Static Value-Flow Analysis
Public Types | Public Member Functions | Static Public Member Functions | Protected Member Functions | Protected Attributes | List of all members
SVF::Andersen Class Reference

#include <Andersen.h>

Inheritance diagram for SVF::Andersen:
SVF::AndersenBase SVF::WPASolver< GraphType > SVF::BVDataPTAImpl SVF::PointerAnalysis SVF::AndersenSCD SVF::AndersenWaveDiff SVF::AndersenSFR

Public Types

typedef SCCDetection< ConstraintGraph * > CGSCC
 
- Public Types inherited from SVF::AndersenBase
typedef OrderedMap< const CallICFGNode *, NodeIDCallSite2DummyValPN
 
- Public Types inherited from SVF::WPASolver< GraphType >
typedef SVF::GenericGraphTraits< GraphType > GTraits
 Define the GTraits and node iterator for printing. More...
 
typedef GTraits::NodeRef GNODE
 
typedef GTraits::EdgeType GEDGE
 
typedef GTraits::ChildIteratorType child_iterator
 
typedef SCCDetection< GraphType > SCC
 
typedef FIFOWorkList< NodeIDWorkList
 
- Public Types inherited from SVF::BVDataPTAImpl
enum  PTBackingType { Mutable , Persistent }
 How the PTData used is implemented. More...
 
typedef PTData< NodeID, NodeSet, NodeID, PointsToPTDataTy
 
typedef DiffPTData< NodeID, NodeSet, NodeID, PointsToDiffPTDataTy
 
typedef DFPTData< NodeID, NodeSet, NodeID, PointsToDFPTDataTy
 
typedef VersionedPTData< NodeID, NodeSet, NodeID, PointsTo, VersionedVar, Set< VersionedVar > > VersionedPTDataTy
 
typedef MutablePTData< NodeID, NodeSet, NodeID, PointsToMutPTDataTy
 
typedef MutableDiffPTData< NodeID, NodeSet, NodeID, PointsToMutDiffPTDataTy
 
typedef MutableDFPTData< NodeID, NodeSet, NodeID, PointsToMutDFPTDataTy
 
typedef MutableIncDFPTData< NodeID, NodeSet, NodeID, PointsToMutIncDFPTDataTy
 
typedef MutableVersionedPTData< NodeID, NodeSet, NodeID, PointsTo, VersionedVar, Set< VersionedVar > > MutVersionedPTDataTy
 
typedef PersistentPTData< NodeID, NodeSet, NodeID, PointsToPersPTDataTy
 
typedef PersistentDiffPTData< NodeID, NodeSet, NodeID, PointsToPersDiffPTDataTy
 
typedef PersistentDFPTData< NodeID, NodeSet, NodeID, PointsToPersDFPTDataTy
 
typedef PersistentIncDFPTData< NodeID, NodeSet, NodeID, PointsToPersIncDFPTDataTy
 
typedef PersistentVersionedPTData< NodeID, NodeSet, NodeID, PointsTo, VersionedVar, Set< VersionedVar > > PersVersionedPTDataTy
 
- Public Types inherited from SVF::PointerAnalysis
enum  PTATY {
  Andersen_BASE , Andersen_WPA , AndersenSCD_WPA , AndersenSFR_WPA ,
  AndersenWaveDiff_WPA , Steensgaard_WPA , CSCallString_WPA , CSSummary_WPA ,
  FSDATAFLOW_WPA , FSSPARSE_WPA , VFS_WPA , FSCS_WPA ,
  CFLFICI_WPA , CFLFSCI_WPA , CFLFSCS_WPA , TypeCPP_WPA ,
  FieldS_DDA , FlowS_DDA , PathS_DDA , Cxt_DDA ,
  Default_PTA
}
 Pointer analysis type list. More...
 
enum  PTAImplTy { BaseImpl , BVDataImpl , CondImpl }
 Implementation type: BVDataPTAImpl or CondPTAImpl. More...
 
typedef Set< const CallICFGNode * > CallSiteSet
 Indirect call edges type, map a callsite to a set of callees. More...
 
typedef SVFIR::CallSiteToFunPtrMap CallSiteToFunPtrMap
 
typedef Set< const SVFFunction * > FunctionSet
 
typedef OrderedMap< const CallICFGNode *, FunctionSetCallEdgeMap
 
typedef SCCDetection< PTACallGraph * > CallGraphSCC
 
typedef Set< const SVFGlobalValue * > VTableSet
 
typedef Set< const SVFFunction * > VFunSet
 

Public Member Functions

 Andersen (SVFIR *_pag, PTATY type=Andersen_WPA, bool alias_check=true)
 Constructor. More...
 
virtual ~Andersen ()
 Destructor. More...
 
virtual void initialize ()
 Initialize analysis. More...
 
virtual void finalize ()
 Finalize analysis. More...
 
void resetData ()
 Reset data. More...
 
virtual const PointsTogetPts (NodeID id)
 Operation of points-to set. More...
 
virtual bool unionPts (NodeID id, const PointsTo &target)
 
virtual bool unionPts (NodeID id, NodeID ptd)
 
void dumpTopLevelPtsTo ()
 
void setDetectPWC (bool flag)
 
- Public Member Functions inherited from SVF::AndersenBase
 AndersenBase (SVFIR *_pag, PTATY type=Andersen_BASE, bool alias_check=true)
 Constructor. More...
 
 ~AndersenBase () override
 Destructor. More...
 
virtual void analyze () override
 Andersen analysis. More...
 
virtual void solveAndwritePtsToFile (const std::string &filename)
 
virtual void readPtsFromFile (const std::string &filename)
 
virtual void solveConstraints ()
 
virtual bool updateCallGraph (const CallSiteToFunPtrMap &) override
 Update call graph. More...
 
virtual bool updateThreadCallGraph (const CallSiteToFunPtrMap &, NodePairSet &)
 Update thread call graph. More...
 
virtual void connectCaller2ForkedFunParams (const CallICFGNode *cs, const SVFFunction *F, NodePairSet &cpySrcNodes)
 Connect formal and actual parameters for indirect forksites. More...
 
virtual void connectCaller2CalleeParams (const CallICFGNode *cs, const SVFFunction *F, NodePairSet &cpySrcNodes)
 Connect formal and actual parameters for indirect callsites. More...
 
ConstraintGraphgetConstraintGraph ()
 Get constraint graph. More...
 
NodeID sccRepNode (NodeID id) const override
 SCC methods. More...
 
NodeBSsccSubNodes (NodeID repId)
 
void printStat ()
 dump statistics More...
 
virtual void normalizePointsTo () override
 
void cleanConsCG (NodeID id)
 remove redundant gepnodes in constraint graph More...
 
- Public Member Functions inherited from SVF::BVDataPTAImpl
 BVDataPTAImpl (SVFIR *pag, PointerAnalysis::PTATY type, bool alias_check=true)
 Constructor. More...
 
 ~BVDataPTAImpl () override=default
 Destructor. More...
 
PersistentPointsToCache< PointsTo > & getPtCache ()
 
const NodeSetgetRevPts (NodeID nodeId) override
 
virtual void clearPts (NodeID id, NodeID element)
 Remove element from the points-to set of id. More...
 
virtual void clearFullPts (NodeID id)
 Clear points-to set of id. More...
 
virtual bool addPts (NodeID id, NodeID ptd)
 
virtual void clearAllPts ()
 Clear all data. More...
 
virtual void expandFIObjs (const PointsTo &pts, PointsTo &expandedPts)
 Expand FI objects. More...
 
virtual void expandFIObjs (const NodeBS &pts, NodeBS &expandedPts)
 TODO: remove repetition. More...
 
void remapPointsToSets (void)
 Remap all points-to sets to use the current mapping. More...
 
virtual void writeToFile (const std::string &filename)
 Interface for analysis result storage on filesystem. More...
 
virtual void writeObjVarToFile (const std::string &filename)
 
virtual void writePtsResultToFile (std::fstream &f)
 
virtual void writeGepObjVarMapToFile (std::fstream &f)
 
virtual bool readFromFile (const std::string &filename)
 
virtual void readPtsResultFromFile (std::ifstream &f)
 
virtual void readGepObjVarMapFromFile (std::ifstream &f)
 
virtual void readAndSetObjFieldSensitivity (std::ifstream &f, const std::string &delimiterStr)
 
AliasResult alias (const SVFValue *V1, const SVFValue *V2) override
 Interface expose to users of our pointer analysis, given Value infos. More...
 
AliasResult alias (NodeID node1, NodeID node2) override
 Interface expose to users of our pointer analysis, given PAGNodeID. More...
 
virtual AliasResult alias (const PointsTo &pts1, const PointsTo &pts2)
 Interface expose to users of our pointer analysis, given two pts. More...
 
void dumpCPts () override
 dump and debug, print out conditional pts More...
 
void dumpAllPts () override
 
- Public Member Functions inherited from SVF::PointerAnalysis
ICFGgetICFG () const
 Get ICFG. More...
 
u32_t getNumOfResolvedIndCallEdge () const
 Return number of resolved indirect call edges. More...
 
PTACallGraphgetCallGraph () const
 Return call graph. More...
 
CallGraphSCCgetCallGraphSCC () const
 Return call graph SCC. More...
 
 PointerAnalysis (SVFIR *pag, PTATY ty=Default_PTA, bool alias_check=true)
 Constructor. More...
 
PTATY getAnalysisTy () const
 Type of pointer analysis. More...
 
PTAImplTy getImplTy () const
 Return implementation type of the pointer analysis. More...
 
bool printStat ()
 Whether print statistics. More...
 
void disablePrintStat ()
 Whether print statistics. More...
 
CallEdgeMapgetIndCallMap ()
 Get callees from an indirect callsite. More...
 
bool hasIndCSCallees (const CallICFGNode *cs) const
 
const FunctionSetgetIndCSCallees (const CallICFGNode *cs) const
 
virtual void resolveIndCalls (const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
 Resolve indirect call edges. More...
 
void callGraphSCCDetection ()
 PTACallGraph SCC related methods. More...
 
NodeID getCallGraphSCCRepNode (NodeID id) const
 Get SCC rep node of a SVFG node. More...
 
bool inSameCallGraphSCC (const SVFFunction *fun1, const SVFFunction *fun2)
 Return TRUE if this edge is inside a PTACallGraph SCC, i.e., src node and dst node are in the same SCC on the SVFG. More...
 
bool isInRecursion (const SVFFunction *fun) const
 
bool isLocalVarInRecursiveFun (NodeID id) const
 Whether a local variable is in function recursions. More...
 
CommonCHGraphgetCHGraph () const
 get CHGraph More...
 
void getVFnsFromCHA (const CallICFGNode *cs, VFunSet &vfns)
 
void getVFnsFromPts (const CallICFGNode *cs, const PointsTo &target, VFunSet &vfns)
 
void connectVCallToVFns (const CallICFGNode *cs, const VFunSet &vfns, CallEdgeMap &newEdges)
 
virtual void resolveCPPIndCalls (const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
 Resolve cpp indirect call edges. More...
 
SVFIRgetPAG () const
 
PTAStatgetStat () const
 Get PTA stat. More...
 
SVFModulegetModule () const
 Module. More...
 
OrderedNodeSetgetAllValidPtrs ()
 Get all Valid Pointers for resolution. More...
 
virtual ~PointerAnalysis ()
 Destructor. More...
 
virtual void computeDDAPts (NodeID)
 Compute points-to results on-demand, overridden by derived classes. More...
 
void printIndCSTargets (const CallICFGNode *cs, const FunctionSet &targets)
 Print targets of a function pointer. More...
 
virtual void dumpPts (NodeID ptr, const PointsTo &pts)
 
void printIndCSTargets ()
 
void dumpAllTypes ()
 
void dumpStat ()
 Dump the statistics. More...
 
bool containBlackHoleNode (const PointsTo &pts)
 Determine whether a points-to contains a black hole or constant node. More...
 
bool containConstantNode (const PointsTo &pts)
 
virtual bool isBlkObjOrConstantObj (NodeID ptd) const
 
bool isHeapMemObj (NodeID id) const
 Whether this object is heap or array. More...
 
bool isArrayMemObj (NodeID id) const
 
bool isFIObjNode (NodeID id) const
 
NodeID getBaseObjVar (NodeID id)
 
NodeID getFIObjVar (NodeID id)
 
NodeID getGepObjVar (NodeID id, const APOffset &ap)
 
virtual const NodeBSgetAllFieldsObjVars (NodeID id)
 
void setObjFieldInsensitive (NodeID id)
 
bool isFieldInsensitive (NodeID id) const
 

Static Public Member Functions

static bool classof (const Andersen *)
 Methods for support type inquiry through isa, cast, and dyn_cast: More...
 
static bool classof (const PointerAnalysis *pta)
 
- Static Public Member Functions inherited from SVF::AndersenBase
static bool classof (const AndersenBase *)
 Methods for support type inquiry through isa, cast, and dyn_cast: More...
 
static bool classof (const PointerAnalysis *pta)
 
- Static Public Member Functions inherited from SVF::BVDataPTAImpl
static bool classof (const PointerAnalysis *pta)
 

Protected Member Functions

virtual void computeDiffPts (NodeID id)
 Handle diff points-to set. More...
 
virtual const PointsTogetDiffPts (NodeID id)
 
void updatePropaPts (NodeID dstId, NodeID srcId)
 Handle propagated points-to set. More...
 
void clearPropaPts (NodeID src)
 
virtual void initWorklist ()
 
virtual void processNode (NodeID nodeId)
 Override WPASolver function in order to use the default solver. More...
 
void processAllAddr ()
 handling various constraints More...
 
virtual bool processLoad (NodeID node, const ConstraintEdge *load)
 
virtual bool processStore (NodeID node, const ConstraintEdge *load)
 
virtual bool processCopy (NodeID node, const ConstraintEdge *edge)
 
virtual bool processGep (NodeID node, const GepCGEdge *edge)
 
virtual void handleCopyGep (ConstraintNode *node)
 
virtual void handleLoadStore (ConstraintNode *node)
 
virtual void processAddr (const AddrCGEdge *addr)
 
virtual bool processGepPts (const PointsTo &pts, const GepCGEdge *edge)
 
virtual bool addCopyEdge (NodeID src, NodeID dst)
 Add copy edge on constraint graph. More...
 
virtual void mergeNodeToRep (NodeID nodeId, NodeID newRepId)
 Merge sub node to its rep. More...
 
virtual bool mergeSrcToTgt (NodeID srcId, NodeID tgtId)
 
void mergeSccNodes (NodeID repNodeId, const NodeBS &subNodes)
 Merge sub node in a SCC cycle to their rep node. More...
 
void mergeSccCycle ()
 
virtual void collapsePWCNode (NodeID nodeId)
 Collapse a field object into its base for field insensitive analysis. More...
 
void collapseFields ()
 collapse positive weight cycles of a graph More...
 
bool collapseNodePts (NodeID nodeId)
 
bool collapseField (NodeID nodeId)
 
void updateNodeRepAndSubs (NodeID nodeId, NodeID newRepId)
 Updates subnodes of its rep, and rep node of its subs. More...
 
virtual NodeStackSCCDetect ()
 SCC detection. More...
 
void sanitizePts ()
 Sanitize pts for field insensitive objects. More...
 
virtual const std::string PTAName () const
 Get PTA name. More...
 
virtual void cluster (void) const
 
- Protected Member Functions inherited from SVF::AndersenBase
void heapAllocatorViaIndCall (const CallICFGNode *cs, NodePairSet &cpySrcNodes)
 
- Protected Member Functions inherited from SVF::WPASolver< GraphType >
 WPASolver ()
 Constructor. More...
 
virtual ~WPASolver ()=default
 Destructor. More...
 
SCCgetSCCDetector () const
 Get SCC detector. More...
 
const GraphType graph ()
 Get/Set graph methods. More...
 
void setGraph (GraphType g)
 
virtual NodeStackSCCDetect (NodeSet &candidates)
 
virtual void solveWorklist ()
 
virtual void propagate (GNODE *v)
 
virtual bool propFromSrcToDst (GEDGE *)
 Propagate information from source to destination node, to be implemented in the child class. More...
 
NodeID popFromWorklist ()
 Worklist operations. More...
 
virtual void pushIntoWorklist (NodeID id)
 
bool isWorklistEmpty ()
 
bool isInWorklist (NodeID id)
 
GNODENode (NodeID id)
 Get node on the graph. More...
 
NodeID Node_Index (GNODE node)
 Get node ID. More...
 
- Protected Member Functions inherited from SVF::BVDataPTAImpl
PTDataTygetPTDataTy () const
 Get points-to data structure. More...
 
DiffPTDataTygetDiffPTDataTy () const
 
DFPTDataTygetDFPTDataTy () const
 
MutDFPTDataTygetMutDFPTDataTy () const
 
VersionedPTDataTygetVersionedPTDataTy () const
 
virtual void onTheFlyCallGraphSolve (const CallSiteToFunPtrMap &callsites, CallEdgeMap &newEdges)
 On the fly call graph construction. More...
 
virtual void onTheFlyThreadCallGraphSolve (const CallSiteToFunPtrMap &callsites, CallEdgeMap &newForkEdges)
 On the fly thread call graph construction respecting forksite. More...
 
- Protected Member Functions inherited from SVF::PointerAnalysis
const CallSiteToFunPtrMapgetIndirectCallsites () const
 Return all indirect callsites. More...
 
NodeID getFunPtr (const CallICFGNode *cs) const
 Return function pointer PAGNode at a callsite cs. More...
 
virtual void validateTests ()
 Alias check functions to verify correctness of pointer analysis. More...
 
virtual void validateSuccessTests (std::string fun)
 
virtual void validateExpectedFailureTests (std::string fun)
 
void resetObjFieldSensitive ()
 Reset all object node as field-sensitive. More...
 

Protected Attributes

CallSite2DummyValPN callsite2DummyValPN
 Map an instruction to a dummy obj which created at an indirect callsite, which invokes a heap allocator. More...
 
- Protected Attributes inherited from SVF::AndersenBase
ConstraintGraphconsCG
 Constraint Graph. More...
 
CallSite2DummyValPN callsite2DummyValPN
 
- Protected Attributes inherited from SVF::WPASolver< GraphType >
bool reanalyze
 Reanalyze if any constraint value changed. More...
 
u32_t iterationForPrintStat
 print out statistics for i-th iteration More...
 
GraphType _graph
 Graph. More...
 
std::unique_ptr< SCCscc
 SCC. More...
 
WorkList worklist
 Worklist for resolution. More...
 
- Protected Attributes inherited from SVF::PointerAnalysis
bool print_stat
 User input flags. More...
 
bool alias_validation
 Flag for validating points-to/alias results. More...
 
u32_t OnTheFlyIterBudgetForStat
 Flag for iteration budget for on-the-fly statistics. More...
 
SVFModulesvfMod
 Module. More...
 
PTATY ptaTy
 Pointer analysis Type. More...
 
PTAImplTy ptaImplTy
 PTA implementation type. More...
 
PTAStatstat
 Statistics. More...
 
PTACallGraphcallgraph
 Call graph used for pointer analysis. More...
 
CallGraphSCCcallGraphSCC
 SCC for PTACallGraph. More...
 
ICFGicfg
 Interprocedural control-flow graph. More...
 
CommonCHGraphchgraph
 CHGraph. More...
 

Additional Inherited Members

- Public Attributes inherited from SVF::AndersenBase
NodeBS redundantGepNodes
 
- Public Attributes inherited from SVF::WPASolver< GraphType >
u32_t numOfIteration
 num of iterations during constraint solving More...
 
- Static Public Attributes inherited from SVF::AndersenBase
static u32_t numOfProcessedAddr = 0
 Statistics. More...
 
static u32_t numOfProcessedCopy = 0
 Number of processed Addr edge. More...
 
static u32_t numOfProcessedGep = 0
 Number of processed Copy edge. More...
 
static u32_t numOfProcessedLoad = 0
 Number of processed Gep edge. More...
 
static u32_t numOfProcessedStore = 0
 Number of processed Load edge. More...
 
static u32_t numOfSfrs = 0
 Number of processed Store edge. More...
 
static u32_t numOfFieldExpand = 0
 
static u32_t numOfSCCDetection = 0
 
static double timeOfSCCDetection = 0
 
static double timeOfSCCMerges = 0
 
static double timeOfCollapse = 0
 
static u32_t AveragePointsToSetSize = 0
 
static u32_t MaxPointsToSetSize = 0
 
static double timeOfProcessCopyGep = 0
 
static double timeOfProcessLoadStore = 0
 
static double timeOfUpdateCallGraph = 0
 
- Static Public Attributes inherited from SVF::PointerAnalysis
static const std::string aliasTestMayAlias = "MAYALIAS"
 
static const std::string aliasTestMayAliasMangled = "_Z8MAYALIASPvS_"
 
static const std::string aliasTestNoAlias = "NOALIAS"
 
static const std::string aliasTestNoAliasMangled = "_Z7NOALIASPvS_"
 
static const std::string aliasTestPartialAlias = "PARTIALALIAS"
 
static const std::string aliasTestPartialAliasMangled = "_Z12PARTIALALIASPvS_"
 
static const std::string aliasTestMustAlias = "MUSTALIAS"
 
static const std::string aliasTestMustAliasMangled = "_Z9MUSTALIASPvS_"
 
static const std::string aliasTestFailMayAlias = "EXPECTEDFAIL_MAYALIAS"
 
static const std::string aliasTestFailMayAliasMangled = "_Z21EXPECTEDFAIL_MAYALIASPvS_"
 
static const std::string aliasTestFailNoAlias = "EXPECTEDFAIL_NOALIAS"
 
static const std::string aliasTestFailNoAliasMangled = "_Z20EXPECTEDFAIL_NOALIASPvS_"
 
- Static Protected Attributes inherited from SVF::PointerAnalysis
static SVFIRpag = nullptr
 SVFIR. More...
 

Detailed Description

Inclusion-based Pointer Analysis

Definition at line 189 of file Andersen.h.

Member Typedef Documentation

◆ CGSCC

Definition at line 194 of file Andersen.h.

Constructor & Destructor Documentation

◆ Andersen()

SVF::Andersen::Andersen ( SVFIR _pag,
PTATY  type = Andersen_WPA,
bool  alias_check = true 
)
inline

Constructor.

Definition at line 197 of file Andersen.h.

198  : AndersenBase(_pag, type, alias_check)
199  {
200  }
newitem type
Definition: cJSON.cpp:2739
AndersenBase(SVFIR *_pag, PTATY type=Andersen_BASE, bool alias_check=true)
Constructor.
Definition: Andersen.h:65

◆ ~Andersen()

virtual SVF::Andersen::~Andersen ( )
inlinevirtual

Destructor.

Definition at line 203 of file Andersen.h.

204  {
205 
206  }

Member Function Documentation

◆ addCopyEdge()

virtual bool SVF::Andersen::addCopyEdge ( NodeID  src,
NodeID  dst 
)
inlineprotectedvirtual

Add copy edge on constraint graph.

Implements SVF::AndersenBase.

Reimplemented in SVF::AndersenSCD.

Definition at line 323 of file Andersen.h.

324  {
325  if (consCG->addCopyCGEdge(src, dst))
326  {
327  updatePropaPts(src, dst);
328  return true;
329  }
330  return false;
331  }
ConstraintGraph * consCG
Constraint Graph.
Definition: Andersen.h:178
void updatePropaPts(NodeID dstId, NodeID srcId)
Handle propagated points-to set.
Definition: Andersen.h:286
CopyCGEdge * addCopyCGEdge(NodeID src, NodeID dst)
Add Copy edge.
Definition: ConsG.cpp:222

◆ classof() [1/2]

static bool SVF::Andersen::classof ( const Andersen )
inlinestatic

Methods for support type inquiry through isa, cast, and dyn_cast:

Definition at line 225 of file Andersen.h.

226  {
227  return true;
228  }

◆ classof() [2/2]

static bool SVF::Andersen::classof ( const PointerAnalysis pta)
inlinestatic

Definition at line 229 of file Andersen.h.

230  {
231  return (pta->getAnalysisTy() == Andersen_WPA
232  || pta->getAnalysisTy() == AndersenWaveDiff_WPA
233  || pta->getAnalysisTy() == AndersenSCD_WPA
234  || pta->getAnalysisTy() == AndersenSFR_WPA);
235  }
@ AndersenSCD_WPA
Selective cycle detection andersen-style WPA.
@ Andersen_WPA
Andersen PTA.
@ AndersenWaveDiff_WPA
Diff wave propagation andersen-style WPA.
@ AndersenSFR_WPA
Stride-based field representation.

◆ clearPropaPts()

void SVF::Andersen::clearPropaPts ( NodeID  src)
inlineprotected

Definition at line 294 of file Andersen.h.

295  {
296  if (Options::DiffPts())
297  {
298  NodeID rep = sccRepNode(src);
300  }
301  }
NodeID sccRepNode(NodeID id) const override
SCC methods.
Definition: Andersen.h:129
DiffPTDataTy * getDiffPTDataTy() const
virtual void clearPropaPts(Key &var)=0
Clear propagated points-to set of var.
static const Option< bool > DiffPts
Definition: Options.h:215
u32_t NodeID
Definition: GeneralType.h:55

◆ cluster()

void Andersen::cluster ( void  ) const
protectedvirtual

Runs a Steensgaard analysis and performs clustering based on those results set the global best mapping.

Definition at line 917 of file Andersen.cpp.

918 {
919  assert(Options::MaxFieldLimit() == 0 && "Andersen::cluster: clustering for Andersen's is currently only supported in field-insensitive analysis");
921  std::vector<std::pair<unsigned, unsigned>> keys;
922  for (SVFIR::iterator pit = pag->begin(); pit != pag->end(); ++pit)
923  {
924  keys.push_back(std::make_pair(pit->first, 1));
925  }
926 
927  std::vector<std::pair<hclust_fast_methods, std::vector<NodeID>>> candidates;
928  PointsTo::MappingPtr nodeMapping =
929  std::make_shared<std::vector<NodeID>>(NodeIDAllocator::Clusterer::cluster(steens, keys, candidates, "aux-steens"));
930  PointsTo::MappingPtr reverseNodeMapping =
931  std::make_shared<std::vector<NodeID>>(NodeIDAllocator::Clusterer::getReverseNodeMapping(*nodeMapping));
932 
933  PointsTo::setCurrentBestNodeMapping(nodeMapping, reverseNodeMapping);
934 }
iterator begin()
Iterators.
Definition: GenericGraph.h:627
IDToNodeMapTy::iterator iterator
Node Iterators.
Definition: GenericGraph.h:606
static std::vector< NodeID > cluster(BVDataPTAImpl *pta, const std::vector< std::pair< NodeID, unsigned >> keys, std::vector< std::pair< hclust_fast_methods, std::vector< NodeID >>> &candidates, std::string evalSubtitle="")
static std::vector< NodeID > getReverseNodeMapping(const std::vector< NodeID > &nodeMapping)
static const Option< u32_t > MaxFieldLimit
Maximum number of field derivations for an object.
Definition: Options.h:38
static SVFIR * pag
SVFIR.
std::shared_ptr< std::vector< NodeID > > MappingPtr
Definition: PointsTo.h:42
static void setCurrentBestNodeMapping(MappingPtr newCurrentBestNodeMapping, MappingPtr newCurrentBestReverseNodeMapping)
Definition: PointsTo.cpp:371
static Steensgaard * createSteensgaard(SVFIR *_pag)
Create an singleton instance.
Definition: Steensgaard.h:31

◆ collapseField()

bool Andersen::collapseField ( NodeID  nodeId)
protected

Collapse field. make struct with the same base as nodeId become field-insensitive.

Black hole doesn't have structures, no collapse is needed. In later versions, instead of using base node to represent the struct, we'll create new field-insensitive node. To avoid creating a new "black hole" node, do not collapse field for black hole node.

Definition at line 773 of file Andersen.cpp.

774 {
779  if (consCG->isBlkObjOrConstantObj(nodeId))
780  return false;
781 
782  bool changed = false;
783 
784  double start = stat->getClk();
785 
786  // set base node field-insensitive.
787  setObjFieldInsensitive(nodeId);
788 
789  // replace all occurrences of each field with the field-insensitive node
790  NodeID baseId = consCG->getFIObjVar(nodeId);
791  NodeID baseRepNodeId = consCG->sccRepNode(baseId);
792  NodeBS & allFields = consCG->getAllFieldsObjVars(baseId);
793  for (NodeBS::iterator fieldIt = allFields.begin(), fieldEit = allFields.end(); fieldIt != fieldEit; fieldIt++)
794  {
795  NodeID fieldId = *fieldIt;
796  if (fieldId != baseId)
797  {
798  // use the reverse pts of this field node to find all pointers point to it
799  const NodeSet revPts = getRevPts(fieldId);
800  for (const NodeID o : revPts)
801  {
802  // change the points-to target from field to base node
803  clearPts(o, fieldId);
804  addPts(o, baseId);
805  pushIntoWorklist(o);
806 
807  changed = true;
808  }
809  // merge field node into base node, including edges and pts.
810  NodeID fieldRepNodeId = consCG->sccRepNode(fieldId);
811  mergeNodeToRep(fieldRepNodeId, baseRepNodeId);
812  if (fieldId != baseRepNodeId)
813  {
814  // gep node fieldId becomes redundant if it is merged to its base node who is set as field-insensitive
815  // two node IDs should be different otherwise this field is actually the base and should not be removed.
816  redundantGepNodes.set(fieldId);
817  }
818  }
819  }
820 
821  if (consCG->isPWCNode(baseRepNodeId))
822  if (collapseNodePts(baseRepNodeId))
823  changed = true;
824 
825  double end = stat->getClk();
826  timeOfCollapse += (end - start) / TIMEINTERVAL;
827 
828  return changed;
829 }
#define TIMEINTERVAL
Definition: SVFType.h:512
NodeBS redundantGepNodes
Definition: Andersen.h:153
static double timeOfCollapse
Definition: Andersen.h:168
virtual void mergeNodeToRep(NodeID nodeId, NodeID newRepId)
Merge sub node to its rep.
Definition: Andersen.cpp:889
bool collapseNodePts(NodeID nodeId)
Definition: Andersen.cpp:753
virtual void clearPts(NodeID id, NodeID element)
Remove element from the points-to set of id.
const NodeSet & getRevPts(NodeID nodeId) override
virtual bool addPts(NodeID id, NodeID ptd)
NodeID sccRepNode(NodeID id) const
SCC rep/sub nodes methods.
Definition: ConsG.h:235
NodeID getFIObjVar(NodeID id)
Get a field-insensitive node of a memory object.
Definition: ConsG.h:339
bool isPWCNode(NodeID nodeId)
Check/Set PWC (positive weight cycle) flag.
Definition: ConsG.h:350
bool isBlkObjOrConstantObj(NodeID id)
Definition: ConsG.h:312
NodeBS & getAllFieldsObjVars(NodeID id)
Definition: ConsG.h:316
PTAStat * stat
Statistics.
void setObjFieldInsensitive(NodeID id)
static double getClk(bool mark=false)
Definition: SVFStat.cpp:47
iterator end() const
void set(unsigned Idx)
iterator begin() const
virtual void pushIntoWorklist(NodeID id)
Definition: WPASolver.h:156
Set< NodeID > NodeSet
Definition: GeneralType.h:113

◆ collapseFields()

void Andersen::collapseFields ( )
inlineprotectedvirtual

collapse positive weight cycles of a graph

Reimplemented from SVF::WPASolver< GraphType >.

Definition at line 695 of file Andersen.cpp.

696 {
697  while (consCG->hasNodesToBeCollapsed())
698  {
700  // collapseField() may change the points-to set of the nodes which have been processed
701  // before, in this case, we may need to re-do the analysis.
702  if (collapseField(node))
703  reanalyze = true;
704  }
705 }
bool collapseField(NodeID nodeId)
Definition: Andersen.cpp:773
NodeID getNextCollapseNode()
Definition: ConsG.h:370
bool hasNodesToBeCollapsed() const
Add/get nodes to be collapsed.
Definition: ConsG.h:362
bool reanalyze
Reanalyze if any constraint value changed.
Definition: WPASolver.h:171

◆ collapseNodePts()

bool Andersen::collapseNodePts ( NodeID  nodeId)
protected

Collapse node's points-to set. Change all points-to elements into field-insensitive.

Points to set may be changed during collapse, so use a clone instead.

Definition at line 753 of file Andersen.cpp.

754 {
755  bool changed = false;
756  const PointsTo& nodePts = getPts(nodeId);
758  PointsTo ptsClone = nodePts;
759  for (PointsTo::iterator ptsIt = ptsClone.begin(), ptsEit = ptsClone.end(); ptsIt != ptsEit; ptsIt++)
760  {
761  if (isFieldInsensitive(*ptsIt))
762  continue;
763 
764  if (collapseField(*ptsIt))
765  changed = true;
766  }
767  return changed;
768 }
virtual const PointsTo & getPts(NodeID id)
Operation of points-to set.
Definition: Andersen.h:239
bool isFieldInsensitive(NodeID id) const
const_iterator end() const
Definition: PointsTo.h:132
const_iterator begin() const
Definition: PointsTo.h:128

◆ collapsePWCNode()

void Andersen::collapsePWCNode ( NodeID  nodeId)
inlineprotectedvirtual

Collapse a field object into its base for field insensitive analysis.

Detect and collapse PWC nodes produced by processing gep edges, under the constraint of field limit.

Definition at line 686 of file Andersen.cpp.

687 {
688  // If a node is a PWC node, collapse all its points-to target.
689  // collapseNodePts() may change the points-to set of the nodes which have been processed
690  // before, in this case, we may need to re-do the analysis.
691  if (consCG->isPWCNode(nodeId) && collapseNodePts(nodeId))
692  reanalyze = true;
693 }

◆ computeDiffPts()

virtual void SVF::Andersen::computeDiffPts ( NodeID  id)
inlineprotectedvirtual

Handle diff points-to set.

Definition at line 268 of file Andersen.h.

269  {
270  if (Options::DiffPts())
271  {
272  NodeID rep = sccRepNode(id);
274  }
275  }
virtual bool computeDiffPts(Key &var, const DataSet &all)=0

◆ dumpTopLevelPtsTo()

void Andersen::dumpTopLevelPtsTo ( )
virtual

Print pag nodes' pts by an ascending order

Reimplemented from SVF::BVDataPTAImpl.

Definition at line 939 of file Andersen.cpp.

940 {
941  for (OrderedNodeSet::iterator nIter = this->getAllValidPtrs().begin();
942  nIter != this->getAllValidPtrs().end(); ++nIter)
943  {
944  const PAGNode* node = getPAG()->getGNode(*nIter);
945  if (getPAG()->isValidTopLevelPtr(node))
946  {
947  const PointsTo& pts = this->getPts(node->getId());
948  outs() << "\nNodeID " << node->getId() << " ";
949 
950  if (pts.empty())
951  {
952  outs() << "\t\tPointsTo: {empty}\n";
953  }
954  else
955  {
956  outs() << "\t\tPointsTo: { ";
957 
958  multiset<u32_t> line;
959  for (PointsTo::iterator it = pts.begin(), eit = pts.end();
960  it != eit; ++it)
961  {
962  line.insert(*it);
963  }
964  for (multiset<u32_t>::const_iterator it = line.begin(); it != line.end(); ++it)
965  {
967  if (auto gepNode = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(*it)))
968  outs() << gepNode->getBaseNode() << "_" << gepNode->getConstantFieldIdx() << " ";
969  else
970  outs() << *it << " ";
971  else
972  outs() << *it << " ";
973  }
974  outs() << "}\n";
975  }
976  }
977  }
978 
979  outs().flush();
980 }
NodeType * getGNode(NodeID id) const
Get a node.
Definition: GenericGraph.h:653
static const Option< bool > PrintFieldWithBasePrefix
Definition: Options.h:118
SVFIR * getPAG() const
OrderedNodeSet & getAllValidPtrs()
Get all Valid Pointers for resolution.
bool empty() const
Returns true if set is empty.
Definition: PointsTo.cpp:98
NodeID getId() const
Get ID.
Definition: GenericGraph.h:260
std::ostream & outs()
Overwrite llvm::outs()
Definition: SVFUtil.h:50

◆ finalize()

void Andersen::finalize ( )
virtual

Finalize analysis.

Finalize analysis

sanitize field insensitive obj TODO: Fields has been collapsed during Andersen::collapseField().

Reimplemented from SVF::AndersenBase.

Definition at line 432 of file Andersen.cpp.

433 {
434  // TODO: check -stat too.
435  // TODO: broken
436  if (Options::ClusterAnder())
437  {
439  const PTDataTy *ptd = getPTDataTy();
440  // TODO: should we use liveOnly?
441  // TODO: parameterise final arg.
442  NodeIDAllocator::Clusterer::evaluate(*PointsTo::getCurrentBestNodeMapping(), ptd->getAllPts(true), stats, true);
443  NodeIDAllocator::Clusterer::printStats("post-main", stats);
444  }
445 
448  // sanitizePts();
450 }
virtual void finalize() override
Finalize analysis.
Definition: Andersen.cpp:89
PTData< NodeID, NodeSet, NodeID, PointsTo > PTDataTy
PTDataTy * getPTDataTy() const
Get points-to data structure.
static void printStats(std::string title, Map< std::string, std::string > &stats)
static void evaluate(const std::vector< NodeID > &nodeMap, const Map< PointsTo, unsigned > pointsToSets, Map< std::string, std::string > &stats, bool accountForOcc)
Fills in *NumWords statistics in stats..
static const Option< bool > ClusterAnder
Whether to stage Andersen's with Steensgaard and cluster based on that data.
Definition: Options.h:41
static MappingPtr getCurrentBestNodeMapping()
Definition: PointsTo.cpp:361
std::unordered_map< Key, Value, Hash, KeyEqual, Allocator > Map
Definition: GeneralType.h:101

◆ getDiffPts()

virtual const PointsTo& SVF::Andersen::getDiffPts ( NodeID  id)
inlineprotectedvirtual

Definition at line 276 of file Andersen.h.

277  {
278  NodeID rep = sccRepNode(id);
279  if (Options::DiffPts())
280  return getDiffPTDataTy()->getDiffPts(rep);
281  else
282  return getPTDataTy()->getPts(rep);
283  }
virtual const DataSet & getDiffPts(Key &var)=0
Get diff points to.
virtual const DataSet & getPts(const Key &var)=0
Get points-to set of var.

◆ getPts()

virtual const PointsTo& SVF::Andersen::getPts ( NodeID  id)
inlinevirtual

Operation of points-to set.

Reimplemented from SVF::BVDataPTAImpl.

Definition at line 239 of file Andersen.h.

240  {
241  return getPTDataTy()->getPts(sccRepNode(id));
242  }

◆ handleCopyGep()

void Andersen::handleCopyGep ( ConstraintNode node)
protectedvirtual

Process copy and gep edges

Reimplemented in SVF::AndersenSCD.

Definition at line 476 of file Andersen.cpp.

477 {
478  NodeID nodeId = node->getId();
479  computeDiffPts(nodeId);
480 
481  if (!getDiffPts(nodeId).empty())
482  {
483  for (ConstraintEdge* edge : node->getCopyOutEdges())
484  processCopy(nodeId, edge);
485  for (ConstraintEdge* edge : node->getGepOutEdges())
486  {
487  if (GepCGEdge* gepEdge = SVFUtil::dyn_cast<GepCGEdge>(edge))
488  processGep(nodeId, gepEdge);
489  }
490  }
491 }
virtual const PointsTo & getDiffPts(NodeID id)
Definition: Andersen.h:276
virtual void computeDiffPts(NodeID id)
Handle diff points-to set.
Definition: Andersen.h:268
virtual bool processGep(NodeID node, const GepCGEdge *edge)
Definition: Andersen.cpp:613
virtual bool processCopy(NodeID node, const ConstraintEdge *edge)
Definition: Andersen.cpp:593
const ConstraintEdge::ConstraintEdgeSetTy & getGepOutEdges() const
Definition: ConsGNode.h:123
const ConstraintEdge::ConstraintEdgeSetTy & getCopyOutEdges() const
Definition: ConsGNode.h:115

◆ handleLoadStore()

void Andersen::handleLoadStore ( ConstraintNode node)
protectedvirtual

Process load and store edges

Reimplemented in SVF::AndersenSCD.

Definition at line 496 of file Andersen.cpp.

497 {
498  NodeID nodeId = node->getId();
499  for (PointsTo::iterator piter = getPts(nodeId).begin(), epiter =
500  getPts(nodeId).end(); piter != epiter; ++piter)
501  {
502  NodeID ptd = *piter;
503  // handle load
505  eit = node->outgoingLoadsEnd(); it != eit; ++it)
506  {
507  if (processLoad(ptd, *it))
508  pushIntoWorklist(ptd);
509  }
510 
511  // handle store
513  eit = node->incomingStoresEnd(); it != eit; ++it)
514  {
515  if (processStore(ptd, *it))
516  pushIntoWorklist((*it)->getSrcID());
517  }
518  }
519 }
virtual bool processLoad(NodeID node, const ConstraintEdge *load)
Definition: Andersen.cpp:553
virtual bool processStore(NodeID node, const ConstraintEdge *load)
Definition: Andersen.cpp:573
const_iterator outgoingLoadsEnd() const
Definition: ConsGNode.h:194
const_iterator incomingStoresBegin() const
Definition: ConsGNode.h:215
const_iterator incomingStoresEnd() const
Definition: ConsGNode.h:219
ConstraintEdge::ConstraintEdgeSetTy::const_iterator const_iterator
Definition: ConsGNode.h:45
const_iterator outgoingLoadsBegin() const
Definition: ConsGNode.h:190

◆ initialize()

void Andersen::initialize ( )
virtual

Initialize analysis.

 Connect formal and actual parameters for indirect callsites
&zwj;/

void AndersenBase::connectCaller2CalleeParams(const CallICFGNode* cs, const SVFFunction* F, NodePairSet &cpySrcNodes) { assert(F);

DBOUT(DAndersen, outs() << "connect parameters from indirect callsite " << cs->valueOnlyToString() << " to callee " << *F << "\n");

const CallICFGNode* callBlockNode = cs; const RetICFGNode* retBlockNode = cs->getRetICFGNode();

if(SVFUtil::isHeapAllocExtFunViaRet(F) && pag->callsiteHasRet(retBlockNode)) { heapAllocatorViaIndCall(cs,cpySrcNodes); }

if (pag->funHasRet(F) && pag->callsiteHasRet(retBlockNode)) { const PAGNode* cs_return = pag->getCallSiteRet(retBlockNode); const PAGNode* fun_return = pag->getFunRet(F); if (cs_return->isPointer() && fun_return->isPointer()) { NodeID dstrec = sccRepNode(cs_return->getId()); NodeID srcret = sccRepNode(fun_return->getId()); if(addCopyEdge(srcret, dstrec)) { cpySrcNodes.insert(std::make_pair(srcret,dstrec)); } } else { DBOUT(DAndersen, outs() << "not a pointer ignored\n"); } }

if (pag->hasCallSiteArgsMap(callBlockNode) && pag->hasFunArgsList(F)) {

connect actual and formal param const SVFIR::SVFVarList& csArgList = pag->getCallSiteArgsList(callBlockNode); const SVFIR::SVFVarList& funArgList = pag->getFunArgsList(F); Go through the fixed parameters. DBOUT(DPAGBuild, outs() << " args:"); SVFIR::SVFVarList::const_iterator funArgIt = funArgList.begin(), funArgEit = funArgList.end(); SVFIR::SVFVarList::const_iterator csArgIt = csArgList.begin(), csArgEit = csArgList.end(); for (; funArgIt != funArgEit; ++csArgIt, ++funArgIt) { Some programs (e.g. Linux kernel) leave unneeded parameters empty. if (csArgIt == csArgEit) { DBOUT(DAndersen, outs() << " !! not enough args\n"); break; } const PAGNode *cs_arg = *csArgIt ; const PAGNode *fun_arg = *funArgIt;

if (cs_arg->isPointer() && fun_arg->isPointer()) { DBOUT(DAndersen, outs() << "process actual parm " << cs_arg->toString() << " \n"); NodeID srcAA = sccRepNode(cs_arg->getId()); NodeID dstFA = sccRepNode(fun_arg->getId()); if(addCopyEdge(srcAA, dstFA)) { cpySrcNodes.insert(std::make_pair(srcAA,dstFA)); } } }

Any remaining actual args must be varargs. if (F->isVarArg()) { NodeID vaF = sccRepNode(pag->getVarargNode(F)); DBOUT(DPAGBuild, outs() << "\n varargs:"); for (; csArgIt != csArgEit; ++csArgIt) { const PAGNode *cs_arg = *csArgIt; if (cs_arg->isPointer()) { NodeID vnAA = sccRepNode(cs_arg->getId()); if (addCopyEdge(vnAA,vaF)) { cpySrcNodes.insert(std::make_pair(vnAA,vaF)); } } } } if(csArgIt != csArgEit) { writeWrnMsg("too many args to non-vararg func."); writeWrnMsg("(" + cs->getSourceLoc() + ")"); } } }

void AndersenBase::heapAllocatorViaIndCall(const CallICFGNode* cs, NodePairSet &cpySrcNodes) { assert(cs->getCalledFunction() == nullptr && "not an indirect callsite?"); const RetICFGNode* retBlockNode = cs->getRetICFGNode(); const PAGNode* cs_return = pag->getCallSiteRet(retBlockNode); NodeID srcret; CallSite2DummyValPN::const_iterator it = callsite2DummyValPN.find(cs); if(it != callsite2DummyValPN.end()) { srcret = sccRepNode(it->second); } else { NodeID valNode = pag->addDummyValNode(); NodeID objNode = pag->addDummyObjNode(cs->getType()); addPts(valNode,objNode); callsite2DummyValPN.insert(std::make_pair(cs,valNode)); consCG->addConstraintNode(new ConstraintNode(valNode),valNode); consCG->addConstraintNode(new ConstraintNode(objNode),objNode); srcret = valNode; }

NodeID dstrec = sccRepNode(cs_return->getId()); if(addCopyEdge(srcret, dstrec)) cpySrcNodes.insert(std::make_pair(srcret,dstrec)); }

void AndersenBase::normalizePointsTo() { SVFIR::MemObjToFieldsMap &memToFieldsMap = pag->getMemToFieldsMap(); SVFIR::NodeOffsetMap &GepObjVarMap = pag->getGepObjNodeMap();

clear GepObjVarMap/memToFieldsMap/nodeToSubsMap/nodeToRepMap for redundant gepnodes and remove those nodes from pag for (NodeID n: redundantGepNodes) { NodeID base = pag->getBaseObjVar(n); GepObjVar *gepNode = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(n)); assert(gepNode && "Not a gep node in redundantGepNodes set"); const APOffset apOffset = gepNode->getConstantFieldIdx(); GepObjVarMap.erase(std::make_pair(base, apOffset)); memToFieldsMap[base].reset(n); cleanConsCG(n);

pag->removeGNode(gepNode); } }

/*! Initialize analysis

Initialize worklist

Reimplemented from SVF::AndersenBase.

Reimplemented in SVF::AndersenSFR, and SVF::AndersenWaveDiff.

Definition at line 418 of file Andersen.cpp.

419 {
420  resetData();
422 
424 
426  processAllAddr();
427 }
virtual void initialize() override
Initialize analysis.
Definition: Andersen.cpp:73
void resetData()
Reset data.
Definition: Andersen.h:215
void processAllAddr()
handling various constraints
Definition: Andersen.cpp:524
virtual void cluster(void) const
Definition: Andersen.cpp:917

◆ initWorklist()

virtual void SVF::Andersen::initWorklist ( )
inlineprotectedvirtual

Reimplemented from SVF::WPASolver< GraphType >.

Definition at line 303 of file Andersen.h.

303 {}

◆ mergeNodeToRep()

void Andersen::mergeNodeToRep ( NodeID  nodeId,
NodeID  newRepId 
)
protectedvirtual

Merge sub node to its rep.

Definition at line 889 of file Andersen.cpp.

890 {
891 
892  if (mergeSrcToTgt(nodeId,newRepId))
893  consCG->setPWCNode(newRepId);
894 }
virtual bool mergeSrcToTgt(NodeID srcId, NodeID tgtId)
Definition: Andersen.cpp:858
void setPWCNode(NodeID nodeId)
Definition: ConsG.h:354

◆ mergeSccCycle()

void Andersen::mergeSccCycle ( )
protected

Definition at line 710 of file Andersen.cpp.

711 {
712  NodeStack revTopoOrder;
713  NodeStack & topoOrder = getSCCDetector()->topoNodeStack();
714  while (!topoOrder.empty())
715  {
716  NodeID repNodeId = topoOrder.top();
717  topoOrder.pop();
718  revTopoOrder.push(repNodeId);
719  const NodeBS& subNodes = getSCCDetector()->subNodes(repNodeId);
720  // merge sub nodes to rep node
721  mergeSccNodes(repNodeId, subNodes);
722  }
723 
724  // restore the topological order for later solving.
725  while (!revTopoOrder.empty())
726  {
727  NodeID nodeId = revTopoOrder.top();
728  revTopoOrder.pop();
729  topoOrder.push(nodeId);
730  }
731 }
void mergeSccNodes(NodeID repNodeId, const NodeBS &subNodes)
Merge sub node in a SCC cycle to their rep node.
Definition: Andersen.cpp:738
GNodeStack & topoNodeStack()
Definition: SCC.h:128
const NodeBS & subNodes(NodeID n) const
get all subnodes in one scc, if size is empty insert itself into the set
Definition: SCC.h:173
SCC * getSCCDetector() const
Get SCC detector.
Definition: WPASolver.h:67
std::stack< NodeID > NodeStack
Definition: GeneralType.h:118

◆ mergeSccNodes()

void Andersen::mergeSccNodes ( NodeID  repNodeId,
const NodeBS subNodes 
)
protected

Merge sub node in a SCC cycle to their rep node.

Union points-to of subscc nodes into its rep nodes Move incoming/outgoing direct edges of sub node to rep node

Definition at line 738 of file Andersen.cpp.

739 {
740  for (NodeBS::iterator nodeIt = subNodes.begin(); nodeIt != subNodes.end(); nodeIt++)
741  {
742  NodeID subNodeId = *nodeIt;
743  if (subNodeId != repNodeId)
744  {
745  mergeNodeToRep(subNodeId, repNodeId);
746  }
747  }
748 }

◆ mergeSrcToTgt()

bool Andersen::mergeSrcToTgt ( NodeID  nodeId,
NodeID  newRepId 
)
protectedvirtual

merge nodeId to newRepId. Return true if the newRepId is a PWC node

union pts of node to rep

move the edges from node to rep, and remove the node

  1. if find gep edges inside SCC cycle, the rep node will become a PWC node and its pts should be collapsed later.
  2. if the node to be merged is already a PWC node, the rep node will also become a PWC node as it will have a self-cycle gep edge.

set rep and sub relations

Reimplemented in SVF::AndersenSFR.

Definition at line 858 of file Andersen.cpp.

859 {
860 
861  if(nodeId==newRepId)
862  return false;
863 
865  updatePropaPts(newRepId, nodeId);
866  unionPts(newRepId,nodeId);
867 
869  ConstraintNode* node = consCG->getConstraintNode(nodeId);
870  bool pwc = consCG->moveEdgesToRepNode(node, consCG->getConstraintNode(newRepId));
871 
876  if(node->isPWCNode())
877  pwc = true;
878 
880  updateNodeRepAndSubs(node->getId(),newRepId);
881 
883 
884  return pwc;
885 }
virtual bool unionPts(NodeID id, const PointsTo &target)
Definition: Andersen.h:243
void updateNodeRepAndSubs(NodeID nodeId, NodeID newRepId)
Updates subnodes of its rep, and rep node of its subs.
Definition: Andersen.cpp:899
ConstraintNode * getConstraintNode(NodeID id) const
Get/add/remove constraint node.
Definition: ConsG.h:109
void removeConstraintNode(ConstraintNode *node)
Definition: ConsG.h:123
bool moveEdgesToRepNode(ConstraintNode *node, ConstraintNode *rep)
Definition: ConsG.h:286
bool isPWCNode() const
Whether a node involves in PWC, if so, all its points-to elements should become field-insensitive.
Definition: ConsGNode.h:81

◆ processAddr()

void Andersen::processAddr ( const AddrCGEdge addr)
protectedvirtual

Process address edges

Reimplemented in SVF::AndersenSCD.

Definition at line 538 of file Andersen.cpp.

539 {
541 
542  NodeID dst = addr->getDstID();
543  NodeID src = addr->getSrcID();
544  if(addPts(dst,src))
545  pushIntoWorklist(dst);
546 }
static u32_t numOfProcessedAddr
Statistics.
Definition: Andersen.h:157
NodeID getDstID() const
Definition: GenericGraph.h:85
NodeID getSrcID() const
get methods of the components
Definition: GenericGraph.h:81

◆ processAllAddr()

void Andersen::processAllAddr ( )
protected

handling various constraints

Process address edges

Definition at line 524 of file Andersen.cpp.

525 {
526  for (ConstraintGraph::const_iterator nodeIt = consCG->begin(), nodeEit = consCG->end(); nodeIt != nodeEit; nodeIt++)
527  {
528  ConstraintNode * cgNode = nodeIt->second;
529  for (ConstraintNode::const_iterator it = cgNode->incomingAddrsBegin(), eit = cgNode->incomingAddrsEnd();
530  it != eit; ++it)
531  processAddr(SVFUtil::cast<AddrCGEdge>(*it));
532  }
533 }
virtual void processAddr(const AddrCGEdge *addr)
Definition: Andersen.cpp:538
const_iterator incomingAddrsBegin() const
Definition: ConsGNode.h:181
const_iterator incomingAddrsEnd() const
Definition: ConsGNode.h:185

◆ processCopy()

bool Andersen::processCopy ( NodeID  node,
const ConstraintEdge edge 
)
protectedvirtual

Process copy edges src –copy--> dst, union pts(dst) with pts(src)

Definition at line 593 of file Andersen.cpp.

594 {
596 
597  assert((SVFUtil::isa<CopyCGEdge>(edge)) && "not copy/call/ret ??");
598  NodeID dst = edge->getDstID();
599  const PointsTo& srcPts = getDiffPts(node);
600 
601  bool changed = unionPts(dst, srcPts);
602  if (changed)
603  pushIntoWorklist(dst);
604  return changed;
605 }
static u32_t numOfProcessedCopy
Number of processed Addr edge.
Definition: Andersen.h:158

◆ processGep()

bool Andersen::processGep ( NodeID  node,
const GepCGEdge edge 
)
protectedvirtual

Process gep edges src –gep--> dst, for each srcPtdNode \in pts(src) ==> add fieldSrcPtdNode into tmpDstPts union pts(dst) with tmpDstPts

Definition at line 613 of file Andersen.cpp.

614 {
615  const PointsTo& srcPts = getDiffPts(edge->getSrcID());
616  return processGepPts(srcPts, edge);
617 }
virtual bool processGepPts(const PointsTo &pts, const GepCGEdge *edge)
Definition: Andersen.cpp:622

◆ processGepPts()

bool Andersen::processGepPts ( const PointsTo pts,
const GepCGEdge edge 
)
protectedvirtual

Compute points-to for gep edges

Reimplemented in SVF::AndersenSFR.

Definition at line 622 of file Andersen.cpp.

623 {
625 
626  PointsTo tmpDstPts;
627  if (SVFUtil::isa<VariantGepCGEdge>(edge))
628  {
629  // If a pointer is connected by a variant gep edge,
630  // then set this memory object to be field insensitive,
631  // unless the object is a black hole/constant.
632  for (NodeID o : pts)
633  {
635  {
636  tmpDstPts.set(o);
637  continue;
638  }
639 
640  if (!isFieldInsensitive(o))
641  {
644  }
645 
646  // Add the field-insensitive node into pts.
647  NodeID baseId = consCG->getFIObjVar(o);
648  tmpDstPts.set(baseId);
649  }
650  }
651  else if (const NormalGepCGEdge* normalGepEdge = SVFUtil::dyn_cast<NormalGepCGEdge>(edge))
652  {
653  // TODO: after the node is set to field insensitive, handling invariant
654  // gep edge may lose precision because offsets here are ignored, and the
655  // base object is always returned.
656  for (NodeID o : pts)
657  {
659  {
660  tmpDstPts.set(o);
661  continue;
662  }
663 
664  NodeID fieldSrcPtdNode = consCG->getGepObjVar(o, normalGepEdge->getAccessPath().getConstantStructFldIdx());
665  tmpDstPts.set(fieldSrcPtdNode);
666  }
667  }
668  else
669  {
670  assert(false && "Andersen::processGepPts: New type GEP edge type?");
671  }
672 
673  NodeID dstId = edge->getDstID();
674  if (unionPts(dstId, tmpDstPts))
675  {
676  pushIntoWorklist(dstId);
677  return true;
678  }
679 
680  return false;
681 }
static u32_t numOfProcessedGep
Number of processed Copy edge.
Definition: Andersen.h:159
void addNodeToBeCollapsed(NodeID id)
Definition: ConsG.h:366
NodeID getGepObjVar(NodeID id, const APOffset &apOffset)
Get a field of a memory object.
Definition: ConsG.h:330
NodeID getBaseObjVar(NodeID id)
Definition: ConsG.h:320
void set(u32_t n)
Inserts n in the set.
Definition: PointsTo.cpp:157

◆ processLoad()

bool Andersen::processLoad ( NodeID  node,
const ConstraintEdge load 
)
protectedvirtual

Process load edges src –load--> dst, node \in pts(src) ==> node–copy-->dst

TODO: New copy edges are also added for black hole obj node to make gcc in spec 2000 pass the flow-sensitive analysis. Try to handle black hole obj in an appropriate way.

Definition at line 553 of file Andersen.cpp.

554 {
558 // if (pag->isBlkObjOrConstantObj(node))
559  if (pag->isConstantObj(node) || pag->getGNode(load->getDstID())->isPointer() == false)
560  return false;
561 
563 
564  NodeID dst = load->getDstID();
565  return addCopyEdge(node, dst);
566 }
static u32_t numOfProcessedLoad
Number of processed Gep edge.
Definition: Andersen.h:160
virtual bool addCopyEdge(NodeID src, NodeID dst)
Add copy edge on constraint graph.
Definition: Andersen.h:323
bool isConstantObj(NodeID id) const
Definition: SVFIR.h:443
virtual bool isPointer() const
Whether it is a pointer.
Definition: SVFVariables.h:106

◆ processNode()

void Andersen::processNode ( NodeID  nodeId)
protectedvirtual

Override WPASolver function in order to use the default solver.

Start constraint solving

Reimplemented from SVF::WPASolver< GraphType >.

Reimplemented in SVF::AndersenWaveDiff.

Definition at line 455 of file Andersen.cpp.

456 {
457  // sub nodes do not need to be processed
458  if (sccRepNode(nodeId) != nodeId)
459  return;
460 
461  ConstraintNode* node = consCG->getConstraintNode(nodeId);
462  double insertStart = stat->getClk();
463  handleLoadStore(node);
464  double insertEnd = stat->getClk();
465  timeOfProcessLoadStore += (insertEnd - insertStart) / TIMEINTERVAL;
466 
467  double propStart = stat->getClk();
468  handleCopyGep(node);
469  double propEnd = stat->getClk();
470  timeOfProcessCopyGep += (propEnd - propStart) / TIMEINTERVAL;
471 }
static double timeOfProcessLoadStore
Definition: Andersen.h:172
static double timeOfProcessCopyGep
Definition: Andersen.h:171
virtual void handleLoadStore(ConstraintNode *node)
Definition: Andersen.cpp:496
virtual void handleCopyGep(ConstraintNode *node)
Definition: Andersen.cpp:476

◆ processStore()

bool Andersen::processStore ( NodeID  node,
const ConstraintEdge store 
)
protectedvirtual

Process store edges src –store--> dst, node \in pts(dst) ==> src–copy-->node

TODO: New copy edges are also added for black hole obj node to make gcc in spec 2000 pass the flow-sensitive analysis. Try to handle black hole obj in an appropriate way

Definition at line 573 of file Andersen.cpp.

574 {
578 // if (pag->isBlkObjOrConstantObj(node))
579  if (pag->isConstantObj(node) || pag->getGNode(store->getSrcID())->isPointer() == false)
580  return false;
581 
583 
584  NodeID src = store->getSrcID();
585  return addCopyEdge(src, node);
586 }
static u32_t numOfProcessedStore
Number of processed Load edge.
Definition: Andersen.h:161

◆ PTAName()

virtual const std::string SVF::Andersen::PTAName ( ) const
inlineprotectedvirtual

Get PTA name.

Reimplemented from SVF::PointerAnalysis.

Definition at line 382 of file Andersen.h.

383  {
384  return "AndersenWPA";
385  }

◆ resetData()

void SVF::Andersen::resetData ( )
inline

Reset data.

Definition at line 215 of file Andersen.h.

216  {
218  MaxPointsToSetSize = 0;
221  }
static u32_t MaxPointsToSetSize
Definition: Andersen.h:170
static u32_t AveragePointsToSetSize
Definition: Andersen.h:169

◆ sanitizePts()

void SVF::Andersen::sanitizePts ( )
inlineprotected

Sanitize pts for field insensitive objects.

Definition at line 360 of file Andersen.h.

361  {
362  for(ConstraintGraph::iterator it = consCG->begin(), eit = consCG->end(); it!=eit; ++it)
363  {
364  const PointsTo& pts = getPts(it->first);
365  NodeBS fldInsenObjs;
366 
367  for (NodeID o : pts)
368  {
369  if(isFieldInsensitive(o))
370  fldInsenObjs.set(o);
371  }
372 
373  for (NodeID o : fldInsenObjs)
374  {
375  const NodeBS &allFields = consCG->getAllFieldsObjVars(o);
376  for (NodeID f : allFields) addPts(it->first, f);
377  }
378  }
379  }
SparseBitVector NodeBS
Definition: GeneralType.h:62

◆ SCCDetect()

NodeStack & Andersen::SCCDetect ( )
protectedvirtual

SCC detection.

SCC detection on constraint graph

Reimplemented from SVF::WPASolver< GraphType >.

Reimplemented in SVF::AndersenSCD.

Definition at line 834 of file Andersen.cpp.

835 {
837 
838  double sccStart = stat->getClk();
840  double sccEnd = stat->getClk();
841 
842  timeOfSCCDetection += (sccEnd - sccStart)/TIMEINTERVAL;
843 
844  double mergeStart = stat->getClk();
845 
846  mergeSccCycle();
847 
848  double mergeEnd = stat->getClk();
849 
850  timeOfSCCMerges += (mergeEnd - mergeStart)/TIMEINTERVAL;
851 
852  return getSCCDetector()->topoNodeStack();
853 }
static double timeOfSCCMerges
Definition: Andersen.h:167
static u32_t numOfSCCDetection
Definition: Andersen.h:165
static double timeOfSCCDetection
Definition: Andersen.h:166
void mergeSccCycle()
Definition: Andersen.cpp:710
virtual NodeStack & SCCDetect()
SCC detection.
Definition: WPASolver.h:86

◆ setDetectPWC()

void SVF::Andersen::setDetectPWC ( bool  flag)
inline

Definition at line 258 of file Andersen.h.

259  {
261  }
void setValue(T v)
Definition: CommandLine.h:351
static Option< bool > DetectPWC
Definition: Options.h:216

◆ unionPts() [1/2]

virtual bool SVF::Andersen::unionPts ( NodeID  id,
const PointsTo target 
)
inlinevirtual

Union/add points-to. Add the reverse points-to for node collapse purpose To be noted that adding reverse pts might incur 10% total overhead during solving

Reimplemented from SVF::BVDataPTAImpl.

Definition at line 243 of file Andersen.h.

244  {
245  id = sccRepNode(id);
246  return getPTDataTy()->unionPts(id, target);
247  }
virtual bool unionPts(const Key &dstVar, const Key &srcVar)=0
Performs pts(dstVar) = pts(dstVar) U pts(srcVar).

◆ unionPts() [2/2]

virtual bool SVF::Andersen::unionPts ( NodeID  id,
NodeID  ptd 
)
inlinevirtual

Reimplemented from SVF::BVDataPTAImpl.

Definition at line 248 of file Andersen.h.

249  {
250  id = sccRepNode(id);
251  ptd = sccRepNode(ptd);
252  return getPTDataTy()->unionPts(id,ptd);
253  }

◆ updateNodeRepAndSubs()

void Andersen::updateNodeRepAndSubs ( NodeID  nodeId,
NodeID  newRepId 
)
protected

Updates subnodes of its rep, and rep node of its subs.

update nodeToRepMap, for each subs of current node updates its rep to newRepId

Definition at line 899 of file Andersen.cpp.

900 {
901  consCG->setRep(nodeId,newRepId);
902  NodeBS repSubs;
903  repSubs.set(nodeId);
905  // update nodeToSubsMap, union its subs with its rep Subs
906  NodeBS& nodeSubs = consCG->sccSubNodes(nodeId);
907  for(NodeBS::iterator sit = nodeSubs.begin(), esit = nodeSubs.end(); sit!=esit; ++sit)
908  {
909  NodeID subId = *sit;
910  consCG->setRep(subId,newRepId);
911  }
912  repSubs |= nodeSubs;
913  consCG->setSubs(newRepId,repSubs);
914  consCG->resetSubs(nodeId);
915 }
void setSubs(NodeID node, NodeBS &subs)
Definition: ConsG.h:252
void resetSubs(NodeID node)
Definition: ConsG.h:256
void setRep(NodeID node, NodeID rep)
Definition: ConsG.h:248
NodeBS & sccSubNodes(NodeID id)
Definition: ConsG.h:243

◆ updatePropaPts()

void SVF::Andersen::updatePropaPts ( NodeID  dstId,
NodeID  srcId 
)
inlineprotected

Handle propagated points-to set.

Definition at line 286 of file Andersen.h.

287  {
288  if (!Options::DiffPts())
289  return;
290  NodeID srcRep = sccRepNode(srcId);
291  NodeID dstRep = sccRepNode(dstId);
292  getDiffPTDataTy()->updatePropaPtsMap(srcRep, dstRep);
293  }
virtual void updatePropaPtsMap(Key &src, Key &dst)=0

Member Data Documentation

◆ callsite2DummyValPN

CallSite2DummyValPN SVF::Andersen::callsite2DummyValPN
protected

Map an instruction to a dummy obj which created at an indirect callsite, which invokes a heap allocator.

Definition at line 265 of file Andersen.h.


The documentation for this class was generated from the following files: