#include <FlowSensitiveTBHC.h>

Inheritance diagram for SVF::FlowSensitiveTBHC:

Public Member Functions
	FlowSensitiveTBHC (PAG *_pag, PTATY type=FSTBHC_WPA)
	Constructor. More...

virtual	~FlowSensitiveTBHC ()
	Destructor. More...

virtual void	analyze () override
	Flow sensitive analysis with FSTBHC. More...

virtual void	initialize () override
	Initialize analysis. More...

virtual void	finalize () override
	Finalize analysis. More...

virtual const std::string	PTAName () const override
	Get PTA name. More...

virtual bool	propAlongIndirectEdge (const IndirectSVFGEdge *edge) override
	Propagate points-to information along an INDIRECT SVFG edge. More...

virtual bool	propAlongDirectEdge (const DirectSVFGEdge *edge) override
	Propagate points-to information along a DIRECT SVFG edge. More...

virtual bool	processAddr (const AddrSVFGNode *addr) override

virtual bool	processGep (const GepSVFGNode *gep) override

virtual bool	processLoad (const LoadSVFGNode *load) override

virtual bool	processStore (const StoreSVFGNode *store) override

virtual bool	processPhi (const PHISVFGNode *phi) override

virtual bool	processCopy (const CopySVFGNode *copy) override

virtual const NodeBS &	getAllFieldsObjNode (NodeID id) override

virtual bool	updateInFromIn (const SVFGNode srcStmt, NodeID srcVar, const SVFGNode dstStmt, NodeID dstVar) override

virtual bool	updateInFromOut (const SVFGNode srcStmt, NodeID srcVar, const SVFGNode dstStmt, NodeID dstVar) override

virtual bool	unionPtsFromIn (const SVFGNode *stmt, NodeID srcVar, NodeID dstVar) override

virtual bool	unionPtsFromTop (const SVFGNode *stmt, NodeID srcVar, NodeID dstVar) override

virtual bool	propDFOutToIn (const SVFGNode srcStmt, NodeID srcVar, const SVFGNode dstStmt, NodeID dstVar) override

virtual bool	propDFInToIn (const SVFGNode srcStmt, NodeID srcVar, const SVFGNode dstStmt, NodeID dstVar) override

virtual void	expandFIObjs (const PointsTo &pts, PointsTo &expandedPts) override
	Expand FI objects. More...

const DIType *	getTypeFromCTirMetadata (const SVFGNode *)

Public Member Functions inherited from SVF::FlowSensitive
	FlowSensitive (PAG *_pag, PTATY type=FSSPARSE_WPA)
	Constructor. More...

virtual	~FlowSensitive ()
	Destructor. More...

virtual bool	runOnModule (SVFModule *)
	We start from here. More...

SVFG *	getSVFG () const
	Return SVFG. More...

Public Member Functions inherited from SVF::WPAFSSolver< GraphType >
	WPAFSSolver ()
	Constructor. More...

virtual	~WPAFSSolver ()
	Destructor. More...

virtual NodeID	sccRepNode (NodeID id) const
	SCC methods. More...

Public Member Functions inherited from SVF::BVDataPTAImpl
	BVDataPTAImpl (PAG *pag, PointerAnalysis::PTATY type, bool alias_check=true)
	Constructor. More...

virtual	~BVDataPTAImpl ()
	Destructor. More...

void	destroy ()
	Release memory. More...

virtual void	clearPts (NodeID id, NodeID element)
	Remove element from the points-to set of id. More...

virtual void	clearFullPts (NodeID id)
	Clear points-to set of id. More...

virtual void	clearAllPts ()
	Clear all data. More...

virtual AliasResult	alias (const MemoryLocation &LocA, const MemoryLocation &LocB)
	Interface expose to users of our pointer analysis, given Location infos. More...

virtual AliasResult	alias (const Value V1, const Value V2)
	Interface expose to users of our pointer analysis, given Value infos. More...

virtual AliasResult	alias (NodeID node1, NodeID node2)
	Interface expose to users of our pointer analysis, given PAGNodeID. More...

virtual AliasResult	alias (const PointsTo &pts1, const PointsTo &pts2)
	Interface expose to users of our pointer analysis, given two pts. More...

virtual const PointsTo &	getPts (NodeID id)

virtual const NodeBS &	getRevPts (NodeID nodeId)

virtual bool	unionPts (NodeID id, const PointsTo &target)

virtual bool	unionPts (NodeID id, NodeID ptd)

virtual bool	addPts (NodeID id, NodeID ptd)

virtual void	writeToFile (const std::string &filename)
	Interface for analysis result storage on filesystem. More...

virtual bool	readFromFile (const std::string &filename)

virtual void	dumpCPts ()
	dump and debug, print out conditional pts More...

virtual void	dumpTopLevelPtsTo ()

virtual void	dumpAllPts ()

Public Member Functions inherited from SVF::PointerAnalysis
Size_t	getNumOfResolvedIndCallEdge () const
	Return number of resolved indirect call edges. More...

PTACallGraph *	getPTACallGraph () const
	Return call graph. More...

CallGraphSCC *	getCallGraphSCC () const
	Return call graph SCC. More...

	PointerAnalysis (PAG *pag, PTATY ty=Default_PTA, bool alias_check=true)
	Constructor. More...

PTATY	getAnalysisTy () const
	Type of pointer analysis. More...

PTAImplTy	getImplTy () const
	Return implementation type of the pointer analysis. More...

PTAStat *	getStat () const
	Get PTA stat. More...

SVFModule *	getModule () const
	Module. More...

OrderedNodeSet &	getAllValidPtrs ()
	Get all Valid Pointers for resolution. More...

virtual	~PointerAnalysis ()
	Destructor. More...

virtual void	computeDDAPts (NodeID)
	Compute points-to results on-demand, overridden by derived classes. More...

virtual void	clearPts ()
	Clear points-to data. More...

void	printIndCSTargets (const CallBlockNode *cs, const FunctionSet &targets)
	Print targets of a function pointer. More...

void	dumpStat ()
	Dump the statistics. More...

bool	printStat ()
	Whether print statistics. More...

void	disablePrintStat ()
	Whether print statistics. More...

virtual void	resolveIndCalls (const CallBlockNode cs, const PointsTo &target, CallEdgeMap &newEdges, LLVMCallGraph callgraph=nullptr)
	Resolve indirect call edges. More...

bool	matchArgs (const CallBlockNode cs, const SVFFunction callee)
	Match arguments for callsite at caller and callee. More...

CommonCHGraph *	getCHGraph () const
	get CHGraph More...

void	getVFnsFromCHA (const CallBlockNode *cs, VFunSet &vfns)

void	getVFnsFromPts (const CallBlockNode *cs, const PointsTo &target, VFunSet &vfns)

void	connectVCallToVFns (const CallBlockNode *cs, const VFunSet &vfns, CallEdgeMap &newEdges)

virtual void	resolveCPPIndCalls (const CallBlockNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
	Resolve cpp indirect call edges. More...

const TypeSystem *	getTypeSystem () const
	get TypeSystem More...

PAG *	getPAG () const

virtual void	dumpPts (NodeID ptr, const PointsTo &pts)

void	printIndCSTargets ()

void	dumpAllTypes ()

bool	containBlackHoleNode (const PointsTo &pts)
	Determine whether a points-to contains a black hole or constant node. More...

bool	containConstantNode (const PointsTo &pts)

virtual bool	isBlkObjOrConstantObj (NodeID ptd) const

bool	isNonPointerObj (NodeID ptd) const

bool	isHeapMemObj (NodeID id) const
	Whether this object is heap or array. More...

bool	isArrayMemObj (NodeID id) const

bool	isFIObjNode (NodeID id) const

NodeID	getBaseObjNode (NodeID id)

NodeID	getFIObjNode (NodeID id)

NodeID	getGepObjNode (NodeID id, const LocationSet &ls)

void	setObjFieldInsensitive (NodeID id)

bool	isFieldInsensitive (NodeID id) const

CallEdgeMap &	getIndCallMap ()
	Get callees from an indirect callsite. More...

bool	hasIndCSCallees (const CallBlockNode *cs) const

const FunctionSet &	getIndCSCallees (const CallBlockNode *cs) const

void	callGraphSCCDetection ()
	CallGraph SCC related methods. More...

NodeID	getCallGraphSCCRepNode (NodeID id) const
	Get SCC rep node of a SVFG node. More...

bool	inSameCallGraphSCC (const SVFFunction fun1, const SVFFunction fun2)
	Return TRUE if this edge is inside a CallGraph SCC, i.e., src node and dst node are in the same SCC on the SVFG. More...

bool	isInRecursion (const SVFFunction *fun) const

bool	isLocalVarInRecursiveFun (NodeID id) const
	Whether a local variable is in function recursions. More...

Public Member Functions inherited from SVF::TypeBasedHeapCloning
virtual	~TypeBasedHeapCloning ()

Static Public Member Functions
static const MDNode *	getRawCTirMetadata (const SVFGNode *)

static bool	classof (const FlowSensitiveTBHC *)
	For LLVM RTTI. More...

static bool	classof (const PointerAnalysis *pta)
	For LLVM RTTI. More...

Static Public Member Functions inherited from SVF::FlowSensitive
static FlowSensitive *	createFSWPA (PAG *_pag)
	Create signle instance of flow-sensitive pointer analysis. More...

static void	releaseFSWPA ()
	Release flow-sensitive pointer analysis. More...

static bool	classof (const FlowSensitive *)
	Methods for support type inquiry through isa, cast, and dyn_cast. More...

static bool	classof (const PointerAnalysis *pta)

Static Public Member Functions inherited from SVF::BVDataPTAImpl
static bool	classof (const PointerAnalysis *pta)

Static Public Member Functions inherited from SVF::TypeBasedHeapCloning
static const MDNode *	getRawCTirMetadata (const Value *)
	Returns raw ctir metadata of a Value. Returns null if it doesn't exist. More...

Protected Member Functions
virtual void	backPropagate (NodeID clone) override

virtual void	countAliases (Set< std::pair< NodeID, NodeID >> cmp, unsigned mayAliases, unsigned noAliases) override
	Fills may/noAliases for the location/pointer pairs in cmp. More...

Protected Member Functions inherited from SVF::FlowSensitive
virtual NodeStack &	SCCDetect ()
	SCC detection. More...

bool	isStrongUpdate (const SVFGNode *node, NodeID &singleton)
	Return TRUE if this is a strong update STORE statement. More...

virtual void	printCTirAliasStats (void)

void	svfgStat ()

virtual bool	propFromSrcToDst (SVFGEdge *edge)
	Propagation. More...

virtual bool	propVarPtsFromSrcToDst (NodeID var, const SVFGNode src, const SVFGNode dst)
	Propagate points-to information of a certain variable from src to dst. More...

virtual bool	propagateFromAPToFP (const ActualParmSVFGNode ap, const SVFGNode dst)

virtual bool	propagateFromFRToAR (const FormalRetSVFGNode fr, const SVFGNode dst)

virtual bool	weakUpdateOutFromIn (const SVFGNode *node)
	Handle weak updates. More...

virtual bool	strongUpdateOutFromIn (const SVFGNode *node, NodeID singleton)
	Handle strong updates. More...

bool	propVarPtsAfterCGUpdated (NodeID var, const SVFGNode src, const SVFGNode dst)

bool	updateOutFromIn (const SVFGNode srcStmt, NodeID srcVar, const SVFGNode dstStmt, NodeID dstVar)
	Update data-flow points-to data. More...

void	clearAllDFOutVarFlag (const SVFGNode *stmt)

virtual void	processNode (NodeID nodeId)
	Handle various constraints. More...

bool	processSVFGNode (SVFGNode *node)

bool	updateCallGraph (const CallSiteToFunPtrMap &callsites)
	Update call graph. More...

void	connectCallerAndCallee (const CallEdgeMap &newEdges, SVFGEdgeSetTy &edges)
	Connect nodes in SVFG. More...

virtual void	updateConnectedNodes (const SVFGEdgeSetTy &edges)
	Update nodes connected during updating call graph. More...

const PointsTo &	getDFInPtsSet (const SVFGNode *stmt, const NodeID node)
	Get points-to set for a node from data flow IN/OUT set at a statement. More...

const PointsTo &	getDFOutPtsSet (const SVFGNode *stmt, const NodeID node)

const DFInOutMap &	getDFInputMap () const

const DFInOutMap &	getDFOutputMap () const

Protected Member Functions inherited from SVF::WPASolver< GraphType >
	WPASolver ()
	Constructor. More...

virtual	~WPASolver ()
	Destructor. More...

SCC *	getSCCDetector () const
	Get SCC detector. More...

virtual NodeStack &	SCCDetect (NodeSet &candidates)

virtual void	initWorklist ()

virtual void	solveWorklist ()

GNODE *	Node (NodeID id)
	Get node on the graph. More...

NodeID	Node_Index (GNODE node)
	Get node ID. More...

const GraphType	graph ()
	Get/Set graph methods. More...

void	setGraph (GraphType g)

virtual void	collapsePWCNode (NodeID)
	collapse positive weight cycles of a graph More...

virtual void	collapseFields ()

virtual void	propagate (GNODE *v)

virtual bool	propFromSrcToDst (GEDGE *)
	Propagate information from source to destination node, to be implemented in the child class. More...

NodeID	popFromWorklist ()
	Worklist operations. More...

virtual void	pushIntoWorklist (NodeID id)

bool	isWorklistEmpty ()

bool	isInWorklist (NodeID id)

Protected Member Functions inherited from SVF::BVDataPTAImpl
PTDataTy *	getPTDataTy () const
	Get points-to data structure. More...

DiffPTDataTy *	getDiffPTDataTy () const

DFPTDataTy *	getDFPTDataTy () const

MutDFPTDataTy *	getMutDFPTDataTy () const

VersionedPTDataTy *	getVersionedPTDataTy () const

virtual void	onTheFlyCallGraphSolve (const CallSiteToFunPtrMap &callsites, CallEdgeMap &newEdges)
	On the fly call graph construction. More...

virtual void	normalizePointsTo ()

Protected Member Functions inherited from SVF::PointerAnalysis
const CallSiteToFunPtrMap &	getIndirectCallsites () const
	Return all indirect callsites. More...

NodeID	getFunPtr (const CallBlockNode *cs) const
	Return function pointer PAGNode at a callsite cs. More...

bool	dumpGraph ()
	Whether to dump the graph for debugging purpose. More...

void	resetObjFieldSensitive ()
	Reset all object node as field-sensitive. More...

virtual void	validateTests ()
	Alias check functions to verify correctness of pointer analysis. More...

virtual void	validateSuccessTests (std::string fun)

virtual void	validateExpectedFailureTests (std::string fun)

Protected Member Functions inherited from SVF::TypeBasedHeapCloning
	TypeBasedHeapCloning (BVDataPTAImpl *pta)
	Constructor. pta is the pointer analysis using this object (i.e. that which is extending). More...

void	setDCHG (DCHGraph *dchg)
	DCHG must be set by extending class once the DCHG is available. More...

void	setPAG (PAG *pag)
	PAG must be set by extending class once the PAG is available. More...

bool	isBlkObjOrConstantObj (NodeID o) const

bool	isBase (const DIType a, const DIType b) const

bool	isClone (NodeID o) const
	Returns true if o is a clone. More...

void	setType (NodeID o, const DIType *t)
	Sets the type (in objToType) of o. More...

const DIType *	getType (NodeID o) const
	Returns the type (from objToType) of o. Asserts existence. More...

void	setAllocationSite (NodeID o, NodeID site)
	Sets the allocation site (in objToAllocation) of o. More...

NodeID	getAllocationSite (NodeID o) const
	Returns the allocation site (from objToAllocation) of o. Asserts existence. More...

const NodeBS	getObjsWithClones (void)
	Returns objects that have clones (any key in objToClones). More...

void	addClone (NodeID o, NodeID c)
	Add a clone c to object o. More...

const NodeBS &	getClones (NodeID o)
	Returns all the clones of o. More...

void	setOriginalObj (NodeID c, NodeID o)

NodeID	getOriginalObj (NodeID c) const
	Returns the original object c is cloned from. If c is not a clone, returns itself. More...

PointsTo &	getFilterSet (NodeID loc)
	Returns the filter set of a location. Not const; could create empty PointsTo. More...

void	addGepToObj (NodeID gep, NodeID base, unsigned offset)
	Associates gep with base (through objToGeps and memObjToGeps). More...

const NodeBS &	getGepObjsFromMemObj (const MemObj *memObj, unsigned offset)

const NodeBS &	getGepObjs (NodeID base)

const NodeBS	getGepObjClones (NodeID base, unsigned offset)

bool	init (NodeID loc, NodeID p, const DIType *tildet, bool reuse, bool gep=false)

NodeID	cloneObject (NodeID o, const DIType *type, bool reuse)

NodeID	addCloneDummyObjNode (const MemObj *mem)
	Add clone dummy object node to PAG. More...

NodeID	addCloneGepObjNode (const MemObj *mem, const LocationSet &l)
	Add clone GEP object node to PAG. More...

NodeID	addCloneFIObjNode (const MemObj *mem)
	Add clone FI object node to PAG. More...

const DIType *	getTypeFromCTirMetadata (const Value *)

void	validateTBHCTests (SVFModule *svfMod)

void	dumpStats (void)
	Dump some statistics we tracked. More...

Private Member Functions
void	determineWhichGepsAreLoads (void)

bool	gepIsLoad (NodeID gep)

Private Attributes
bool	storeReuse
	Whether to allow for reuse at stores. More...

bool	allReuse

Map< NodeID, NodeBS >	gepToSVFGRetrievers
	Maps GEP objects to the SVFG nodes that retrieved them with getGepObjClones. More...

NodeBS	loadGeps
	Maps whether a (SVFG) GEP node is a load or not. More...

Additional Inherited Members
Public Types inherited from SVF::FlowSensitive
typedef BVDataPTAImpl::MutDFPTDataTy	MutDFPTDataTy

typedef BVDataPTAImpl::MutDFPTDataTy::DFPtsMap	DFInOutMap

typedef BVDataPTAImpl::MutDFPTDataTy::PtsMap	PtsMap

Public Types inherited from SVF::WPASolver< GraphType >
typedef llvm::GraphTraits< GraphType >	GTraits
	Define the GTraits and node iterator for printing. More...

typedef GTraits::NodeRef	GNODE

typedef GTraits::EdgeType	GEDGE

typedef GTraits::ChildIteratorType	child_iterator

typedef SCCDetection< GraphType >	SCC

typedef FIFOWorkList< NodeID >	WorkList

Public Types inherited from SVF::BVDataPTAImpl
typedef PTData< NodeID, NodeBS, NodeID, PointsTo >	PTDataTy

typedef MutablePTData< NodeID, NodeBS, NodeID, PointsTo >	MutPTDataTy

typedef DiffPTData< NodeID, NodeBS, NodeID, PointsTo >	DiffPTDataTy

typedef MutableDiffPTData< NodeID, NodeBS, NodeID, PointsTo >	MutDiffPTDataTy

typedef DFPTData< NodeID, NodeBS, NodeID, PointsTo >	DFPTDataTy

typedef MutableDFPTData< NodeID, NodeBS, NodeID, PointsTo >	MutDFPTDataTy

typedef IncMutableDFPTData< NodeID, NodeBS, NodeID, PointsTo >	IncMutDFPTDataTy

typedef VersionedPTData< NodeID, NodeBS, NodeID, PointsTo, VersionedVar, Set< VersionedVar > >	VersionedPTDataTy

typedef MutableVersionedPTData< NodeID, NodeBS, NodeID, PointsTo, VersionedVar, Set< VersionedVar > >	MutVersionedPTDataTy

Public Types inherited from SVF::PointerAnalysis
enum	PTATY { Andersen_BASE, Andersen_WPA, AndersenLCD_WPA, AndersenHCD_WPA, AndersenHLCD_WPA, AndersenSCD_WPA, AndersenSFR_WPA, AndersenWaveDiff_WPA, AndersenWaveDiffWithType_WPA, Steensgaard_WPA, CSCallString_WPA, CSSummary_WPA, FSDATAFLOW_WPA, FSSPARSE_WPA, FSTBHC_WPA, VFS_WPA, FSCS_WPA, FSCSPS_WPA, ADAPTFSCS_WPA, ADAPTFSCSPS_WPA, TypeCPP_WPA, FieldS_DDA, FlowS_DDA, PathS_DDA, Cxt_DDA, Default_PTA }
	Pointer analysis type list. More...

enum	PTAImplTy { BaseImpl, BVDataImpl, CondImpl }
	Implementation type: BVDataPTAImpl or CondPTAImpl. More...

typedef llvm::AliasAnalysis	AliasAnalysis
	Indirect call edges type, map a callsite to a set of callees. More...

typedef Set< const CallBlockNode * >	CallSiteSet

typedef PAG::CallSiteToFunPtrMap	CallSiteToFunPtrMap

typedef Set< const SVFFunction * >	FunctionSet

typedef OrderedMap< const CallBlockNode *, FunctionSet >	CallEdgeMap

typedef SCCDetection< PTACallGraph * >	CallGraphSCC

typedef Set< const GlobalValue * >	VTableSet

typedef Set< const SVFFunction * >	VFunSet

Public Attributes inherited from SVF::WPASolver< GraphType >
u32_t	numOfIteration
	num of iterations during constaint solving More...

Static Public Attributes inherited from SVF::PointerAnalysis
static const std::string	aliasTestMayAlias = "MAYALIAS"

static const std::string	aliasTestMayAliasMangled = "_Z8MAYALIASPvS_"

static const std::string	aliasTestNoAlias = "NOALIAS"

static const std::string	aliasTestNoAliasMangled = "_Z7NOALIASPvS_"

static const std::string	aliasTestPartialAlias = "PARTIALALIAS"

static const std::string	aliasTestPartialAliasMangled = "_Z12PARTIALALIASPvS_"

static const std::string	aliasTestMustAlias = "MUSTALIAS"

static const std::string	aliasTestMustAliasMangled = "_Z9MUSTALIASPvS_"

static const std::string	aliasTestFailMayAlias = "EXPECTEDFAIL_MAYALIAS"

static const std::string	aliasTestFailMayAliasMangled = "_Z21EXPECTEDFAIL_MAYALIASPvS_"

static const std::string	aliasTestFailNoAlias = "EXPECTEDFAIL_NOALIAS"

static const std::string	aliasTestFailNoAliasMangled = "_Z20EXPECTEDFAIL_NOALIASPvS_"

Protected Types inherited from SVF::FlowSensitive
typedef SVFG::SVFGEdgeSetTy	SVFGEdgeSetTy

Protected Attributes inherited from SVF::FlowSensitive
SVFG *	svfg

SVFGBuilder	memSSA

AndersenWaveDiff *	ander

Size_t	numOfProcessedAddr
	Statistics. More...

Size_t	numOfProcessedCopy
	Number of processed Addr node. More...

Size_t	numOfProcessedGep
	Number of processed Copy node. More...

Size_t	numOfProcessedPhi
	Number of processed Gep node. More...

Size_t	numOfProcessedLoad
	Number of processed Phi node. More...

Size_t	numOfProcessedStore
	Number of processed Load node. More...

Size_t	numOfProcessedActualParam
	Number of processed Store node. More...

Size_t	numOfProcessedFormalRet
	Number of processed actual param node. More...

Size_t	numOfProcessedMSSANode
	Number of processed formal ret node. More...

Size_t	maxSCCSize
	Number of processed mssa node. More...

Size_t	numOfSCC

Size_t	numOfNodesInSCC

double	solveTime
	time of solve. More...

double	sccTime
	time of SCC detection. More...

double	processTime
	time of processNode. More...

double	propagationTime
	time of points-to propagation. More...

double	directPropaTime
	time of points-to propagation of address-taken objects More...

double	indirectPropaTime
	time of points-to propagation of top-level pointers More...

double	updateTime
	time of strong/weak updates. More...

double	addrTime
	time of handling address edges More...

double	copyTime
	time of handling copy edges More...

double	gepTime
	time of handling gep edges More...

double	loadTime
	time of load edges More...

double	storeTime
	time of store edges More...

double	phiTime
	time of phi nodes. More...

double	updateCallGraphTime
	time of updating call graph More...

NodeBS	svfgHasSU

Protected Attributes inherited from SVF::WPAFSSolver< GraphType >
NodeStack	nodeStack
	stack used for processing nodes. More...

Protected Attributes inherited from SVF::WPASolver< GraphType >
bool	reanalyze
	Reanalyze if any constraint value changed. More...

u32_t	iterationForPrintStat
	print out statistics for i-th iteration More...

GraphType	_graph
	Graph. More...

SCC *	scc
	SCC. More...

WorkList	worklist
	Worklist for resolution. More...

Protected Attributes inherited from SVF::PointerAnalysis
SVFModule *	svfMod
	Module. More...

PTATY	ptaTy
	Pointer analysis Type. More...

PTAImplTy	ptaImplTy
	PTA implementation type. More...

PTAStat *	stat
	Statistics. More...

PTACallGraph *	ptaCallGraph
	Call graph used for pointer analysis. More...

CallGraphSCC *	callGraphSCC
	SCC for CallGraph. More...

ICFG *	icfg
	Interprocedural control-flow graph. More...

TypeSystem *	typeSystem
	TypeSystem. More...

bool	print_stat
	User input flags. More...

bool	alias_validation
	Flag for validating points-to/alias results. More...

u32_t	OnTheFlyIterBudgetForStat
	Flag for iteration budget for on-the-fly statistics. More...

Protected Attributes inherited from SVF::TypeBasedHeapCloning
DCHGraph *	dchg = nullptr

Static Protected Attributes inherited from SVF::FlowSensitive
static FlowSensitive *	fspta = nullptr

Static Protected Attributes inherited from SVF::PointerAnalysis
static PAG *	pag = nullptr
	PAG. More...

static CommonCHGraph *	chgraph = nullptr
	CHGraph. More...

Static Protected Attributes inherited from SVF::TypeBasedHeapCloning
static const DIType *	undefType = nullptr
	The undefined type (•); void. More...

static const std::string	derefFnName = "deref"
	deref function for TBHC alias tests. More...

static const std::string	mangledDerefFnName = "_Z5derefv"
	deref function (mangled) for TBHC alias tests. More...

Detailed Description

Flow sensitive whole program pointer analysis with type-based heap cloning.

Definition at line 27 of file FlowSensitiveTBHC.h.

Constructor & Destructor Documentation

◆ FlowSensitiveTBHC()

FlowSensitiveTBHC::FlowSensitiveTBHC	(	PAG *	_pag,
		PTATY	type = `FSTBHC_WPA`
	)

Constructor.

Definition at line 19 of file FlowSensitiveTBHC.cpp.

                                                           : FlowSensitive(_pag, type), TypeBasedHeapCloning(this)
 {
     // Using `this` as the argument for TypeBasedHeapCloning is okay. As PointerAnalysis, it's
     // already constructed. TypeBasedHeapCloning also doesn't use pta in the constructor so it
     // just needs to be allocated, which it is.
     allReuse = Options::TBHCAllReuse;
     storeReuse = allReuse || Options::TBHCStoreReuse;
 }

◆ ~FlowSensitiveTBHC()

virtual SVF::FlowSensitiveTBHC::~FlowSensitiveTBHC ( )

inlinevirtual

Destructor.

Definition at line 38 of file FlowSensitiveTBHC.h.

38 { };

Member Function Documentation

◆ analyze()

void FlowSensitiveTBHC::analyze ( )

overridevirtual

Flow sensitive analysis with FSTBHC.

Reimplemented from SVF::FlowSensitive.

Definition at line 28 of file FlowSensitiveTBHC.cpp.

 {
     FlowSensitive::analyze();
 }

◆ backPropagate()

void FlowSensitiveTBHC::backPropagate ( NodeID clone )

overrideprotectedvirtual

Required by user. Handles back-propagation of newly created clone after all metadata has been set. Used by cloneObject.

Implements SVF::TypeBasedHeapCloning.

Definition at line 63 of file FlowSensitiveTBHC.cpp.

 {
     PAGNode *cloneObj = pag->getPAGNode(clone);
     assert(cloneObj && "FSTBHC: clone does not exist in PAG?");
     PAGNode *originalObj = pag->getPAGNode(getOriginalObj(clone));
     assert(cloneObj && "FSTBHC: original object does not exist in PAG?");
     // Check the original object too because when reuse of a gep occurs, the new object
     // is an FI object.
     if (SVFUtil::isa<CloneGepObjPN>(cloneObj) || SVFUtil::isa<GepObjPN>(originalObj))
     {
         // Since getGepObjClones is updated, some GEP nodes need to be redone.
         const NodeBS &retrievers = gepToSVFGRetrievers[getOriginalObj(clone)];
         for (NodeID r : retrievers)
         {
             pushIntoWorklist(r);
         }
     }
     else if (SVFUtil::isa<CloneFIObjPN>(cloneObj) || SVFUtil::isa<CloneDummyObjPN>(cloneObj))
     {
         pushIntoWorklist(getAllocationSite(getOriginalObj(clone)));
     }
     else
     {
         assert(false && "FSTBHC: unexpected object type?");
     }
 }

◆ classof() [1/2]

static bool SVF::FlowSensitiveTBHC::classof ( const FlowSensitiveTBHC * )

inlinestatic

For LLVM RTTI.

Definition at line 54 of file FlowSensitiveTBHC.h.

     {
         return true;
     }

◆ classof() [2/2]

static bool SVF::FlowSensitiveTBHC::classof ( const PointerAnalysis * pta )

inlinestatic

For LLVM RTTI.

Definition at line 60 of file FlowSensitiveTBHC.h.

     {
         return pta->getAnalysisTy() == FSTBHC_WPA;
     }

◆ countAliases()

void FlowSensitiveTBHC::countAliases	(	Set< std::pair< NodeID, NodeID >>	cmp,
		unsigned *	mayAliases,
		unsigned *	noAliases
	)

overrideprotectedvirtual

Fills may/noAliases for the location/pointer pairs in cmp.

Reimplemented from SVF::FlowSensitive.

Definition at line 658 of file FlowSensitiveTBHC.cpp.

 {
     Map<std::pair<NodeID, NodeID>, PointsTo> filteredPts;
     for (std::pair<NodeID, NodeID> locP : cmp)
     {
         const PointsTo &filterSet = getFilterSet(locP.first);
         const PointsTo &pts = getPts(locP.second);
         PointsTo &ptsFiltered = filteredPts[locP];
 
         for (NodeID o : pts)
         {
             if (filterSet.test(o)) continue;
             ptsFiltered.set(o);
         }
     }
 
     for (std::pair<NodeID, NodeID> locPA : cmp)
     {
         const PointsTo &aPts = filteredPts[locPA];
         for (std::pair<NodeID, NodeID> locPB : cmp)
         {
             if (locPB == locPA) continue;
             const PointsTo &bPts = filteredPts[locPB];
 
             switch (alias(aPts, bPts))
             {
             case llvm::NoAlias:
                 ++(*noAliases);
                 break;
             case llvm::MayAlias:
                 ++(*mayAliases);
                 break;
             default:
                 assert("Not May/NoAlias?");
             }
         }
     }
 
 }

◆ determineWhichGepsAreLoads()

void FlowSensitiveTBHC::determineWhichGepsAreLoads ( void )

private

Determines whether each GEP is for a load or not. Builds gepIsLoad map. This is a quick heuristic; if all destination nodes are loads, it's a load.

Definition at line 576 of file FlowSensitiveTBHC.cpp.

 {
     for (SVFG::iterator nI = svfg->begin(); nI != svfg->end(); ++nI)
     {
         SVFGNode *svfgNode = nI->second;
         if (const StmtSVFGNode *gep = SVFUtil::dyn_cast<GepSVFGNode>(svfgNode))
         {
             // Only care about ctir nodes - they have the reuse problem.
             if (getTypeFromCTirMetadata(gep))
             {
                 bool isLoad = true;
                 for (const SVFGEdge *e : gep->getOutEdges())
                 {
                     SVFGNode *dst = e->getDstNode();
 
                     // Loop on itself - don't care.
                     if (gep == dst) continue;
 
                     if (!SVFUtil::isa<LoadSVFGNode>(dst))
                     {
                         isLoad = false;
                         break;
                     }
                 }
 
                 if (isLoad)
                 {
                     loadGeps.set(gep->getId());
                 }
             }
         }
     }
 }

◆ expandFIObjs()

void FlowSensitiveTBHC::expandFIObjs	(	const PointsTo &	pts,
		PointsTo &	expandedPts
	)

overridevirtual

Expand FI objects.

Expand all fields of an aggregate in all points-to sets

Reimplemented from SVF::BVDataPTAImpl.

Definition at line 644 of file FlowSensitiveTBHC.cpp.

 {
     expandedPts = pts;
     for (NodeID o : pts)
     {
         expandedPts |= getAllFieldsObjNode(o);
         while (const GepObjPN *gepObj = SVFUtil::dyn_cast<GepObjPN>(pag->getPAGNode(o)))
         {
             expandedPts |= getAllFieldsObjNode(o);
             o = gepObj->getBaseNode();
         }
     }
 }

◆ finalize()

void FlowSensitiveTBHC::finalize ( void )

overridevirtual

Finalize analysis.

Reimplemented from SVF::FlowSensitive.

Definition at line 51 of file FlowSensitiveTBHC.cpp.

 {
     FlowSensitive::finalize();
     // ^ Will print call graph and alias stats.
 
     if(print_stat)
         dumpStats();
     // getDFPTDataTy()->dumpPTData();
 
     validateTBHCTests(svfMod);
 }

◆ gepIsLoad()

bool FlowSensitiveTBHC::gepIsLoad ( NodeID gep )

private

Returns true if the given GEP is for loads, false otherwise. If the node ID is not for a GEP SVFG node, returns false.

Definition at line 610 of file FlowSensitiveTBHC.cpp.

 {
     // Handles when gep is not even a GEP; loadGeps only contains GEPs.
     return loadGeps.test(gep);
 }

◆ getAllFieldsObjNode()

const NodeBS & FlowSensitiveTBHC::getAllFieldsObjNode ( NodeID id )

inlineoverridevirtual

Reimplemented from SVF::PointerAnalysis.

Definition at line 531 of file FlowSensitiveTBHC.cpp.

 {
     return getGepObjs(id);
 }

◆ getRawCTirMetadata()

const MDNode * FlowSensitiveTBHC::getRawCTirMetadata ( const SVFGNode * s )

static

Returns raw ctir metadata of the instruction behind a SVFG node. Wraps getRawCTirMetadata(const Value *). Returns null if it doesn't exist.

Definition at line 616 of file FlowSensitiveTBHC.cpp.

 {
     if (const StmtSVFGNode *stmt = SVFUtil::dyn_cast<StmtSVFGNode>(s))
     {
         const Value *v = stmt->getInst() ? stmt->getInst() : stmt->getPAGEdge()->getValue();
         if (v != nullptr)
         {
             return TypeBasedHeapCloning::getRawCTirMetadata(v);
         }
     }
 
     return nullptr;
 }

◆ getTypeFromCTirMetadata()

const DIType * FlowSensitiveTBHC::getTypeFromCTirMetadata ( const SVFGNode * s )

Extracts the value from SVFGNode (if it exists), and calls getTypeFromCTirMetadata(const Value *). If no ctir type exists, returns null (void).

Definition at line 630 of file FlowSensitiveTBHC.cpp.

 {
     if (const StmtSVFGNode *stmt = SVFUtil::dyn_cast<StmtSVFGNode>(s))
     {
         const Value *v = stmt->getInst();
         if (v != nullptr)
         {
             return TypeBasedHeapCloning::getTypeFromCTirMetadata(v);
         }
     }
 
     return nullptr;
 }

◆ initialize()

void FlowSensitiveTBHC::initialize ( )

overridevirtual

Initialize analysis.

Reimplemented from SVF::FlowSensitive.

Definition at line 33 of file FlowSensitiveTBHC.cpp.

 {
     PointerAnalysis::initialize();
     AndersenWaveDiff* ander = AndersenWaveDiff::createAndersenWaveDiff(getPAG());
     svfg = memSSA.buildFullSVFG(ander);
     setGraph(svfg);
     stat = new FlowSensitiveStat(this);
 
     DCHGraph *dchg = SVFUtil::dyn_cast<DCHGraph>(getCHGraph());
     assert(dchg != nullptr && "FSTBHC: DCHGraph required!");
 
     TypeBasedHeapCloning::setDCHG(dchg);
     TypeBasedHeapCloning::setPAG(pag);
 
     // Populates loadGeps.
     determineWhichGepsAreLoads();
 }

◆ processAddr()

bool FlowSensitiveTBHC::processAddr ( const AddrSVFGNode * addr )

overridevirtual

Process address node

TODO: If this object has been set as field-insensitive, just add the insensitive object node into dst pointer's pts.

Reimplemented from SVF::FlowSensitive.

Definition at line 216 of file FlowSensitiveTBHC.cpp.

 {
     double start = stat->getClk();
 
     NodeID srcID = addr->getPAGSrcNodeID();
     NodeID dstID = addr->getPAGDstNodeID();
 
     double end = stat->getClk();
     addrTime += (end - start) / TIMEINTERVAL;
 
     if (!addr->getPAGEdge()->isPTAEdge()) return false;
 
     bool changed = FlowSensitive::processAddr(addr);
 
     start = stat->getClk();
 
     const DIType *objType;
     if (isHeapMemObj(srcID))
     {
         objType = undefType;
     }
     else if (pag->isConstantObj(srcID))
     {
         // Probably constants that have been merged into one.
         // We make it undefined even though it's technically a global
         // to keep in line with SVF's design.
         // This will end up splitting into one for each type of constant.
         objType = undefType;
     }
     else
     {
         // Stack/global.
         objType = getTypeFromCTirMetadata(addr);
     }
 
     setType(srcID, objType);
     setAllocationSite(srcID, addr->getId());
 
     // All the typed versions of srcID. This handles back-propagation.
     const NodeBS &clones = getClones(srcID);
     for (NodeID c : clones)
     {
         changed = addPts(dstID, c) || changed;
         // No need for typing these are all clones; they are all typed.
     }
 
     end = stat->getClk();
     addrTime += (end - start) / TIMEINTERVAL;
 
     return changed;
 }

◆ processCopy()

bool FlowSensitiveTBHC::processCopy ( const CopySVFGNode * copy )

overridevirtual

Process copy node

Reimplemented from SVF::FlowSensitive.

Definition at line 518 of file FlowSensitiveTBHC.cpp.

 {
     const DIType *vtInitType = getVTInitType(copy, dchg);
     bool changed = false;
     if (vtInitType != nullptr)
     {
         // Setting the virtual table pointer.
         changed = init(copy->getId(), copy->getPAGSrcNodeID(), vtInitType, true);
     }
 
     return FlowSensitive::processCopy(copy) || changed;
 }

◆ processGep()

bool FlowSensitiveTBHC::processGep ( const GepSVFGNode * edge )

overridevirtual

Process gep node

Reimplemented from SVF::FlowSensitive.

Definition at line 268 of file FlowSensitiveTBHC.cpp.

 {
     // Copy of that in FlowSensitive.cpp + some changes.
     double start = stat->getClk();
     bool changed = false;
 
     NodeID q = gep->getPAGSrcNodeID();
 
     const DIType *tildet = getTypeFromCTirMetadata(gep);
     if (tildet != undefType)
     {
         bool reuse = Options::TBHCAllReuse || (Options::TBHCStoreReuse && !gepIsLoad(gep->getId()));
         changed = init(gep->getId(), q, tildet, reuse, true);
     }
 
     if (!gep->getPAGEdge()->isPTAEdge())
     {
         return changed;
     }
 
     const PointsTo& qPts = getPts(q);
     PointsTo &filterSet = getFilterSet(gep->getId());
     PointsTo tmpDstPts;
     for (NodeID oq : qPts)
     {
         if (filterSet.test(oq)) continue;
 
         if (TypeBasedHeapCloning::isBlkObjOrConstantObj(oq))
         {
             tmpDstPts.set(oq);
         }
         else
         {
             if (SVFUtil::isa<VariantGepPE>(gep->getPAGEdge()))
             {
                 setObjFieldInsensitive(oq);
                 tmpDstPts.set(oq);
                 const DIType *t = getType(oq);
                 if (t && (t->getTag() == dwarf::DW_TAG_array_type || t->getTag() == dwarf::DW_TAG_pointer_type))
                 {
                     const NodeBS fieldClones = getGepObjClones(oq, 1);
                     for (NodeID fc : fieldClones)
                     {
                         gepToSVFGRetrievers[getOriginalObj(fc)].set(gep->getId());
                         tmpDstPts.set(fc);
                     }
                 }
             }
             else if (const NormalGepPE* normalGep = SVFUtil::dyn_cast<NormalGepPE>(gep->getPAGEdge()))
             {
                 const DIType *baseType = getType(oq);
 
                 // Drop down to field insensitive.
                 if (baseType == nullptr)
                 {
                     setObjFieldInsensitive(oq);
                     NodeID fiObj = oq;
                     tmpDstPts.set(fiObj);
                     continue;
                 }
 
                 if (DCHGraph::isAgg(baseType) && baseType->getTag() != dwarf::DW_TAG_array_type
                         && normalGep->getLocationSet().getOffset() >= dchg->getNumFields(baseType))
                 {
                     // If the field offset is too high for this object, it is killed. It seems that a
                     // clone was made on this GEP but this is not the base (e.g. base->f1->f2), and SVF
                     // expects to operate on the base (hence the large offset). The base will have been
                     // cloned at another GEP and back-propagated, thus it'll reach here safe and sound.
                     // We ignore arrays/pointers because those are array accesses/pointer arithmetic we
                     // assume are correct.
                     // Obviously, non-aggregates cannot have their fields taken so they are spurious.
                     filterSet.set(oq);
                 }
                 else
                 {
                     // Operate on the field and all its clones.
                     const NodeBS fieldClones = getGepObjClones(oq, normalGep->getLocationSet().getOffset());
                     for (NodeID fc : fieldClones)
                     {
                         gepToSVFGRetrievers[getOriginalObj(fc)].set(gep->getId());
                         tmpDstPts.set(fc);
                     }
                 }
             }
             else
             {
                 assert(false && "FSTBHC: new gep edge?");
             }
         }
     }
 
     double end = stat->getClk();
     gepTime += (end - start) / TIMEINTERVAL;
 
     changed = unionPts(gep->getPAGDstNodeID(), tmpDstPts) || changed;
     return changed;
 }

◆ processLoad()

bool FlowSensitiveTBHC::processLoad ( const LoadSVFGNode * load )

overridevirtual

Process load node

Foreach node src pts(dst) = union pts(node)

If the ptd is a field-insensitive node, we should also get all field nodes' points-to sets and pass them to pagDst.

Reimplemented from SVF::FlowSensitive.

Definition at line 366 of file FlowSensitiveTBHC.cpp.

 {
     double start = stat->getClk();
 
     bool changed = false;
     const DIType *tildet = getTypeFromCTirMetadata(load);
     if (tildet != undefType)
     {
         changed = init(load->getId(), load->getPAGSrcNodeID(), tildet, Options::TBHCAllReuse);
     }
 
     // We want to perform the initialisation for non-pointer nodes but not process the load.
     if (!load->getPAGEdge()->isPTAEdge())
     {
         return changed;
     }
 
     NodeID dstVar = load->getPAGDstNodeID();
 
     const PointsTo& srcPts = getPts(load->getPAGSrcNodeID());
     const PointsTo &filterSet = getFilterSet(load->getId());
     // unionPtsFromIn is going to call getOriginalObj on ptd anyway.
     // This results in fewer loop iterations. o_t, o_s --> o.
     PointsTo srcOriginalObjs;
     for (NodeID s : srcPts)
     {
         if (filterSet.test(s)) continue;
         if (pag->isConstantObj(s) || pag->isNonPointerObj(s)) continue;
         srcOriginalObjs.set(getOriginalObj(s));
     }
 
     for (NodeID ptd : srcOriginalObjs)
     {
         // filterSet tests happened while building srcOriginalObjs.
         if (unionPtsFromIn(load, ptd, dstVar))
             changed = true;
 
         if (isFIObjNode(ptd))
         {
             const NodeBS &allFields = getAllFieldsObjNode(ptd);
             for (NodeID f : allFields)
             {
                 if (unionPtsFromIn(load, f, dstVar))
                     changed = true;
             }
         }
     }
 
     double end = stat->getClk();
     loadTime += (end - start) / TIMEINTERVAL;
     return changed;
 }

◆ processPhi()

bool FlowSensitiveTBHC::processPhi ( const PHISVFGNode * phi )

overridevirtual

Process mssa phi node

Reimplemented from SVF::FlowSensitive.

Definition at line 496 of file FlowSensitiveTBHC.cpp.

 {
     if (!phi->isPTANode()) return false;
     return FlowSensitive::processPhi(phi);
 }

◆ processStore()

bool FlowSensitiveTBHC::processStore ( const StoreSVFGNode * store )

overridevirtual

Process store node

foreach node dst pts(node) = union pts(src)

STORE statement can only be processed if the pointer on the LHS points to something. If we handle STORE with an empty points-to set, the OUT set will be updated from IN set. Then if LHS pointer points-to one target and it has been identified as a strong update, we can't remove those points-to information computed before this strong update from the OUT set.

check if this is a strong updates store

STORE statement can only be processed if the pointer on the LHS points to something. If we handle STORE with an empty points-to set, the OUT set will be updated from IN set. Then if LHS pointer points-to one target and it has been identified as a strong update, we can't remove those points-to information computed before this strong update from the OUT set.

check if this is a strong updates store

Reimplemented from SVF::FlowSensitive.

Definition at line 421 of file FlowSensitiveTBHC.cpp.

 {
     double start = stat->getClk();
 
     bool changed = false;
     const DIType *tildet = getTypeFromCTirMetadata(store);
     if (tildet != undefType)
     {
         changed = init(store->getId(), store->getPAGDstNodeID(), tildet, Options::TBHCAllReuse || Options::TBHCStoreReuse);
     }
 
     // Like processLoad: we want to perform initialisation for non-pointers but not the store.
     if (!store->getPAGEdge()->isPTAEdge())
     {
         // Pass through and return because there may be some pointer nodes
         // relying on this node's parents.
         changed = getDFPTDataTy()->updateAllDFOutFromIn(store->getId(), 0, false);
         return changed;
     }
 
     const PointsTo & dstPts = getPts(store->getPAGDstNodeID());
 
     if (dstPts.empty())
     {
         return changed;
     }
 
     changed = false;
     const PointsTo &filterSet = getFilterSet(store->getId());
     if(getPts(store->getPAGSrcNodeID()).empty() == false)
     {
         for (NodeID ptd : dstPts)
         {
             if (filterSet.test(ptd)) continue;
 
             if (pag->isConstantObj(ptd) || pag->isNonPointerObj(ptd))
                 continue;
 
             if (unionPtsFromTop(store, store->getPAGSrcNodeID(), ptd))
                 changed = true;
         }
     }
 
     double end = stat->getClk();
     storeTime += (end - start) / TIMEINTERVAL;
 
     double updateStart = stat->getClk();
     // also merge the DFInSet to DFOutSet.
     NodeID singleton;
     bool isSU = isStrongUpdate(store, singleton);
     if (isSU)
     {
         svfgHasSU.set(store->getId());
         if (strongUpdateOutFromIn(store, singleton))
             changed = true;
     }
     else
     {
         svfgHasSU.reset(store->getId());
         if (weakUpdateOutFromIn(store))
             changed = true;
     }
     double updateEnd = stat->getClk();
     updateTime += (updateEnd - updateStart) / TIMEINTERVAL;
 
     return changed;
 }

◆ propAlongDirectEdge()

bool FlowSensitiveTBHC::propAlongDirectEdge ( const DirectSVFGEdge * edge )

overridevirtual

Propagate points-to information along a DIRECT SVFG edge.

Propagate points-to information along DIRECT SVFG edge.

Reimplemented from SVF::FlowSensitive.

Definition at line 183 of file FlowSensitiveTBHC.cpp.

 {
     double start = stat->getClk();
     bool changed = false;
 
     SVFGNode* src = edge->getSrcNode();
     SVFGNode* dst = edge->getDstNode();
     // If this is an actual-param or formal-ret, top-level pointer's pts must be
     // propagated from src to dst.
     if (ActualParmSVFGNode* ap = SVFUtil::dyn_cast<ActualParmSVFGNode>(src))
     {
         if (!ap->getParam()->isPointer()) return false;
         changed = propagateFromAPToFP(ap, dst);
     }
     else if (FormalRetSVFGNode* fp = SVFUtil::dyn_cast<FormalRetSVFGNode>(src))
     {
         if (!fp->getRet()->isPointer()) return false;
         changed = propagateFromFRToAR(fp, dst);
     }
     else
     {
         // Direct SVFG edge links between def and use of a top-level pointer.
         // There's no points-to information propagated along direct edge.
         // Since the top-level pointer's value has been changed at src node,
         // return TRUE to put dst node into the work list.
         changed = true;
     }
 
     double end = stat->getClk();
     directPropaTime += (end - start) / TIMEINTERVAL;
     return changed;
 }

◆ propAlongIndirectEdge()

bool FlowSensitiveTBHC::propAlongIndirectEdge ( const IndirectSVFGEdge * edge )

overridevirtual

Propagate points-to information along an INDIRECT SVFG edge.

Propagate points-to information along INDIRECT SVFG edge.

If this is a field-insensitive obj, propagate all field node's pts

Reimplemented from SVF::FlowSensitive.

Definition at line 90 of file FlowSensitiveTBHC.cpp.

 {
     SVFGNode* src = edge->getSrcNode();
     SVFGNode* dst = edge->getDstNode();
 
     bool changed = false;
 
     // Get points-to targets may be used by next SVFG node.
     // Propagate points-to set for node used in dst.
     const PointsTo& pts = edge->getPointsTo();
 
     // Since the base Andersen's analysis does NOT perform type-based heap cloning,
     // it uses only the base objects; we want to account for clones too.
     PointsTo edgePtsAndClones;
 
     // TODO: the conditional bool may be unnecessary.
     // Adding all clones is redundant, and introduces too many calls to propVarPts...
     // This introduces performance and precision penalties.
     // We should filter out according to src.
     bool isStore = false;
     const DIType *tildet = nullptr;
     PointsTo storePts;
     if (const StoreSVFGNode *store = SVFUtil::dyn_cast<StoreSVFGNode>(src))
     {
         tildet = getTypeFromCTirMetadata(store);
         isStore = true;
         storePts = getPts(store->getPAGDstNodeID());
     }
 
     const PointsTo &filterSet = getFilterSet(src->getId());
     for (NodeID o : pts)
     {
         if (!filterSet.test(o))
         {
             edgePtsAndClones.set(o);
         }
 
         for (NodeID c : getClones(o))
         {
             if (!isStore)
             {
                 if (!filterSet.test(c))
                 {
                     edgePtsAndClones.set(c);
                 }
             }
             else
             {
                 if (storePts.test(c) && !filterSet.test(c))
                 {
                     edgePtsAndClones.set(c);
                 }
             }
         }
 
         if (GepObjPN *gep = SVFUtil::dyn_cast<GepObjPN>(pag->getPAGNode(o)))
         {
             // Want the geps which are at the same "level" as this one (same mem obj, same offset).
             const NodeBS &geps = getGepObjsFromMemObj(gep->getMemObj(), gep->getLocationSet().getOffset());
             for (NodeID g : geps)
             {
                 const DIType *gepType = getType(g);
                 if (!isStore || gepType || isBase(tildet, gepType))
                 {
                     if (!filterSet.test(g))
                     {
                         edgePtsAndClones.set(g);
                     }
                 }
             }
         }
     }
 
     for (NodeID o : edgePtsAndClones)
     {
         if (propVarPtsFromSrcToDst(o, src, dst))
             changed = true;
 
         if (isFIObjNode(o))
         {
             const NodeBS &allFields = getAllFieldsObjNode(o);
             for (NodeID f : allFields)
             {
                 if (propVarPtsFromSrcToDst(f, src, dst))
                     changed = true;
             }
         }
     }
 
     return changed;
 }

◆ propDFInToIn()

bool FlowSensitiveTBHC::propDFInToIn	(	const SVFGNode *	srcStmt,
		NodeID	srcVar,
		const SVFGNode *	dstStmt,
		NodeID	dstVar
	)

inlineoverridevirtual

Reimplemented from SVF::FlowSensitive.

Definition at line 562 of file FlowSensitiveTBHC.cpp.

 {
     // IN sets are only based on the original object.
     return getDFPTDataTy()->updateAllDFInFromIn(srcStmt->getId(), getOriginalObj(srcVar),
             dstStmt->getId(), getOriginalObj(dstVar));
 }

◆ propDFOutToIn()

bool FlowSensitiveTBHC::propDFOutToIn	(	const SVFGNode *	srcStmt,
		NodeID	srcVar,
		const SVFGNode *	dstStmt,
		NodeID	dstVar
	)

inlineoverridevirtual

Reimplemented from SVF::FlowSensitive.

Definition at line 569 of file FlowSensitiveTBHC.cpp.

 {
     // OUT/IN sets only have original objects.
     return getDFPTDataTy()->updateAllDFInFromOut(srcStmt->getId(), getOriginalObj(srcVar),
             dstStmt->getId(), getOriginalObj(dstVar));
 }

◆ PTAName()

virtual const std::string SVF::FlowSensitiveTBHC::PTAName ( ) const

inlineoverridevirtual

Get PTA name.

Reimplemented from SVF::FlowSensitive.

Definition at line 48 of file FlowSensitiveTBHC.h.

     {
         return "FSTBHC";
     }

◆ unionPtsFromIn()

bool FlowSensitiveTBHC::unionPtsFromIn	(	const SVFGNode *	stmt,
		NodeID	srcVar,
		NodeID	dstVar
	)

inlineoverridevirtual

Reimplemented from SVF::FlowSensitive.

Definition at line 550 of file FlowSensitiveTBHC.cpp.

 {
     // IN sets only have original objects.
     return getDFPTDataTy()->updateTLVPts(stmt->getId(), getOriginalObj(srcVar), dstVar);
 }

◆ unionPtsFromTop()

bool FlowSensitiveTBHC::unionPtsFromTop	(	const SVFGNode *	stmt,
		NodeID	srcVar,
		NodeID	dstVar
	)

inlineoverridevirtual

Reimplemented from SVF::FlowSensitive.

Definition at line 556 of file FlowSensitiveTBHC.cpp.

 {
     // OUT sets only have original objects.
     return getDFPTDataTy()->updateATVPts(srcVar, stmt->getId(), getOriginalObj(dstVar));
 }

◆ updateInFromIn()

bool FlowSensitiveTBHC::updateInFromIn	(	const SVFGNode *	srcStmt,
		NodeID	srcVar,
		const SVFGNode *	dstStmt,
		NodeID	dstVar
	)

inlineoverridevirtual

Reimplemented from SVF::FlowSensitive.

Definition at line 536 of file FlowSensitiveTBHC.cpp.

 {
     // IN sets are only based on the original object.
     return getDFPTDataTy()->updateDFInFromIn(srcStmt->getId(), getOriginalObj(srcVar),
             dstStmt->getId(), getOriginalObj(dstVar));
 }

◆ updateInFromOut()

bool FlowSensitiveTBHC::updateInFromOut	(	const SVFGNode *	srcStmt,
		NodeID	srcVar,
		const SVFGNode *	dstStmt,
		NodeID	dstVar
	)

inlineoverridevirtual

Reimplemented from SVF::FlowSensitive.

Definition at line 543 of file FlowSensitiveTBHC.cpp.

 {
     // OUT/IN sets only have original objects.
     return getDFPTDataTy()->updateDFInFromOut(srcStmt->getId(), getOriginalObj(srcVar),
             dstStmt->getId(), getOriginalObj(dstVar));
 }

Member Data Documentation

◆ allReuse

bool SVF::FlowSensitiveTBHC::allReuse

private

Whether to allow reuse at all instructions (load/store/field). allReuse => storeReuse.

Definition at line 111 of file FlowSensitiveTBHC.h.

◆ gepToSVFGRetrievers

Map<NodeID, NodeBS> SVF::FlowSensitiveTBHC::gepToSVFGRetrievers

private

Maps GEP objects to the SVFG nodes that retrieved them with getGepObjClones.

Definition at line 114 of file FlowSensitiveTBHC.h.

◆ loadGeps

NodeBS SVF::FlowSensitiveTBHC::loadGeps

private

Maps whether a (SVFG) GEP node is a load or not.

Definition at line 116 of file FlowSensitiveTBHC.h.

◆ storeReuse

bool SVF::FlowSensitiveTBHC::storeReuse

private

Whether to allow for reuse at stores.

Definition at line 108 of file FlowSensitiveTBHC.h.

The documentation for this class was generated from the following files:

/home/runner/work/SVF-1/SVF-1/include/WPA/FlowSensitiveTBHC.h
/home/runner/work/SVF-1/SVF-1/lib/WPA/FlowSensitiveTBHC.cpp

Public Member Functions

Static Public Member Functions

Protected Member Functions

Private Member Functions

Private Attributes

Additional Inherited Members

Detailed Description

Constructor & Destructor Documentation

◆ FlowSensitiveTBHC()

◆ ~FlowSensitiveTBHC()

Member Function Documentation

◆ analyze()

◆ backPropagate()

◆ classof() [1/2]

◆ classof() [2/2]

◆ countAliases()

◆ determineWhichGepsAreLoads()

◆ expandFIObjs()

◆ finalize()

◆ gepIsLoad()

◆ getAllFieldsObjNode()

◆ getRawCTirMetadata()

◆ getTypeFromCTirMetadata()

◆ initialize()

◆ processAddr()

◆ processCopy()

◆ processGep()

◆ processLoad()

◆ processPhi()

◆ processStore()

◆ propAlongDirectEdge()

◆ propAlongIndirectEdge()

◆ propDFInToIn()

◆ propDFOutToIn()

◆ PTAName()

◆ unionPtsFromIn()

◆ unionPtsFromTop()

◆ updateInFromIn()

◆ updateInFromOut()

Member Data Documentation

◆ allReuse

◆ gepToSVFGRetrievers

◆ loadGeps

◆ storeReuse