Static Value-Flow Analysis
PointerAnalysis.h
Go to the documentation of this file.
1 //===- PointerAnalysis.h -- Base class of pointer analyses--------------------//
2 //
3 // SVF: Static Value-Flow Analysis
4 //
5 // Copyright (C) <2013-> <Yulei Sui>
6 //
7 
8 // This program is free software: you can redistribute it and/or modify
9 // it under the terms of the GNU Affero General Public License as published by
10 // the Free Software Foundation, either version 3 of the License, or
11 // (at your option) any later version.
12 
13 // This program is distributed in the hope that it will be useful,
14 // but WITHOUT ANY WARRANTY; without even the implied warranty of
15 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 // GNU Affero General Public License for more details.
17 
18 // You should have received a copy of the GNU Affero General Public License
19 // along with this program. If not, see <http://www.gnu.org/licenses/>.
20 //
21 //===----------------------------------------------------------------------===//
22 
23 /*
24  * PointerAnalysis.h
25  *
26  * Created on: Nov 12, 2013
27  * Author: Yulei Sui
28  */
29 
30 #ifndef POINTERANALYSIS_H_
31 #define POINTERANALYSIS_H_
32 
33 #include <unistd.h>
34 #include <signal.h>
35 
36 #include "Graphs/CHG.h"
37 #include "Graphs/ThreadCallGraph.h"
38 #include "Graphs/SCC.h"
43 #include "MemoryModel/PointsTo.h"
44 #include "SVFIR/SVFIR.h"
45 
46 namespace SVF
47 {
48 
49 class CommonCHGraph;
50 
51 class SVFModule;
52 class ICFG;
53 class PTAStat;
54 /*
55  * Pointer Analysis Base Class
56  */
58 {
59 
60 public:
62  enum PTATY
63  {
64  // Whole program analysis
81 
82  // Demand driven analysis
87 
88 
90  };
91 
93  enum PTAImplTy
94  {
98  };
99 
101 
110 
123 
124 private:
126  void destroy();
127 
128 protected:
129 
131 
132  bool print_stat;
139 
141  static SVFIR* pag;
158 
159 public:
161  inline ICFG* getICFG() const
162  {
163  return pag->getICFG();
164  }
167  {
169  }
171  inline PTACallGraph* getCallGraph() const
172  {
173  return callgraph;
174  }
177  {
178  return callGraphSCC;
179  }
180 
182  PointerAnalysis(SVFIR* pag, PTATY ty = Default_PTA, bool alias_check = true);
183 
185  inline PTATY getAnalysisTy() const
186  {
187  return ptaTy;
188  }
189 
191  inline PTAImplTy getImplTy() const
192  {
193  return ptaImplTy;
194  }
195 
198  inline SVFIR* getPAG() const
199  {
200  return pag;
201  }
203 
205  inline PTAStat* getStat() const
206  {
207  return stat;
208  }
210  inline SVFModule* getModule() const
211  {
212  return svfMod;
213  }
216  {
217  return pag->getAllValidPtrs();
218  }
219 
221  virtual ~PointerAnalysis();
222 
224  virtual void initialize();
225 
227  virtual void finalize();
228 
230  virtual void analyze() = 0;
231 
233  virtual void computeDDAPts(NodeID) {}
234 
236  virtual AliasResult alias(const SVFValue* V1,
237  const SVFValue* V2) = 0;
238 
240  virtual AliasResult alias(NodeID node1, NodeID node2) = 0;
241 
243  virtual const PointsTo& getPts(NodeID ptr) = 0;
244 
247  virtual const NodeSet& getRevPts(NodeID nodeId) = 0;
248 
250  void printIndCSTargets(const CallICFGNode* cs, const FunctionSet& targets);
251 
252  // Debug purpose
254  virtual void dumpTopLevelPtsTo() {}
255  virtual void dumpAllPts() {}
256  virtual void dumpCPts() {}
257  virtual void dumpPts(NodeID ptr, const PointsTo& pts);
258  void printIndCSTargets();
259  void dumpAllTypes();
261 
262 protected:
265  {
266  return pag->getIndirectCallsites();
267  }
269  inline NodeID getFunPtr(const CallICFGNode* cs) const
270  {
271  return pag->getFunPtr(cs);
272  }
274 
275  virtual void validateTests();
276  virtual void validateSuccessTests(std::string fun);
277  virtual void validateExpectedFailureTests(std::string fun);
279 
281  void resetObjFieldSensitive();
282 
283 public:
285  void dumpStat();
286 
288 
289  inline bool containBlackHoleNode(const PointsTo& pts)
290  {
291  return pts.test(pag->getBlackHoleNode());
292  }
293  inline bool containConstantNode(const PointsTo& pts)
294  {
295  return pts.test(pag->getConstantNode());
296  }
297  virtual inline bool isBlkObjOrConstantObj(NodeID ptd) const
298  {
299  return pag->isBlkObjOrConstantObj(ptd);
300  }
302 
304 
305  inline bool isHeapMemObj(NodeID id) const
306  {
307  const MemObj* mem = pag->getObject(id);
308  assert(mem && "memory object is null??");
309  return mem->isHeap();
310  }
311 
312  inline bool isArrayMemObj(NodeID id) const
313  {
314  const MemObj* mem = pag->getObject(id);
315  assert(mem && "memory object is null??");
316  return mem->isArray();
317  }
319 
322  inline bool isFIObjNode(NodeID id) const
323  {
324  return (SVFUtil::isa<FIObjVar>(pag->getGNode(id)));
325  }
327  {
328  return pag->getBaseObjVar(id);
329  }
331  {
332  return pag->getFIObjVar(id);
333  }
334  inline NodeID getGepObjVar(NodeID id, const APOffset& ap)
335  {
336  return pag->getGepObjVar(id, ap);
337  }
338  virtual inline const NodeBS& getAllFieldsObjVars(NodeID id)
339  {
340  return pag->getAllFieldsObjVars(id);
341  }
343  {
344  MemObj* mem = const_cast<MemObj*>(pag->getBaseObj(id));
345  mem->setFieldInsensitive();
346  }
347  inline bool isFieldInsensitive(NodeID id) const
348  {
349  const MemObj* mem = pag->getBaseObj(id);
350  return mem->isFieldInsensitive();
351  }
353 
355  inline bool printStat()
356  {
357  return print_stat;
358  }
359 
361  inline void disablePrintStat()
362  {
363  print_stat = false;
364  }
365 
367 
369  {
370  return getCallGraph()->getIndCallMap();
371  }
372  inline bool hasIndCSCallees(const CallICFGNode* cs) const
373  {
374  return getCallGraph()->hasIndCSCallees(cs);
375  }
376  inline const FunctionSet& getIndCSCallees(const CallICFGNode* cs) const
377  {
378  return getCallGraph()->getIndCSCallees(cs);
379  }
381 
383  virtual void resolveIndCalls(const CallICFGNode* cs, const PointsTo& target, CallEdgeMap& newEdges);
384 
386 
387  inline void callGraphSCCDetection()
389  {
390  if(callGraphSCC==nullptr)
392 
393  callGraphSCC->find();
394  }
397  {
398  return callGraphSCC->repNode(id);
399  }
401  inline bool inSameCallGraphSCC(const SVFFunction* fun1,const SVFFunction* fun2)
402  {
403  const PTACallGraphNode* src = callgraph->getCallGraphNode(fun1);
404  const PTACallGraphNode* dst = callgraph->getCallGraphNode(fun2);
405  return (getCallGraphSCCRepNode(src->getId()) == getCallGraphSCCRepNode(dst->getId()));
406  }
407  inline bool isInRecursion(const SVFFunction* fun) const
408  {
410  }
412  bool isLocalVarInRecursiveFun(NodeID id) const;
414 
416  virtual const std::string PTAName() const
417  {
418  return "Pointer Analysis";
419  }
420 
423  {
424  return chgraph;
425  }
426 
427  void getVFnsFromCHA(const CallICFGNode* cs, VFunSet &vfns);
428  void getVFnsFromPts(const CallICFGNode* cs, const PointsTo &target, VFunSet &vfns);
429  void connectVCallToVFns(const CallICFGNode* cs, const VFunSet &vfns, CallEdgeMap& newEdges);
430  virtual void resolveCPPIndCalls(const CallICFGNode* cs,
431  const PointsTo& target,
432  CallEdgeMap& newEdges);
433 };
434 
435 } // End namespace SVF
436 
437 #endif /* POINTERANALYSIS_H_ */
const char *const string
Definition: cJSON.h:172
Common base for class hierarchy graph. Only implements what PointerAnalysis needs.
Definition: CHG.h:51
NodeType * getGNode(NodeID id) const
Get a node.
Definition: GenericGraph.h:653
Definition: ICFG.h:48
NodeID getBlackHoleNode() const
Definition: IRGraph.h:161
NodeID getConstantNode() const
Definition: IRGraph.h:165
bool isFieldInsensitive() const
Return true if its field limit is 0.
bool isHeap() const
void setFieldInsensitive()
Set the memory object to be field insensitive.
bool isArray() const
u32_t getNumOfResolvedIndCallEdge() const
Definition: PTACallGraph.h:324
bool hasIndCSCallees(const CallICFGNode *cs) const
Definition: PTACallGraph.h:308
PTACallGraphNode * getCallGraphNode(NodeID id) const
Get call graph node.
Definition: PTACallGraph.h:339
const FunctionSet & getIndCSCallees(const CallICFGNode *cs) const
Definition: PTACallGraph.h:312
CallEdgeMap & getIndCallMap()
Get callees from an indirect callsite.
Definition: PTACallGraph.h:304
void getVFnsFromPts(const CallICFGNode *cs, const PointsTo &target, VFunSet &vfns)
void destroy()
Release the memory.
virtual void validateTests()
Alias check functions to verify correctness of pointer analysis.
PTATY
Pointer analysis type list.
@ Cxt_DDA
context sensitive DDA
@ CFLFICI_WPA
Flow-, context-, insensitive CFL-reachability-based analysis.
@ VFS_WPA
Versioned sparse flow-sensitive WPA.
@ FSCS_WPA
Flow-, context- sensitive WPA.
@ FSDATAFLOW_WPA
Traditional Dataflow-based flow sensitive WPA.
@ AndersenSCD_WPA
Selective cycle detection andersen-style WPA.
@ Andersen_BASE
Base Andersen PTA.
@ FlowS_DDA
Flow sensitive DDA.
@ Andersen_WPA
Andersen PTA.
@ CFLFSCS_WPA
Flow-, context-, CFL-reachability-based analysis.
@ FieldS_DDA
Field sensitive DDA.
@ AndersenWaveDiff_WPA
Diff wave propagation andersen-style WPA.
@ CSCallString_WPA
Call string based context sensitive WPA.
@ PathS_DDA
Guarded value-flow DDA.
@ TypeCPP_WPA
Type-based analysis for C++.
@ AndersenSFR_WPA
Stride-based field representation.
@ Steensgaard_WPA
Steensgaard PTA.
@ FSSPARSE_WPA
Sparse flow sensitive WPA.
@ Default_PTA
default pta without any analysis
@ CSSummary_WPA
Summary based context sensitive WPA.
@ CFLFSCI_WPA
Flow-insensitive, context-sensitive CFL-reachability-based analysis.
virtual void computeDDAPts(NodeID)
Compute points-to results on-demand, overridden by derived classes.
CallGraphSCC * getCallGraphSCC() const
Return call graph SCC.
CommonCHGraph * chgraph
CHGraph.
static const std::string aliasTestNoAliasMangled
PTAStat * getStat() const
Get PTA stat.
virtual AliasResult alias(NodeID node1, NodeID node2)=0
Interface exposed to users of our pointer analysis, given PAGNodeID.
bool isFieldInsensitive(NodeID id) const
bool isLocalVarInRecursiveFun(NodeID id) const
Whether a local variable is in function recursions.
virtual void finalize()
Finalization of a pointer analysis, including checking alias correctness.
static const std::string aliasTestMayAliasMangled
PointerAnalysis(SVFIR *pag, PTATY ty=Default_PTA, bool alias_check=true)
Constructor.
static const std::string aliasTestFailNoAlias
virtual void dumpPts(NodeID ptr, const PointsTo &pts)
CallEdgeMap & getIndCallMap()
Get callees from an indirect callsite.
SVFIR * getPAG() const
static const std::string aliasTestFailMayAlias
bool print_stat
User input flags.
OrderedMap< const CallICFGNode *, FunctionSet > CallEdgeMap
virtual void initialize()
Initialization of a pointer analysis, including building symbol table and SVFIR etc.
virtual bool isBlkObjOrConstantObj(NodeID ptd) const
bool printStat()
Whether print statistics.
virtual ~PointerAnalysis()
Destructor.
virtual const PointsTo & getPts(NodeID ptr)=0
Get points-to targets of a pointer. It needs to be implemented in child class.
Set< const CallICFGNode * > CallSiteSet
Indirect call edges type, map a callsite to a set of callees.
bool containBlackHoleNode(const PointsTo &pts)
Determine whether a points-to contains a black hole or constant node.
Set< const SVFGlobalValue * > VTableSet
PTAImplTy ptaImplTy
PTA implementation type.
virtual const NodeBS & getAllFieldsObjVars(NodeID id)
PTAStat * stat
Statistics.
OrderedNodeSet & getAllValidPtrs()
Get all Valid Pointers for resolution.
virtual void dumpTopLevelPtsTo()
static const std::string aliasTestFailMayAliasMangled
NodeID getFIObjVar(NodeID id)
void connectVCallToVFns(const CallICFGNode *cs, const VFunSet &vfns, CallEdgeMap &newEdges)
void resetObjFieldSensitive()
Reset all object node as field-sensitive.
static const std::string aliasTestMustAlias
static const std::string aliasTestMayAlias
PTACallGraph * getCallGraph() const
Return call graph.
virtual void validateSuccessTests(std::string fun)
SVFModule * svfMod
Module.
static const std::string aliasTestPartialAlias
virtual void dumpAllPts()
bool isArrayMemObj(NodeID id) const
virtual void resolveIndCalls(const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
Resolve indirect call edges.
ICFG * icfg
Interprocedural control-flow graph.
const CallSiteToFunPtrMap & getIndirectCallsites() const
Return all indirect callsites.
NodeID getBaseObjVar(NodeID id)
bool isInRecursion(const SVFFunction *fun) const
Set< const SVFFunction * > VFunSet
bool alias_validation
Flag for validating points-to/alias results.
NodeID getGepObjVar(NodeID id, const APOffset &ap)
void callGraphSCCDetection()
PTACallGraph SCC related methods.
void dumpStat()
Dump the statistics.
virtual void validateExpectedFailureTests(std::string fun)
bool hasIndCSCallees(const CallICFGNode *cs) const
virtual void resolveCPPIndCalls(const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
Resolve cpp indirect call edges.
PTAImplTy
Implementation type: BVDataPTAImpl or CondPTAImpl.
@ BaseImpl
Represents PointerAnalaysis.
@ BVDataImpl
Represents BVDataPTAImpl.
@ CondImpl
Represents CondPTAImpl.
PTAImplTy getImplTy() const
Return implementation type of the pointer analysis.
Set< const SVFFunction * > FunctionSet
PTATY getAnalysisTy() const
Type of pointer analysis.
static const std::string aliasTestNoAlias
SCCDetection< PTACallGraph * > CallGraphSCC
void setObjFieldInsensitive(NodeID id)
static const std::string aliasTestPartialAliasMangled
PTACallGraph * callgraph
Call graph used for pointer analysis.
u32_t getNumOfResolvedIndCallEdge() const
Return number of resolved indirect call edges.
virtual void dumpCPts()
SVFModule * getModule() const
Module.
SVFIR::CallSiteToFunPtrMap CallSiteToFunPtrMap
virtual const NodeSet & getRevPts(NodeID nodeId)=0
NodeID getFunPtr(const CallICFGNode *cs) const
Return function pointer PAGNode at a callsite cs.
static SVFIR * pag
SVFIR.
void getVFnsFromCHA(const CallICFGNode *cs, VFunSet &vfns)
PTATY ptaTy
Pointer analysis Type.
ICFG * getICFG() const
Get ICFG.
const FunctionSet & getIndCSCallees(const CallICFGNode *cs) const
virtual AliasResult alias(const SVFValue *V1, const SVFValue *V2)=0
Interface exposed to users of our pointer analysis, given Value infos.
virtual void analyze()=0
Start Analysis here (main part of pointer analysis). It needs to be implemented in child class.
CommonCHGraph * getCHGraph() const
get CHGraph
CallGraphSCC * callGraphSCC
SCC for PTACallGraph.
bool inSameCallGraphSCC(const SVFFunction *fun1, const SVFFunction *fun2)
Return TRUE if this edge is inside a PTACallGraph SCC, i.e., src node and dst node are in the same SC...
bool isHeapMemObj(NodeID id) const
Whether this object is heap or array.
NodeID getCallGraphSCCRepNode(NodeID id) const
Get SCC rep node of a SVFG node.
static const std::string aliasTestMustAliasMangled
virtual const std::string PTAName() const
Return PTA name.
static const std::string aliasTestFailNoAliasMangled
void disablePrintStat()
Whether print statistics.
bool isFIObjNode(NodeID id) const
bool containConstantNode(const PointsTo &pts)
u32_t OnTheFlyIterBudgetForStat
Flag for iteration budget for on-the-fly statistics.
bool test(u32_t n) const
Returns true if n is in this set.
Definition: PointsTo.cpp:131
void find(void)
Definition: SCC.h:308
NodeID repNode(NodeID n) const
get the rep node if not found return itself
Definition: SCC.h:139
bool isInCycle(NodeID n) const
whether the node is in a cycle
Definition: SCC.h:149
NodeID getId() const
Get ID.
Definition: GenericGraph.h:260
NodeID getFunPtr(const CallICFGNode *cs) const
Definition: SVFIR.h:354
NodeID getFIObjVar(const MemObj *obj) const
Get a field-insensitive obj SVFIR node according to a mem obj.
Definition: SVFIR.h:415
const CallSiteToFunPtrMap & getIndirectCallsites() const
Add/get indirect callsites.
Definition: SVFIR.h:350
const MemObj * getObject(NodeID id) const
Definition: SVFIR.h:395
OrderedMap< const CallICFGNode *, NodeID > CallSiteToFunPtrMap
Definition: SVFIR.h:55
NodeBS & getAllFieldsObjVars(const MemObj *obj)
Get all fields of an object.
Definition: SVFIR.cpp:477
NodeID getBaseObjVar(NodeID id) const
Base and Offset methods for Value and Object node.
Definition: SVFIR.h:455
OrderedNodeSet & getAllValidPtrs()
Return valid pointers.
Definition: SVFIR.h:139
ICFG * getICFG() const
Definition: SVFIR.h:171
bool isBlkObjOrConstantObj(NodeID id) const
Definition: SVFIR.h:435
NodeID getGepObjVar(const MemObj *obj, const APOffset &ap)
Get a field SVFIR Object node according to base mem obj and offset.
Definition: SVFIR.cpp:422
const MemObj * getBaseObj(NodeID id) const
Definition: SVFIR.h:459
for isBitcode
Definition: BasicTypes.h:68
Set< NodeID > NodeSet
Definition: GeneralType.h:113
OrderedSet< NodeID > OrderedNodeSet
Definition: GeneralType.h:112
u32_t NodeID
Definition: GeneralType.h:55
s64_t APOffset
Definition: GeneralType.h:60
AliasResult
Definition: SVFType.h:527
Set< const SVFFunction * > VFunSet
Definition: CHG.h:47
unsigned u32_t
Definition: GeneralType.h:46
std::map< Key, Value, Compare, Allocator > OrderedMap
Definition: GeneralType.h:109
std::unordered_set< Key, Hash, KeyEqual, Allocator > Set
Definition: GeneralType.h:96