) Yulei Sui and Jingling Xue. "On-Demand Strong Update Analysis via Value-Flow Refinement".
31 * ACM SIGSOFT International Symposium on the Foundation of Software Engineering (FSE'16)
32 *
33 * (2) Yulei Sui and Jingling Xue. "Value-Flow-Based Demand-Driven Pointer Analysis for C and C++".
34 * IEEE Transactions on Software Engineering (TSE'18)
35 */
36
37#ifndef FlowDDA_H_
38#define FlowDDA_H_
39
41#include "DDA/DDAVFSolver.h"
42#include "Util/DPItem.h"
43#include "Util/GeneralType.h"
44
45namespace SVF
46{
47
48class DDAClient;
50
54class FlowDDA : public BVDataPTAImpl, public DDAVFSolver<NodeID,PointsTo,LocDPItem>
55{
56
57public:
68 inline virtual ~FlowDDA()
69 {
70 }
72 virtual void analyze() override {}
73
75 void computeDDAPts(NodeID id) override;
76
79
81 virtual bool handleBKCondition(LocDPItem& dpm, const SVFGEdge* edge) override;
82
85
87 inline virtual void initialize() override
88 {
93 stat = setDDAStat(new DDAStat(this));
94 }
95
97 inline virtual void finalize() override
98 {
100 }
101
107 virtual bool isHeapCondMemObj(const NodeID& var, const StoreSVFGNode* store) override;
108
110 virtual inline PointsTo getConservativeCPts(const LocDPItem& dpm) override
111 {
112 return getAndersenAnalysis()->getPts(dpm.getCurNodeID());
113 }
115 virtual inline NodeID getPtrNodeID(const NodeID& var) const override
116 {
117 return var;
118 }
120 virtual inline void handleAddr(PointsTo& pts,const LocDPItem& dpm,const AddrSVFGNode* addr) override
121 {
122 NodeID srcID = addr->getSrcNodeID();
126
128 DBOUT(DDDA, SVFUtil::outs() << "\t add points-to target " << srcID << " to dpm ");
129 DBOUT(DDDA, dpm.dump());
130 }
132 virtual PointsTo processGepPts(const GepSVFGNode* gep, const PointsTo& srcPts) override;
133
135
136 virtual void updateCallGraphAndSVFG(const LocDPItem& dpm,const CallICFGNode* cs,SVFGEdgeSet& svfgEdges) override
137 {
140 for (CallEdgeMap::const_iterator iter = newEdges.begin(),eiter = newEdges.end(); iter != eiter; iter++)
141 {
142 const CallICFGNode* newcs = iter->first;
143 const FunctionSet & functions = iter->second;
144 for (FunctionSet::const_iterator func_iter = functions.begin(); func_iter != functions.end(); func_iter++)
145 {
146 const FunObjVar* func = *func_iter;
148 }
149 }
150 }
152
154
155 virtual inline const PointsTo& getCachedTLPointsTo(const LocDPItem& dpm) override
156 {
157 return getPts(dpm.getCurNodeID());
158 }
160
163 {
164 if (isTopLevelPtrStmt(dpm.getLoc())) return unionPts(dpm.getCurNodeID(), targetPts);
165 else return dpmToADCPtSetMap[dpm] |= targetPts;
166 }
167
168 virtual const std::string PTAName() const override
169 {
170 return "FlowSensitive DDA";
171 }
172
173private:
175};
176
177} // End namespace SVF
178
179#endif /* FlowDDA_H_ */
#define DBOUT(TYPE, X)
LLVM debug macros, define type of your DBUG model of each pass.
Definition SVFType.h:576
#define DDDA
Definition SVFType.h:588
virtual const PointsTo & getPts(NodeID id)
Operation of points-to set.
Definition Andersen.h:239
void finalize() override
Finalization of pointer analysis, and normalize points-to information to Bit Vector representation.
const PointsTo & getPts(NodeID id) override
virtual bool unionPts(NodeID id, const PointsTo &target)
DPImToCPtSetMap dpmToADCPtSetMap
points-to caching map for address-taken vars
AndersenWaveDiff * getAndersenAnalysis() const
Return Andersen's analysis.
virtual void addDDAPts(PointsTo &pts, const NodeID &var)
Add pts.
bool isTopLevelPtrStmt(const SVFGNode *stmt)
Whether this is a top-level pointer statement.
void setCallGraph(CallGraph *cg)
Set callgraph.
void setCallGraphSCC(CallGraphSCC *scc)
Set callgraphSCC.
virtual const PointsTo & getCachedPointsTo(const LocDPItem &dpm)
Points-to Caching for top-level pointers and address-taken objects.
virtual void buildSVFG(SVFIR *pag)
Build SVFG.
DDAStat * setDDAStat(DDAStat *s)
Set DDAStat.
virtual PointsTo getConservativeCPts(const LocDPItem &dpm) override
Override parent method.
Definition FlowDDA.h:110
DDAClient * _client
DDA client.
Definition FlowDDA.h:174
void computeDDAPts(NodeID id) override
Compute points-to set for all top variable.
Definition FlowDDA.cpp:43
virtual void handleAddr(PointsTo &pts, const LocDPItem &dpm, const AddrSVFGNode *addr) override
Handle Address SVFGNode to add proper points-to.
Definition FlowDDA.h:120
bool testIndCallReachability(LocDPItem &dpm, const FunObjVar *callee, CallSiteID csId)
refine indirect call edge
Definition FlowDDA.cpp:81
virtual ~FlowDDA()
Destructor.
Definition FlowDDA.h:68
BVDataPTAImpl::CallEdgeMap CallEdgeMap
Definition FlowDDA.h:59
virtual void finalize() override
Finalize analysis.
Definition FlowDDA.h:97
BVDataPTAImpl::CallSiteSet CallSiteSet
Definition FlowDDA.h:58
void handleOutOfBudgetDpm(const LocDPItem &dpm)
Handle out-of-budget dpm.
Definition FlowDDA.cpp:72
virtual NodeID getPtrNodeID(const NodeID &var) const override
Override parent method.
Definition FlowDDA.h:115
virtual void analyze() override
dummy analyze method
Definition FlowDDA.h:72
FlowDDA(SVFIR *_pag, DDAClient *client)
Constructor.
Definition FlowDDA.h:62
virtual const std::string PTAName() const override
Return PTA name.
Definition FlowDDA.h:168
virtual const PointsTo & getCachedTLPointsTo(const LocDPItem &dpm) override
Override parent class functions to get/add cached points-to directly via PAGNode ID.
Definition FlowDDA.h:155
virtual PointsTo processGepPts(const GepSVFGNode *gep, const PointsTo &srcPts) override
processGep node
Definition FlowDDA.cpp:141
bool unionDDAPts(LocDPItem dpm, const PointsTo &targetPts) override
Union pts.
Definition FlowDDA.h:162
virtual bool handleBKCondition(LocDPItem &dpm, const SVFGEdge *edge) override
Handle condition for flow analysis (backward analysis)
Definition FlowDDA.cpp:102
BVDataPTAImpl::FunctionSet FunctionSet
Definition FlowDDA.h:60
virtual void updateCallGraphAndSVFG(const LocDPItem &dpm, const CallICFGNode *cs, SVFGEdgeSet &svfgEdges) override
Update call graph.
Definition FlowDDA.h:136
virtual void initialize() override
Initialization of the analysis.
Definition FlowDDA.h:87
virtual bool isHeapCondMemObj(const NodeID &var, const StoreSVFGNode *store) override
Definition FlowDDA.cpp:177
bool isFieldInsensitive(NodeID id) const
OrderedMap< const CallICFGNode *, FunctionSet > CallEdgeMap
virtual void initialize()
Initialization of a pointer analysis, including building symbol table and SVFIR etc.
Set< const CallICFGNode * > CallSiteSet
Indirect call edges type, map a callsite to a set of callees.
PTAStat * stat
Statistics.
NodeID getFIObjVar(NodeID id)
CallGraph * getCallGraph() const
Return call graph.
Set< const FunObjVar * > FunctionSet
virtual void resolveIndCalls(const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
Resolve indirect call edges.
static SVFIR * pag
SVFIR.
CallGraphSCC * getCallGraphSCC() const
Return call graph SCC.
virtual void connectCallerAndCallee(const CallICFGNode *cs, const FunObjVar *callee, SVFGEdgeSetTy &edges)
Connect SVFG nodes between caller and callee for indirect call site.
Definition SVFG.cpp:658
std::ostream & outs()
Overwrite llvm::outs()
Definition SVFUtil.h:52
for isBitcode
Definition BasicTypes.h:70
unsigned CallSiteID
Definition GeneralType.h:78
PTATY
Pointer analysis type list.
Definition PTATY.h:9
@ FlowS_DDA
Flow sensitive DDA.
Definition PTATY.h:30
u32_t NodeID
Definition GeneralType.h:76
llvm::IRBuilder IRBuilder
Definition BasicTypes.h:76
StmtDPItem< SVFGNode > LocDPItem
Definition FlowDDA.h:49