Static Value-Flow Analysis
|
#include <Andersen.h>
Static Public Member Functions | |
static bool | classof (const Andersen *) |
Methods for support type inquiry through isa, cast, and dyn_cast: | |
static bool | classof (const PointerAnalysis *pta) |
Static Public Member Functions inherited from SVF::AndersenBase | |
static bool | classof (const AndersenBase *) |
Methods for support type inquiry through isa, cast, and dyn_cast: | |
static bool | classof (const PointerAnalysis *pta) |
Static Public Member Functions inherited from SVF::BVDataPTAImpl | |
static bool | classof (const PointerAnalysis *pta) |
Protected Member Functions | |
virtual void | computeDiffPts (NodeID id) |
Handle diff points-to set. | |
virtual const PointsTo & | getDiffPts (NodeID id) |
void | updatePropaPts (NodeID dstId, NodeID srcId) |
Handle propagated points-to set. | |
void | clearPropaPts (NodeID src) |
virtual void | initWorklist () |
virtual void | processNode (NodeID nodeId) |
Override WPASolver function in order to use the default solver. | |
void | processAllAddr () |
handling various constraints | |
virtual bool | processLoad (NodeID node, const ConstraintEdge *load) |
virtual bool | processStore (NodeID node, const ConstraintEdge *load) |
virtual bool | processCopy (NodeID node, const ConstraintEdge *edge) |
virtual bool | processGep (NodeID node, const GepCGEdge *edge) |
virtual void | handleCopyGep (ConstraintNode *node) |
virtual void | handleLoadStore (ConstraintNode *node) |
virtual void | processAddr (const AddrCGEdge *addr) |
virtual bool | processGepPts (const PointsTo &pts, const GepCGEdge *edge) |
virtual bool | addCopyEdge (NodeID src, NodeID dst) |
Add copy edge on constraint graph. | |
virtual void | mergeNodeToRep (NodeID nodeId, NodeID newRepId) |
Merge sub node to its rep. | |
virtual bool | mergeSrcToTgt (NodeID srcId, NodeID tgtId) |
void | mergeSccNodes (NodeID repNodeId, const NodeBS &subNodes) |
Merge sub node in a SCC cycle to their rep node. | |
void | mergeSccCycle () |
virtual void | collapsePWCNode (NodeID nodeId) |
Collapse a field object into its base for field insensitive analysis. | |
void | collapseFields () |
collapse positive weight cycles of a graph | |
bool | collapseNodePts (NodeID nodeId) |
bool | collapseField (NodeID nodeId) |
void | updateNodeRepAndSubs (NodeID nodeId, NodeID newRepId) |
Updates subnodes of its rep, and rep node of its subs. | |
virtual NodeStack & | SCCDetect () |
SCC detection. | |
void | sanitizePts () |
Sanitize pts for field insensitive objects. | |
virtual const std::string | PTAName () const |
Get PTA name. | |
virtual void | cluster (void) const |
Protected Member Functions inherited from SVF::AndersenBase | |
void | heapAllocatorViaIndCall (const CallICFGNode *cs, NodePairSet &cpySrcNodes) |
Protected Member Functions inherited from SVF::WPASolver< GraphType > | |
WPASolver () | |
Constructor. | |
virtual | ~WPASolver ()=default |
Destructor. | |
SCC * | getSCCDetector () const |
Get SCC detector. | |
const GraphType | graph () |
Get/Set graph methods. | |
void | setGraph (GraphType g) |
virtual NodeStack & | SCCDetect (NodeSet &candidates) |
virtual void | solveWorklist () |
virtual void | propagate (GNODE *v) |
virtual bool | propFromSrcToDst (GEDGE *) |
Propagate information from source to destination node, to be implemented in the child class. | |
NodeID | popFromWorklist () |
Worklist operations. | |
virtual void | pushIntoWorklist (NodeID id) |
bool | isWorklistEmpty () |
bool | isInWorklist (NodeID id) |
GNODE * | Node (NodeID id) |
Get node on the graph. | |
NodeID | Node_Index (GNODE node) |
Get node ID. | |
Protected Member Functions inherited from SVF::BVDataPTAImpl | |
PTDataTy * | getPTDataTy () const |
Get points-to data structure. | |
void | finalize () override |
Finalization of pointer analysis, and normalize points-to information to Bit Vector representation. | |
DiffPTDataTy * | getDiffPTDataTy () const |
DFPTDataTy * | getDFPTDataTy () const |
MutDFPTDataTy * | getMutDFPTDataTy () const |
VersionedPTDataTy * | getVersionedPTDataTy () const |
virtual void | onTheFlyCallGraphSolve (const CallSiteToFunPtrMap &callsites, CallEdgeMap &newEdges) |
On the fly call graph construction. | |
virtual void | onTheFlyThreadCallGraphSolve (const CallSiteToFunPtrMap &callsites, CallEdgeMap &newForkEdges) |
On the fly thread call graph construction respecting forksite. | |
Protected Member Functions inherited from SVF::PointerAnalysis | |
const CallSiteToFunPtrMap & | getIndirectCallsites () const |
Return all indirect callsites. | |
NodeID | getFunPtr (const CallICFGNode *cs) const |
Return function pointer PAGNode at a callsite cs. | |
virtual void | validateTests () |
Alias check functions to verify correctness of pointer analysis. | |
virtual void | validateSuccessTests (std::string fun) |
virtual void | validateExpectedFailureTests (std::string fun) |
void | resetObjFieldSensitive () |
Reset all object node as field-sensitive. | |
Protected Attributes | |
CallSite2DummyValPN | callsite2DummyValPN |
Map an instruction to a dummy obj which created at an indirect callsite, which invokes a heap allocator. | |
Protected Attributes inherited from SVF::AndersenBase | |
ConstraintGraph * | consCG |
Constraint Graph. | |
CallSite2DummyValPN | callsite2DummyValPN |
Protected Attributes inherited from SVF::WPASolver< GraphType > | |
bool | reanalyze |
Reanalyze if any constraint value changed. | |
u32_t | iterationForPrintStat |
print out statistics for i-th iteration | |
GraphType | _graph |
Graph. | |
std::unique_ptr< SCC > | scc |
SCC. | |
WorkList | worklist |
Worklist for resolution. | |
Protected Attributes inherited from SVF::PointerAnalysis | |
bool | print_stat |
User input flags. | |
bool | alias_validation |
Flag for validating points-to/alias results. | |
u32_t | OnTheFlyIterBudgetForStat |
Flag for iteration budget for on-the-fly statistics. | |
SVFModule * | svfMod |
Module. | |
PTATY | ptaTy |
Pointer analysis Type. | |
PTAImplTy | ptaImplTy |
PTA implementation type. | |
PTAStat * | stat |
Statistics. | |
PTACallGraph * | callgraph |
Call graph used for pointer analysis. | |
CallGraphSCC * | callGraphSCC |
SCC for PTACallGraph. | |
ICFG * | icfg |
Interprocedural control-flow graph. | |
CommonCHGraph * | chgraph |
CHGraph. | |
Inclusion-based Pointer Analysis
Definition at line 189 of file Andersen.h.
Definition at line 194 of file Andersen.h.
|
inline |
Constructor.
Definition at line 197 of file Andersen.h.
|
inlinevirtual |
Add copy edge on constraint graph.
Implements SVF::AndersenBase.
Reimplemented in SVF::AndersenSCD.
Definition at line 323 of file Andersen.h.
Methods for support type inquiry through isa, cast, and dyn_cast:
Definition at line 225 of file Andersen.h.
|
inlinestatic |
Definition at line 229 of file Andersen.h.
|
inlineprotected |
Definition at line 294 of file Andersen.h.
|
protectedvirtual |
Runs a Steensgaard analysis and performs clustering based on those results set the global best mapping.
Definition at line 917 of file Andersen.cpp.
Collapse field. make struct with the same base as nodeId become field-insensitive.
Black hole doesn't have structures, no collapse is needed. In later versions, instead of using base node to represent the struct, we'll create new field-insensitive node. To avoid creating a new "black hole" node, do not collapse field for black hole node.
Definition at line 773 of file Andersen.cpp.
|
inlineprotectedvirtual |
collapse positive weight cycles of a graph
Reimplemented from SVF::WPASolver< GraphType >.
Definition at line 695 of file Andersen.cpp.
Collapse node's points-to set. Change all points-to elements into field-insensitive.
Points to set may be changed during collapse, so use a clone instead.
Definition at line 753 of file Andersen.cpp.
|
inlineprotectedvirtual |
Collapse a field object into its base for field insensitive analysis.
Detect and collapse PWC nodes produced by processing gep edges, under the constraint of field limit.
Definition at line 686 of file Andersen.cpp.
|
virtual |
Print pag nodes' pts by an ascending order
Reimplemented from SVF::PointerAnalysis.
Definition at line 939 of file Andersen.cpp.
|
virtual |
Finalize analysis.
Finalize analysis
sanitize field insensitive obj TODO: Fields has been collapsed during Andersen::collapseField().
Reimplemented from SVF::AndersenBase.
Definition at line 432 of file Andersen.cpp.
Definition at line 276 of file Andersen.h.
Operation of points-to set.
Implements SVF::PointerAnalysis.
Definition at line 239 of file Andersen.h.
|
protectedvirtual |
Process copy and gep edges
Reimplemented in SVF::AndersenSCD.
Definition at line 476 of file Andersen.cpp.
|
protectedvirtual |
Process load and store edges
Reimplemented in SVF::AndersenSCD.
Definition at line 496 of file Andersen.cpp.
|
virtual |
Initialize analysis.
Connect formal and actual parameters for indirect callsites ‍/
void AndersenBase::connectCaller2CalleeParams(const CallICFGNode* cs, const SVFFunction* F, NodePairSet &cpySrcNodes) { assert(F);
DBOUT(DAndersen, outs() << "connect parameters from indirect callsite " << cs->valueOnlyToString() << " to callee " << *F << "\n");
const CallICFGNode* callBlockNode = cs; const RetICFGNode* retBlockNode = cs->getRetICFGNode();
if(SVFUtil::isHeapAllocExtFunViaRet(F) && pag->callsiteHasRet(retBlockNode)) { heapAllocatorViaIndCall(cs,cpySrcNodes); }
if (pag->funHasRet(F) && pag->callsiteHasRet(retBlockNode)) { const PAGNode* cs_return = pag->getCallSiteRet(retBlockNode); const PAGNode* fun_return = pag->getFunRet(F); if (cs_return->isPointer() && fun_return->isPointer()) { NodeID dstrec = sccRepNode(cs_return->getId()); NodeID srcret = sccRepNode(fun_return->getId()); if(addCopyEdge(srcret, dstrec)) { cpySrcNodes.insert(std::make_pair(srcret,dstrec)); } } else { DBOUT(DAndersen, outs() << "not a pointer ignored\n"); } }
if (pag->hasCallSiteArgsMap(callBlockNode) && pag->hasFunArgsList(F)) {
connect actual and formal param const SVFIR::SVFVarList& csArgList = pag->getCallSiteArgsList(callBlockNode); const SVFIR::SVFVarList& funArgList = pag->getFunArgsList(F); Go through the fixed parameters. DBOUT(DPAGBuild, outs() << " args:"); SVFIR::SVFVarList::const_iterator funArgIt = funArgList.begin(), funArgEit = funArgList.end(); SVFIR::SVFVarList::const_iterator csArgIt = csArgList.begin(), csArgEit = csArgList.end(); for (; funArgIt != funArgEit; ++csArgIt, ++funArgIt) { Some programs (e.g. Linux kernel) leave unneeded parameters empty. if (csArgIt == csArgEit) { DBOUT(DAndersen, outs() << " !! not enough args\n"); break; } const PAGNode *cs_arg = *csArgIt ; const PAGNode *fun_arg = *funArgIt;
if (cs_arg->isPointer() && fun_arg->isPointer()) { DBOUT(DAndersen, outs() << "process actual parm " << cs_arg->toString() << " \n"); NodeID srcAA = sccRepNode(cs_arg->getId()); NodeID dstFA = sccRepNode(fun_arg->getId()); if(addCopyEdge(srcAA, dstFA)) { cpySrcNodes.insert(std::make_pair(srcAA,dstFA)); } } }
Any remaining actual args must be varargs. if (F->isVarArg()) { NodeID vaF = sccRepNode(pag->getVarargNode(F)); DBOUT(DPAGBuild, outs() << "\n varargs:"); for (; csArgIt != csArgEit; ++csArgIt) { const PAGNode *cs_arg = *csArgIt; if (cs_arg->isPointer()) { NodeID vnAA = sccRepNode(cs_arg->getId()); if (addCopyEdge(vnAA,vaF)) { cpySrcNodes.insert(std::make_pair(vnAA,vaF)); } } } } if(csArgIt != csArgEit) { writeWrnMsg("too many args to non-vararg func."); writeWrnMsg("(" + cs->getSourceLoc() + ")"); } } }
void AndersenBase::heapAllocatorViaIndCall(const CallICFGNode* cs, NodePairSet &cpySrcNodes) { assert(cs->getCalledFunction() == nullptr && "not an indirect callsite?"); const RetICFGNode* retBlockNode = cs->getRetICFGNode(); const PAGNode* cs_return = pag->getCallSiteRet(retBlockNode); NodeID srcret; CallSite2DummyValPN::const_iterator it = callsite2DummyValPN.find(cs); if(it != callsite2DummyValPN.end()) { srcret = sccRepNode(it->second); } else { NodeID valNode = pag->addDummyValNode(); NodeID objNode = pag->addDummyObjNode(cs->getType()); addPts(valNode,objNode); callsite2DummyValPN.insert(std::make_pair(cs,valNode)); consCG->addConstraintNode(new ConstraintNode(valNode),valNode); consCG->addConstraintNode(new ConstraintNode(objNode),objNode); srcret = valNode; }
NodeID dstrec = sccRepNode(cs_return->getId()); if(addCopyEdge(srcret, dstrec)) cpySrcNodes.insert(std::make_pair(srcret,dstrec)); }
void AndersenBase::normalizePointsTo() { SVFIR::MemObjToFieldsMap &memToFieldsMap = pag->getMemToFieldsMap(); SVFIR::NodeOffsetMap &GepObjVarMap = pag->getGepObjNodeMap();
clear GepObjVarMap/memToFieldsMap/nodeToSubsMap/nodeToRepMap for redundant gepnodes and remove those nodes from pag for (NodeID n: redundantGepNodes) { NodeID base = pag->getBaseObjVar(n); GepObjVar *gepNode = SVFUtil::dyn_cast<GepObjVar>(pag->getGNode(n)); assert(gepNode && "Not a gep node in redundantGepNodes set"); const APOffset apOffset = gepNode->getConstantFieldIdx(); GepObjVarMap.erase(std::make_pair(base, apOffset)); memToFieldsMap[base].reset(n); cleanConsCG(n);
pag->removeGNode(gepNode); } }
/*! Initialize analysis
Initialize worklist
Reimplemented from SVF::AndersenBase.
Reimplemented in SVF::AndersenWaveDiff, and SVF::AndersenSFR.
Definition at line 418 of file Andersen.cpp.
|
inlineprotectedvirtual |
Merge sub node to its rep.
Definition at line 889 of file Andersen.cpp.
|
protected |
Definition at line 710 of file Andersen.cpp.
Merge sub node in a SCC cycle to their rep node.
Union points-to of subscc nodes into its rep nodes Move incoming/outgoing direct edges of sub node to rep node
Definition at line 738 of file Andersen.cpp.
merge nodeId to newRepId. Return true if the newRepId is a PWC node
union pts of node to rep
move the edges from node to rep, and remove the node
set rep and sub relations
Reimplemented in SVF::AndersenSFR.
Definition at line 858 of file Andersen.cpp.
|
protectedvirtual |
Process address edges
Reimplemented in SVF::AndersenSCD.
Definition at line 538 of file Andersen.cpp.
|
protected |
handling various constraints
Process address edges
Definition at line 524 of file Andersen.cpp.
|
protectedvirtual |
Process copy edges src –copy--> dst, union pts(dst) with pts(src)
Definition at line 593 of file Andersen.cpp.
Process gep edges src –gep--> dst, for each srcPtdNode \in pts(src) ==> add fieldSrcPtdNode into tmpDstPts union pts(dst) with tmpDstPts
Definition at line 613 of file Andersen.cpp.
Compute points-to for gep edges
Reimplemented in SVF::AndersenSFR.
Definition at line 622 of file Andersen.cpp.
|
protectedvirtual |
Process load edges src –load--> dst, node \in pts(src) ==> node–copy-->dst
TODO: New copy edges are also added for black hole obj node to make gcc in spec 2000 pass the flow-sensitive analysis. Try to handle black hole obj in an appropriate way.
Definition at line 553 of file Andersen.cpp.
|
protectedvirtual |
Override WPASolver function in order to use the default solver.
Start constraint solving
Reimplemented from SVF::WPASolver< GraphType >.
Reimplemented in SVF::AndersenWaveDiff.
Definition at line 455 of file Andersen.cpp.
|
protectedvirtual |
Process store edges src –store--> dst, node \in pts(dst) ==> src–copy-->node
TODO: New copy edges are also added for black hole obj node to make gcc in spec 2000 pass the flow-sensitive analysis. Try to handle black hole obj in an appropriate way
Definition at line 573 of file Andersen.cpp.
Get PTA name.
Reimplemented from SVF::PointerAnalysis.
Definition at line 382 of file Andersen.h.
|
inline |
Reset data.
Definition at line 215 of file Andersen.h.
|
inlineprotected |
Sanitize pts for field insensitive objects.
Definition at line 360 of file Andersen.h.
|
protectedvirtual |
SCC detection.
SCC detection on constraint graph
Reimplemented from SVF::WPASolver< GraphType >.
Reimplemented in SVF::AndersenSCD.
Definition at line 834 of file Andersen.cpp.
|
inline |
Definition at line 258 of file Andersen.h.
Union/add points-to. Add the reverse points-to for node collapse purpose To be noted that adding reverse pts might incur 10% total overhead during solving
Reimplemented from SVF::BVDataPTAImpl.
Definition at line 243 of file Andersen.h.
Updates subnodes of its rep, and rep node of its subs.
update nodeToRepMap, for each subs of current node updates its rep to newRepId
Definition at line 899 of file Andersen.cpp.
|
protected |
Map an instruction to a dummy obj which created at an indirect callsite, which invokes a heap allocator.
Definition at line 265 of file Andersen.h.