Static Value-Flow Analysis
|
#include <DDAVFSolver.h>
Public Types | |
typedef SCCDetection< SVFG * > | SVFGSCC |
typedef SCCDetection< PTACallGraph * > | CallGraphSCC |
typedef PTACallGraphEdge::CallInstSet | CallInstSet |
typedef SVFIR::CallSiteSet | CallSiteSet |
typedef OrderedSet< DPIm > | DPTItemSet |
typedef OrderedMap< DPIm, CPtSet > | DPImToCPtSetMap |
typedef OrderedMap< DPIm, CVar > | DPMToCVarMap |
typedef OrderedMap< DPIm, DPIm > | DPMToDPMMap |
typedef OrderedMap< NodeID, DPTItemSet > | LocToDPMVecMap |
typedef OrderedSet< const SVFGEdge * > | ConstSVFGEdgeSet |
typedef SVFGEdge::SVFGEdgeSetTy | SVFGEdgeSet |
typedef OrderedMap< const SVFGNode *, DPTItemSet > | StoreToPMSetMap |
Public Member Functions | |
DDAVFSolver () | |
Constructor. | |
virtual | ~DDAVFSolver () |
Destructor. | |
NodeBS & | getCandidateQueries () |
Return candidate pointers for DDA. | |
virtual DPIm | getDPIm (const CVar &var, const SVFGNode *loc) const |
Given CVar and location (SVFGNode) return a new DPItem. | |
virtual bool | unionDDAPts (CPtSet &pts, const CPtSet &targetPts) |
Union pts. | |
virtual bool | unionDDAPts (DPIm dpm, const CPtSet &targetPts) |
Union pts. | |
virtual void | addDDAPts (CPtSet &pts, const CVar &var) |
Add pts. | |
SVFG * | getSVFG () const |
Return SVFG. | |
SVFGSCC * | getSVFGSCC () const |
Return SVFGSCC. | |
void | dumpCPtSet (const CPtSet &cpts) const |
virtual const CPtSet & | findPT (const DPIm &dpm) |
Compute points-to. | |
Protected Member Functions | |
virtual void | handleSingleStatement (const DPIm &dpm, CPtSet &pts) |
Handle single statement. | |
void | reCompute (const DPIm &dpm) |
recompute points-to for value-flow cycles and indirect calls | |
void | reComputeForEdges (const DPIm &dpm, const SVFGEdgeSet &edgeSet, bool indirectCall=false) |
Traverse along out edges to find all nodes which may be affected by locDPM. | |
virtual void | buildSVFG (SVFIR *pag) |
Build SVFG. | |
virtual void | resetQuery () |
Reset visited map for next points-to query. | |
void | OOBResetVisited () |
Reset visited map if the current query is out-of-budget. | |
const SVFGNode * | getDefSVFGNode (const PAGNode *pagNode) const |
GetDefinition SVFG. | |
void | backtraceAlongIndirectVF (CPtSet &pts, const DPIm &oldDpm) |
Backward traverse along indirect value flows. | |
void | backtraceAlongDirectVF (CPtSet &pts, const DPIm &oldDpm) |
Backward traverse along direct value flows. | |
Friends | |
class | DDAStat |
bool | outOfBudgetQuery |
Whether the current query is out of step limits. | |
SVFIR * | _pag |
SVFIR. | |
SVFG * | _svfg |
SVFG. | |
AndersenWaveDiff * | _ander |
Andersen's analysis. | |
NodeBS | candidateQueries |
candidate pointers; | |
PTACallGraph * | _callGraph |
PTACallGraph. | |
CallGraphSCC * | _callGraphSCC |
SCC for PTACallGraph. | |
SVFGSCC * | _svfgSCC |
SCC for SVFG. | |
DPTItemSet | backwardVisited |
visited map during backward traversing | |
DPImToCPtSetMap | dpmToTLCPtSetMap |
points-to caching map for top-level vars | |
DPImToCPtSetMap | dpmToADCPtSetMap |
points-to caching map for address-taken vars | |
LocToDPMVecMap | locToDpmSetMap |
map location to its dpms | |
DPMToDPMMap | dpmToloadDpmMap |
dpms at loads for may/must-alias analysis with stores | |
DPMToCVarMap | loadToPTCVarMap |
map a load dpm to its cvar pointed by its pointer operand | |
DPTItemSet | outOfBudgetDpms |
out of budget dpm set | |
StoreToPMSetMap | storeToDPMs |
map store to set of DPM which have been stong updated there | |
DDAStat * | ddaStat |
DDA stat. | |
SVFGBuilder | svfgBuilder |
SVFG Builder. | |
void | startNewPTCompFromLoadSrc (CPtSet &pts, const DPIm &oldDpm) |
void | startNewPTCompFromStoreDst (CPtSet &pts, const DPIm &oldDpm) |
void | backtraceToStoreSrc (CPtSet &pts, const DPIm &oldDpm) |
virtual void | backwardPropDpm (CPtSet &pts, NodeID ptr, const DPIm &oldDpm, const SVFGEdge *edge) |
dpm transit during backward tracing | |
virtual bool | isMustAlias (const DPIm &, const DPIm &) |
whether load and store are aliased | |
virtual bool | isStrongUpdate (const CPtSet &dstCPSet, const StoreSVFGNode *store) |
Return TRUE if this is a strong update STORE statement. | |
virtual bool | isLocalCVarInRecursion (const CVar &var) const |
Whether a local variable is in function recursions. | |
virtual bool | propagateViaObj (const CVar &storeObj, const CVar &loadObj) |
If the points-to contain the object obj, we could move forward along indirect value-flow edge. | |
void | resolveFunPtr (const DPIm &dpm) |
resolve function pointer | |
virtual NodeID | getPtrNodeID (const CVar &var) const =0 |
Methods to be implemented in child class. | |
virtual CPtSet | processGepPts (const GepSVFGNode *gep, const CPtSet &srcPts)=0 |
ProcessGep node to generate field object nodes of a struct. | |
virtual void | handleAddr (CPtSet &pts, const DPIm &dpm, const AddrSVFGNode *addr)=0 |
Handle AddrSVFGNode to add proper points-to. | |
virtual CPtSet | getConservativeCPts (const DPIm &dpm)=0 |
Get conservative points-to results when the query is out of budget. | |
virtual bool | handleBKCondition (DPIm &, const SVFGEdge *) |
Handle condition for context or path analysis (backward analysis) | |
virtual void | updateCallGraphAndSVFG (const DPIm &, const CallICFGNode *, SVFGEdgeSet &) |
Update call graph. | |
void | markbkVisited (const DPIm &dpm) |
Visited flags to avoid cycles. | |
bool | isbkVisited (const DPIm &dpm) |
void | clearbkVisited (const DPIm &dpm) |
virtual const CPtSet & | getCachedPointsTo (const DPIm &dpm) |
Points-to Caching for top-level pointers and address-taken objects. | |
virtual void | updateCachedPointsTo (const DPIm &dpm, const CPtSet &pts) |
virtual const CPtSet & | getCachedTLPointsTo (const DPIm &dpm) |
virtual const CPtSet & | getCachedADPointsTo (const DPIm &dpm) |
bool | isTopLevelPtrStmt (const SVFGNode *stmt) |
Whether this is a top-level pointer statement. | |
virtual DPIm | getDPImWithOldCond (const DPIm &oldDpm, const CVar &var, const SVFGNode *loc) |
Return dpm with old context and path conditions. | |
void | SVFGSCCDetection () |
SVFG SCC detection. | |
NodeID | getSVFGSCCRepNode (NodeID id) |
Get SCC rep node of a SVFG node. | |
bool | isSVFGNodeInCycle (const SVFGNode *node) |
Return whether this SVFGNode is in cycle. | |
bool | edgeInSVFGSCC (const SVFGEdge *edge) |
Return TRUE if this edge is inside a SVFG SCC, i.e., src node and dst node are in the same SCC on the SVFG. | |
void | setCallGraph (PTACallGraph *cg) |
Set callgraph. | |
void | setCallGraphSCC (CallGraphSCC *scc) |
Set callgraphSCC. | |
virtual bool | isHeapCondMemObj (const CVar &var, const StoreSVFGNode *) |
Check heap and array object. | |
bool | isArrayCondMemObj (const CVar &var) const |
bool | isFieldInsenCondMemObj (const CVar &var) const |
void | addLoadDpmAndCVar (const DPIm &dpm, const DPIm &loadDpm, const CVar &loadVar) |
LoadDpm for must-alias analysis. | |
void | addLoadDpm (const DPIm &dpm, const DPIm &loadDpm) |
Note that simply use "dpmToloadDpmMap[dpm]=loadDpm", requires DPIm have a default constructor. | |
const DPIm & | getLoadDpm (const DPIm &dpm) const |
void | addLoadCVar (const DPIm &dpm, const CVar &loadVar) |
const CVar & | getLoadCVar (const DPIm &dpm) const |
AndersenWaveDiff * | getAndersenAnalysis () const |
Return Andersen's analysis. | |
void | handleOutOfBudgetDpm (const DPIm &dpm) |
handle out-of-budget queries | |
bool | testOutOfBudget (const DPIm &dpm) |
bool | isOutOfBudgetQuery () const |
void | addOutOfBudgetDpm (const DPIm &dpm) |
bool | isOutOfBudgetDpm (const DPIm &dpm) const |
DDAStat * | setDDAStat (DDAStat *s) |
Set DDAStat. | |
void | addSUStat (const DPIm &dpm, const SVFGNode *node) |
stat strong updates num | |
void | rmSUStat (const DPIm &dpm, const SVFGNode *node) |
remove strong updates num if the dpm goes to weak updates branch | |
const LocToDPMVecMap & | getLocToDPMVecMap () const |
Map a SVFGNode to its dpms for handling value-flow cycles. | |
const DPTItemSet & | getDpmSetAtLoc (const SVFGNode *loc) |
void | addDpmToLoc (const DPIm &dpm) |
void | removeDpmFromLoc (const DPIm &dpm) |
Value-Flow Based Demand-Driven Points-to Analysis
Definition at line 47 of file DDAVFSolver.h.
typedef SCCDetection<PTACallGraph*> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::CallGraphSCC |
Definition at line 52 of file DDAVFSolver.h.
typedef PTACallGraphEdge::CallInstSet SVF::DDAVFSolver< CVar, CPtSet, DPIm >::CallInstSet |
Definition at line 53 of file DDAVFSolver.h.
typedef SVFIR::CallSiteSet SVF::DDAVFSolver< CVar, CPtSet, DPIm >::CallSiteSet |
Definition at line 54 of file DDAVFSolver.h.
typedef OrderedSet<const SVFGEdge* > SVF::DDAVFSolver< CVar, CPtSet, DPIm >::ConstSVFGEdgeSet |
Definition at line 60 of file DDAVFSolver.h.
typedef OrderedMap<DPIm, CPtSet> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::DPImToCPtSetMap |
Definition at line 56 of file DDAVFSolver.h.
typedef OrderedMap<DPIm,CVar> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::DPMToCVarMap |
Definition at line 57 of file DDAVFSolver.h.
typedef OrderedMap<DPIm,DPIm> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::DPMToDPMMap |
Definition at line 58 of file DDAVFSolver.h.
typedef OrderedSet<DPIm> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::DPTItemSet |
Definition at line 55 of file DDAVFSolver.h.
typedef OrderedMap<NodeID, DPTItemSet> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::LocToDPMVecMap |
Definition at line 59 of file DDAVFSolver.h.
typedef OrderedMap<const SVFGNode*, DPTItemSet> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::StoreToPMSetMap |
Definition at line 62 of file DDAVFSolver.h.
typedef SVFGEdge::SVFGEdgeSetTy SVF::DDAVFSolver< CVar, CPtSet, DPIm >::SVFGEdgeSet |
Definition at line 61 of file DDAVFSolver.h.
typedef SCCDetection<SVFG*> SVF::DDAVFSolver< CVar, CPtSet, DPIm >::SVFGSCC |
Definition at line 51 of file DDAVFSolver.h.
|
inline |
Constructor.
Definition at line 65 of file DDAVFSolver.h.
|
inlinevirtual |
Destructor.
Definition at line 69 of file DDAVFSolver.h.
|
inlinevirtual |
Add pts.
Definition at line 113 of file DDAVFSolver.h.
|
inlineprivate |
Definition at line 669 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 702 of file DDAVFSolver.h.
|
inlineprotected |
Note that simply use "dpmToloadDpmMap[dpm]=loadDpm", requires DPIm have a default constructor.
Definition at line 688 of file DDAVFSolver.h.
|
inlineprotected |
LoadDpm for must-alias analysis.
Definition at line 682 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 737 of file DDAVFSolver.h.
|
inlineprotected |
stat strong updates num
Definition at line 754 of file DDAVFSolver.h.
|
inlineprotected |
Backward traverse along direct value flows.
Definition at line 374 of file DDAVFSolver.h.
|
inlineprotected |
Backward traverse along indirect value flows.
Definition at line 352 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 413 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
dpm transit during backward tracing
handle context-/path- sensitivity
record the source of load dpm
handle out of budget case
Definition at line 426 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Build SVFG.
Definition at line 317 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 549 of file DDAVFSolver.h.
|
inline |
Definition at line 128 of file DDAVFSolver.h.
|
inlineprotected |
Return TRUE if this edge is inside a SVFG SCC, i.e., src node and dst node are in the same SCC on the SVFG.
Definition at line 624 of file DDAVFSolver.h.
|
inlinevirtual |
Compute points-to.
Add successors of current stmt if its pts has been changed.
Definition at line 138 of file DDAVFSolver.h.
|
inlineprotected |
Return Andersen's analysis.
Definition at line 718 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Definition at line 578 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Points-to Caching for top-level pointers and address-taken objects.
Definition at line 558 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Reimplemented in SVF::FlowDDA.
Definition at line 574 of file DDAVFSolver.h.
|
inline |
Return candidate pointers for DDA.
Definition at line 91 of file DDAVFSolver.h.
|
protectedpure virtual |
Get conservative points-to results when the query is out of budget.
Implemented in SVF::ContextDDA, and SVF::FlowDDA.
|
inlineprotected |
GetDefinition SVFG.
Definition at line 347 of file DDAVFSolver.h.
|
inlinevirtual |
|
inlineprotectedvirtual |
Return dpm with old context and path conditions.
Definition at line 590 of file DDAVFSolver.h.
|
inlineprivate |
Definition at line 665 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 710 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 696 of file DDAVFSolver.h.
|
inlineprivate |
Map a SVFGNode to its dpms for handling value-flow cycles.
Definition at line 661 of file DDAVFSolver.h.
|
protectedpure virtual |
Methods to be implemented in child class.
Get variable ID (PAGNodeID) according to CVar
Implemented in SVF::ContextDDA, and SVF::FlowDDA.
|
inline |
|
inline |
|
inlineprotected |
Get SCC rep node of a SVFG node.
Definition at line 614 of file DDAVFSolver.h.
|
protectedpure virtual |
Handle AddrSVFGNode to add proper points-to.
Implemented in SVF::ContextDDA, and SVF::FlowDDA.
|
inlineprotectedvirtual |
Handle condition for context or path analysis (backward analysis)
Reimplemented in SVF::ContextDDA, and SVF::FlowDDA.
Definition at line 531 of file DDAVFSolver.h.
|
inlineprotected |
handle out-of-budget queries
Handle out-of-budget dpm
Definition at line 725 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Handle single statement.
resolve function pointer first at indirect callsite
Definition at line 170 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 646 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 545 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 652 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Check heap and array object.
Reimplemented in SVF::ContextDDA, and SVF::FlowDDA.
Definition at line 640 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Whether a local variable is in function recursions.
Definition at line 471 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
whether load and store are aliased
Definition at line 449 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 741 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 733 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Return TRUE if this is a strong update STORE statement.
Find the unique element in cpts
Definition at line 454 of file DDAVFSolver.h.
|
inlineprotected |
Return whether this SVFGNode is in cycle.
Definition at line 619 of file DDAVFSolver.h.
|
inlineprotected |
Whether this is a top-level pointer statement.
Definition at line 585 of file DDAVFSolver.h.
|
inlineprotected |
Visited flags to avoid cycles.
Definition at line 541 of file DDAVFSolver.h.
|
inlineprotected |
Reset visited map if the current query is out-of-budget.
Definition at line 336 of file DDAVFSolver.h.
|
protectedpure virtual |
ProcessGep node to generate field object nodes of a struct.
Implemented in SVF::ContextDDA, and SVF::FlowDDA.
|
inlineprotectedvirtual |
If the points-to contain the object obj, we could move forward along indirect value-flow edge.
Reimplemented in SVF::ContextDDA.
Definition at line 489 of file DDAVFSolver.h.
|
inlineprotected |
recompute points-to for value-flow cycles and indirect calls
re-compute due to indirect calls
callgraph scc detection for local variable in recursion
re-compute for transitive closures
Definition at line 255 of file DDAVFSolver.h.
|
inlineprotected |
Traverse along out edges to find all nodes which may be affected by locDPM.
Only collect nodes we have traversed
Definition at line 276 of file DDAVFSolver.h.
|
inlineprivate |
Definition at line 673 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Reset visited map for next points-to query.
Definition at line 324 of file DDAVFSolver.h.
|
inlineprotected |
resolve function pointer
use pre-analysis call graph to approximate all potential callsites
Definition at line 494 of file DDAVFSolver.h.
|
inlineprotected |
remove strong updates num if the dpm goes to weak updates branch
Definition at line 763 of file DDAVFSolver.h.
|
inlineprotected |
|
inlineprotected |
Set callgraphSCC.
Definition at line 634 of file DDAVFSolver.h.
|
inlineprotected |
|
inlineprotected |
Backward traverse for top-level pointers of load/store statements
Definition at line 392 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 403 of file DDAVFSolver.h.
|
inlineprotected |
SVFG SCC detection.
Definition at line 605 of file DDAVFSolver.h.
|
inlineprotected |
Definition at line 726 of file DDAVFSolver.h.
|
inlinevirtual |
|
inlinevirtual |
|
inlineprotectedvirtual |
Definition at line 565 of file DDAVFSolver.h.
|
inlineprotectedvirtual |
Update call graph.
Reimplemented in SVF::ContextDDA, and SVF::FlowDDA.
Definition at line 536 of file DDAVFSolver.h.
Definition at line 49 of file DDAVFSolver.h.
|
protected |
Andersen's analysis.
Definition at line 777 of file DDAVFSolver.h.
|
protected |
Definition at line 779 of file DDAVFSolver.h.
|
protected |
SCC for PTACallGraph.
Definition at line 780 of file DDAVFSolver.h.
|
protected |
Definition at line 775 of file DDAVFSolver.h.
|
protected |
SVFG.
Definition at line 776 of file DDAVFSolver.h.
|
protected |
SCC for SVFG.
Definition at line 781 of file DDAVFSolver.h.
|
protected |
visited map during backward traversing
Definition at line 782 of file DDAVFSolver.h.
|
protected |
candidate pointers;
Definition at line 778 of file DDAVFSolver.h.
|
protected |
DDA stat.
Definition at line 790 of file DDAVFSolver.h.
|
protected |
points-to caching map for address-taken vars
Definition at line 784 of file DDAVFSolver.h.
|
protected |
dpms at loads for may/must-alias analysis with stores
Definition at line 786 of file DDAVFSolver.h.
|
protected |
points-to caching map for top-level vars
Definition at line 783 of file DDAVFSolver.h.
|
protected |
map a load dpm to its cvar pointed by its pointer operand
Definition at line 787 of file DDAVFSolver.h.
|
protected |
map location to its dpms
Definition at line 785 of file DDAVFSolver.h.
|
protected |
out of budget dpm set
Definition at line 788 of file DDAVFSolver.h.
|
protected |
Whether the current query is out of step limits.
Definition at line 774 of file DDAVFSolver.h.
|
protected |
map store to set of DPM which have been stong updated there
Definition at line 789 of file DDAVFSolver.h.
|
protected |
SVFG Builder.
Definition at line 791 of file DDAVFSolver.h.