Static Value-Flow Analysis
Loading...
Searching...
No Matches
ProgSlice.h
Go to the documentation of this file.
1//===- ProgSlice.h -- Program slicing based on SVF----------------------------//
2//
3// SVF: Static Value-Flow Analysis
4//
5// Copyright (C) <2013-> <Yulei Sui>
6//
7
8// This program is free software: you can redistribute it and/or modify
9// it under the terms of the GNU Affero General Public License as published by
10// the Free Software Foundation, either version 3 of the License, or
11// (at your option) any later version.
12
13// This program is distributed in the hope that it will be useful,
14// but WITHOUT ANY WARRANTY; without even the implied warranty of
15// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16// GNU Affero General Public License for more details.
17
18// You should have received a copy of the GNU Affero General Public License
19// along with this program. If not, see <http://www.gnu.org/licenses/>.
20//
21//===----------------------------------------------------------------------===//
22
23/*
24 * ProgSlice.h
25 *
26 * Created on: Apr 1, 2014
27 * Author: Yulei Sui
28 *
29 * The implementation is based on
30 * (1) Yulei Sui, Ding Ye, and Jingling Xue. "Static Memory Leak Detection Using Full-Sparse Value-Flow Analysis".
31 * 2012 International Symposium on Software Testing and Analysis (ISSTA'12)
32 *
33 * (2) Yulei Sui, Ding Ye, and Jingling Xue. "Detecting Memory Leaks Statically with Full-Sparse Value-Flow Analysis".
34 * IEEE Transactions on Software Engineering (TSE'14)
35 */
36
37#ifndef PROGSLICE_H_
38#define PROGSLICE_H_
39
41#include "Util/WorkList.h"
42#include "Graphs/SVFG.h"
43#include "Util/SVFBugReport.h"
44
45namespace SVF
46{
47
49{
50
51public:
53 typedef SVFGNodeSet::const_iterator SVFGNodeSetIter;
56
59
61
62
69
71 virtual ~ProgSlice()
72 {
73 destroy();
74 }
75
77 {
78 return forwardslice.size();
79 }
81 {
82 return backwardslice.size();
83 }
85
86 inline void addToForwardSlice(const SVFGNode* node)
87 {
88 forwardslice.insert(node);
89 }
90 inline void addToBackwardSlice(const SVFGNode* node)
91 {
92 backwardslice.insert(node);
93 }
94 inline bool inForwardSlice(const SVFGNode* node)
95 {
96 return forwardslice.find(node)!=forwardslice.end();
97 }
98 inline bool inBackwardSlice(const SVFGNode* node)
99 {
100 return backwardslice.find(node)!=backwardslice.end();
101 }
103 {
104 return forwardslice.begin();
105 }
107 {
108 return forwardslice.end();
109 }
111 {
112 return backwardslice.begin();
113 }
115 {
116 return backwardslice.end();
117 }
119
121
122 inline const SVFGNode* getSource() const
123 {
124 return root;
125 }
126 inline void addToSinks(const SVFGNode* node)
127 {
128 sinks.insert(node);
129 }
130 inline const SVFGNodeSet& getSinks() const
131 {
132 return sinks;
133 }
135 {
136 return sinks.begin();
137 }
139 {
140 return sinks.end();
141 }
143 {
144 partialReachable = true;
145 }
146 inline void setAllReachable()
147 {
148 fullReachable = true;
149 }
150 inline bool setReachGlobal()
151 {
152 return reachGlob = true;
153 }
154 inline bool isPartialReachable() const
155 {
156 return partialReachable || reachGlob;
157 }
158 inline bool isAllReachable() const
159 {
160 return fullReachable || reachGlob;
161 }
162 inline bool isReachGlobal() const
163 {
164 return reachGlob;
165 }
167
170 bool isSatisfiableForAll();
172
174
175 const CallICFGNode* getCallSite(const SVFGEdge* edge) const;
176 const CallICFGNode* getRetSite(const SVFGEdge* edge) const;
178
180
182 {
183 return pathAllocator->condAnd(lhs,rhs);
184 }
185 inline Condition condOr(const Condition &lhs, const Condition &rhs)
186 {
187 return pathAllocator->condOr(lhs,rhs);
188 }
189 inline Condition condNeg(const Condition &cond)
190 {
191 return pathAllocator->condNeg(cond);
192 }
193 inline Condition getTrueCond() const
194 {
195 return pathAllocator->getTrueCond();
196 }
197 inline Condition getFalseCond() const
198 {
199 return pathAllocator->getFalseCond();
200 }
201 inline std::string dumpCond(const Condition& cond) const
202 {
203 return pathAllocator->dumpCond(cond);
204 }
206 std::string evalFinalCond() const;
210
211protected:
212 inline const SVFG* getSVFG() const
213 {
214 return svfg;
215 }
216
218 void destroy();
220 inline void clearCFCond()
221 {
224 }
225
227
228 inline Condition getVFCond(const SVFGNode* node) const
229 {
230 SVFGNodeToCondMap::const_iterator it = svfgNodeToCondMap.find(node);
231 if(it==svfgNodeToCondMap.end())
232 {
233 return getFalseCond();
234 }
235 return it->second;
236 }
237 inline bool setVFCond(const SVFGNode* node, const Condition &cond)
238 {
239 SVFGNodeToCondMap::iterator it = svfgNodeToCondMap.find(node);
240 // until a fixed-point is reached (condition is not changed)
241 if(it!=svfgNodeToCondMap.end() && isEquivalentBranchCond(it->second, cond))
242 return false;
243
244 svfgNodeToCondMap[node] = cond;
245 return true;
246 }
248
250
252 {
253 return pathAllocator->ComputeIntraVFGGuard(src,dst);
254 }
260 {
262 }
264
265 inline bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const
266 {
268 };
269
273 inline const SVFBasicBlock* getSVFGNodeBB(const SVFGNode* node) const
274 {
275 const ICFGNode* icfgNode = node->getICFGNode();
276 if(SVFUtil::isa<NullPtrSVFGNode>(node) == false)
277 {
278 return icfgNode->getBB();
279 }
280 return nullptr;
281 }
282
284
285 inline const SVFGNode* getCurSVFGNode() const
286 {
287 return _curSVFGNode;
288 }
289 inline void setCurSVFGNode(const SVFGNode* node)
290 {
291 _curSVFGNode = node;
293 }
295
296 inline void setFinalCond(const Condition &cond)
297 {
298 finalCond = cond;
299 }
300
303
308
309private:
313 const SVFGNode* root;
321 const SVFG* svfg;
322};
323
324} // End namespace SVF
325
326#endif /* PROGSLICE_H_ */
#define false
Definition cJSON.cpp:70
std::vector< SVFBugEvent > EventStack
virtual const SVFBasicBlock * getBB() const
Return the basic block of this ICFGNode.
Definition ICFGNode.h:81
void addToForwardSlice(const SVFGNode *node)
Forward and backward slice operations.
Definition ProgSlice.h:86
Condition finalCond
final condition
Definition ProgSlice.h:320
std::string dumpCond(const Condition &cond) const
Definition ProgSlice.h:201
bool inBackwardSlice(const SVFGNode *node)
Definition ProgSlice.h:98
bool isReachGlobal() const
Definition ProgSlice.h:162
const CallICFGNode * getRetSite(const SVFGEdge *edge) const
Condition condNeg(const Condition &cond)
Definition ProgSlice.h:189
const SVFBasicBlock * getSVFGNodeBB(const SVFGNode *node) const
Definition ProgSlice.h:273
void evalFinalCond2Event(GenericBug::EventStack &eventStack) const
Add final condition to eventStack.
SaberCondAllocator::SVFGNodeToSVFGNodeSetMap SVFGNodeToSVFGNodeSetMap
Definition ProgSlice.h:60
SVFGNodeSetIter sinksEnd() const
Definition ProgSlice.h:138
bool partialReachable
reachable from some paths
Definition ProgSlice.h:315
const SVFGNodeSet & getSinks() const
Definition ProgSlice.h:130
bool isAllReachable() const
Definition ProgSlice.h:158
const SVFGNodeToSVFGNodeSetMap & getRemovedSUVFEdges() const
Definition ProgSlice.h:304
bool isPartialReachable() const
Definition ProgSlice.h:154
bool setReachGlobal()
Definition ProgSlice.h:150
Condition condOr(const Condition &lhs, const Condition &rhs)
Definition ProgSlice.h:185
const SVFG * svfg
SVFG.
Definition ProgSlice.h:321
bool isSatisfiableForPairs()
Set< const SVFGNode * > SVFGNodeSet
Definition ProgSlice.h:52
const SVFGNode * getCurSVFGNode() const
Get/set current SVFG node.
Definition ProgSlice.h:285
Condition getTrueCond() const
Definition ProgSlice.h:193
bool inForwardSlice(const SVFGNode *node)
Definition ProgSlice.h:94
bool isSatisfiableForAll()
bool fullReachable
reachable from all paths
Definition ProgSlice.h:316
const SVFG * getSVFG() const
Definition ProgSlice.h:212
FIFOWorkList< const SVFGNode * > VFWorkList
worklist for value-flow guard computation
Definition ProgSlice.h:57
bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const
Definition ProgSlice.h:265
FIFOWorkList< const SVFBasicBlock * > CFWorkList
worklist for control-flow guard computation
Definition ProgSlice.h:58
Condition ComputeInterCallVFGGuard(const SVFBasicBlock *src, const SVFBasicBlock *dst, const SVFBasicBlock *callBB)
Definition ProgSlice.h:255
void destroy()
Release memory.
const CallICFGNode * getCallSite(const SVFGEdge *edge) const
Get callsite ID and get returnsiteID from SVFGEdge.
u32_t getBackwardSliceSize() const
Definition ProgSlice.h:80
Condition getFalseCond() const
Definition ProgSlice.h:197
const SVFGNode * getSource() const
root and sink operations
Definition ProgSlice.h:122
bool AllPathReachableSolve()
Guarded reachability solve.
Definition ProgSlice.cpp:43
SaberCondAllocator::Condition Condition
Definition ProgSlice.h:54
u32_t getForwardSliceSize() const
Definition ProgSlice.h:76
SaberCondAllocator * pathAllocator
path condition allocator
Definition ProgSlice.h:318
bool reachGlob
Whether slice reach a global.
Definition ProgSlice.h:317
SVFGNodeSet sinks
a set of sink nodes
Definition ProgSlice.h:312
void clearCFCond()
Clear Control flow conditions before each VF computation.
Definition ProgSlice.h:220
SVFGNodeSetIter backwardSliceBegin() const
Definition ProgSlice.h:110
bool setVFCond(const SVFGNode *node, const Condition &cond)
Definition ProgSlice.h:237
Condition ComputeInterRetVFGGuard(const SVFBasicBlock *src, const SVFBasicBlock *dst, const SVFBasicBlock *retBB)
Definition ProgSlice.h:259
Condition computeInvalidCondFromRemovedSUVFEdge(const SVFGNode *cur)
Compute invalid branch condition stemming from removed strong update value-flow edges.
SVFGNodeSet forwardslice
the forward slice
Definition ProgSlice.h:310
void addToBackwardSlice(const SVFGNode *node)
Definition ProgSlice.h:90
Condition condAnd(const Condition &lhs, const Condition &rhs)
Condition operations.
Definition ProgSlice.h:181
void addToSinks(const SVFGNode *node)
Definition ProgSlice.h:126
virtual ~ProgSlice()
Destructor.
Definition ProgSlice.h:71
const SVFGNode * root
root node on the slice
Definition ProgSlice.h:313
Map< const SVFGNode *, Condition > SVFGNodeToCondMap
map a SVFGNode to its condition during value-flow guard computation
Definition ProgSlice.h:55
SVFGNodeSetIter forwardSliceEnd() const
Definition ProgSlice.h:106
SVFGNodeSet backwardslice
the backward slice
Definition ProgSlice.h:311
SVFGNodeSetIter sinksBegin() const
Definition ProgSlice.h:134
SVFGNodeSetIter forwardSliceBegin() const
Definition ProgSlice.h:102
void setAllReachable()
Definition ProgSlice.h:146
Condition ComputeIntraVFGGuard(const SVFBasicBlock *src, const SVFBasicBlock *dst)
Compute guards for value-flows.
Definition ProgSlice.h:251
Condition getVFCond(const SVFGNode *node) const
Get/set VF (value-flow) and CF (control-flow) conditions.
Definition ProgSlice.h:228
SVFGNodeSetIter backwardSliceEnd() const
Definition ProgSlice.h:114
SVFGNodeToCondMap svfgNodeToCondMap
map a SVFGNode to its path condition starting from root
Definition ProgSlice.h:314
void setCurSVFGNode(const SVFGNode *node)
Definition ProgSlice.h:289
const SVFGNode * _curSVFGNode
current svfg node during guard computation
Definition ProgSlice.h:319
SVFGNodeSet::const_iterator SVFGNodeSetIter
Definition ProgSlice.h:53
void setFinalCond(const Condition &cond)
Set final condition after all path reachability analysis.
Definition ProgSlice.h:296
void setPartialReachable()
Definition ProgSlice.h:142
std::string evalFinalCond() const
Evaluate final condition.
ProgSlice(const SVFGNode *src, SaberCondAllocator *pa, const SVFG *graph)
Constructor.
Definition ProgSlice.h:64
std::string dumpCond(const Condition &cond) const
Map< const SVFGNode *, Set< const SVFGNode * > > SVFGNodeToSVFGNodeSetMap
Condition condOr(const Condition &lhs, const Condition &rhs)
Condition condNeg(const Condition &cond)
Condition condAnd(const Condition &lhs, const Condition &rhs)
Condition operations.
virtual Condition ComputeInterRetVFGGuard(const SVFBasicBlock *src, const SVFBasicBlock *dst, const SVFBasicBlock *retBB)
Condition getFalseCond() const
bool isEquivalentBranchCond(const Condition &lhs, const Condition &rhs) const
Whether lhs and rhs are equivalent branch conditions.
Condition getTrueCond() const
SVFGNodeToSVFGNodeSetMap & getRemovedSUVFEdges()
void setCurEvalSVFGNode(const SVFGNode *node)
Set current value for branch condition evaluation.
virtual Condition ComputeInterCallVFGGuard(const SVFBasicBlock *src, const SVFBasicBlock *dst, const SVFBasicBlock *callBB)
virtual Condition ComputeIntraVFGGuard(const SVFBasicBlock *src, const SVFBasicBlock *dst)
Guard Computation for a value-flow (between two basic blocks)
virtual const ICFGNode * getICFGNode() const
Return corresponding ICFG node.
Definition VFGNode.h:67
for isBitcode
Definition BasicTypes.h:70
llvm::IRBuilder IRBuilder
Definition BasicTypes.h:76
unsigned u32_t
Definition GeneralType.h:67