Static Value-Flow Analysis
|
#include <MemRegion.h>
Protected Member Functions | |
MRGenerator (BVDataPTAImpl *p, bool ptrOnly) | |
void | createMR (const SVFFunction *fun, const NodeBS &cpts) |
Generate a memory region and put in into functions which use it. | |
void | collectGlobals () |
Collect all global variables for later escape analysis. | |
virtual void | collectModRefForLoadStore () |
Generate regions for loads/stores. | |
virtual void | collectModRefForCall () |
Generate regions for calls/rets. | |
virtual void | partitionMRs () |
Partition regions. | |
virtual void | updateAliasMRs () |
Update aliased regions for loads/stores/callsites. | |
virtual void | sortPointsTo (const NodeBS &cpts) |
Given a condition pts, insert into cptsToRepCPtsMap for region generation. | |
virtual bool | isAliasedMR (const NodeBS &cpts, const MemRegion *mr) |
Whether a region is aliased with a conditional points-to. | |
virtual void | getAliasMemRegions (MRSet &aliasMRs, const NodeBS &cpts, const SVFFunction *fun) |
Get all aliased mem regions from function fun according to cpts. | |
virtual void | getMRsForLoad (MRSet &aliasMRs, const NodeBS &cpts, const SVFFunction *) |
Get memory regions for a load statement according to cpts. | |
virtual void | getMRsForCallSiteRef (MRSet &aliasMRs, const NodeBS &cpts, const SVFFunction *) |
Get memory regions for call site ref according to cpts. | |
virtual void | modRefAnalysis (PTACallGraphNode *callGraphNode, WorkList &worklist) |
Mod-Ref analysis for callsite invoking this callGraphNode. | |
virtual bool | handleCallsiteModRef (NodeBS &mod, NodeBS &ref, const CallICFGNode *cs, const SVFFunction *fun) |
Get Mod-Ref of a callee function. | |
void | addCPtsToStore (NodeBS &cpts, const StoreStmt *st, const SVFFunction *fun) |
Add cpts to store/load. | |
void | addCPtsToLoad (NodeBS &cpts, const LoadStmt *ld, const SVFFunction *fun) |
void | addCPtsToCallSiteRefs (NodeBS &cpts, const CallICFGNode *cs) |
void | addCPtsToCallSiteMods (NodeBS &cpts, const CallICFGNode *cs) |
bool | hasCPtsList (const SVFFunction *fun) const |
PointsToList & | getPointsToList (const SVFFunction *fun) |
FunToPointsTosMap & | getFunToPointsToList () |
void | addRefSideEffectOfFunction (const SVFFunction *fun, const NodeBS &refs) |
Add/Get methods for side-effect of functions and callsites. | |
void | addModSideEffectOfFunction (const SVFFunction *fun, const NodeBS &mods) |
Add indirect def an memory object in the function. | |
bool | addRefSideEffectOfCallSite (const CallICFGNode *cs, const NodeBS &refs) |
Add indirect uses an memory object in the function. | |
bool | addModSideEffectOfCallSite (const CallICFGNode *cs, const NodeBS &mods) |
Add indirect def an memory object in the function. | |
const NodeBS & | getRefSideEffectOfFunction (const SVFFunction *fun) |
Get indirect refs of a function. | |
const NodeBS & | getModSideEffectOfFunction (const SVFFunction *fun) |
Get indirect mods of a function. | |
const NodeBS & | getRefSideEffectOfCallSite (const CallICFGNode *cs) |
Get indirect refs of a callsite. | |
const NodeBS & | getModSideEffectOfCallSite (const CallICFGNode *cs) |
Get indirect mods of a callsite. | |
bool | hasRefSideEffectOfCallSite (const CallICFGNode *cs) |
Has indirect refs of a callsite. | |
bool | hasModSideEffectOfCallSite (const CallICFGNode *cs) |
Has indirect mods of a callsite. | |
Protected Attributes | |
MRSet | memRegSet |
A set of All memory regions. | |
PtsToRepPtsSetMap | cptsToRepCPtsMap |
Map a condition pts to its rep conditional pts (super set points-to) | |
Private Member Functions | |
void | destroy () |
Clean up memory. | |
void | collectCallSitePts (const CallICFGNode *cs) |
NodeBS & | CollectPtsChain (NodeID id) |
NodeBS & | getCallSiteArgsPts (const CallICFGNode *cs) |
Return the pts chain of all callsite arguments. | |
NodeBS & | getCallSiteRetPts (const CallICFGNode *cs) |
Return the pts chain of the return parameter of the callsite. | |
bool | isNonLocalObject (NodeID id, const SVFFunction *curFun) const |
void | getEscapObjviaGlobals (NodeBS &globs, const NodeBS &pts) |
Get all the objects in callee's modref escaped via global objects (the chain pts of globals) | |
void | getCallGraphSCCRevTopoOrder (WorkList &worklist) |
Get reverse topo call graph scc. | |
Private Attributes | |
BVDataPTAImpl * | pta |
SCC * | callGraphSCC |
PTACallGraph * | callGraph |
bool | ptrOnlyMSSA |
FunToMRsMap | funToMRsMap |
Map a function to all its memory regions. | |
LoadsToMRsMap | loadsToMRsMap |
Map a load SVFIR Edge to its memory regions sets in order for inserting mus in Memory SSA. | |
StoresToMRsMap | storesToMRsMap |
Map a store SVFIR Edge to its memory regions sets in order for inserting chis in Memory SSA. | |
CallSiteToMRsMap | callsiteToRefMRsMap |
Map a callsite to its refs regions. | |
CallSiteToMRsMap | callsiteToModMRsMap |
Map a callsite to its mods regions. | |
LoadsToPointsToMap | loadsToPointsToMap |
Map a load SVFIR Edge to its CPts set map. | |
StoresToPointsToMap | storesToPointsToMap |
Map a store SVFIR Edge to its CPts set map. | |
CallSiteToPointsToMap | callsiteToRefPointsToMap |
Map a callsite to it refs cpts set. | |
CallSiteToPointsToMap | callsiteToModPointsToMap |
Map a callsite to it mods cpts set. | |
FunToPointsTosMap | funToPointsToMap |
Map a function to all of its conditional points-to sets. | |
PAGEdgeToFunMap | pagEdgeToFunMap |
Map a PAGEdge to its fun. | |
FunToPointsToMap | funToRefsMap |
Map a function to its indirect uses of memory objects. | |
FunToPointsToMap | funToModsMap |
Map a function to its indirect defs of memory objects. | |
CallSiteToPointsToMap | csToRefsMap |
Map a callsite to its indirect uses of memory objects. | |
CallSiteToPointsToMap | csToModsMap |
Map a callsite to its indirect defs of memory objects. | |
CallSiteToPointsToMap | csToCallSiteArgsPtsMap |
Map a callsite to all its object might pass into its callees. | |
CallSiteToPointsToMap | csToCallSiteRetPtsMap |
Map a callsite to all its object might return from its callees. | |
NodeToPTSSMap | cachedPtsChainMap |
Map a pointer to its cached points-to chain;. | |
NodeBS | allGlobals |
All global variable SVFIR node ids. | |
Memory Region Partitioning
Definition at line 131 of file MemRegion.h.
Definition at line 155 of file MemRegion.h.
Map a callsite to its indirect refs/mods of memory objects.
Definition at line 170 of file MemRegion.h.
Definition at line 162 of file MemRegion.h.
Map a function to its region set.
Definition at line 149 of file MemRegion.h.
Maps Mod-Ref analysis.
Map a function to its indirect refs/mods of memory objects
Definition at line 168 of file MemRegion.h.
Definition at line 144 of file MemRegion.h.
Definition at line 145 of file MemRegion.h.
Map loads/stores to its mem regions, TODO:visitAtomicCmpXchgInst, visitAtomicRMWInst??
Definition at line 153 of file MemRegion.h.
Map loads/stores/callsites to their cpts set.
Definition at line 160 of file MemRegion.h.
Get typedef from Pointer Analysis.
Define mem region set
Definition at line 141 of file MemRegion.h.
Definition at line 173 of file MemRegion.h.
Definition at line 142 of file MemRegion.h.
Definition at line 143 of file MemRegion.h.
Definition at line 146 of file MemRegion.h.
Call Graph SCC.
Definition at line 178 of file MemRegion.h.
Definition at line 154 of file MemRegion.h.
Definition at line 161 of file MemRegion.h.
SVFIR edge list.
Definition at line 176 of file MemRegion.h.
Definition at line 135 of file MemRegion.h.
|
protected |
Definition at line 42 of file MemRegion.cpp.
|
inlinevirtual |
|
inlineprotected |
Definition at line 358 of file MemRegion.h.
|
inlineprotected |
Definition at line 353 of file MemRegion.h.
|
inlineprotected |
Definition at line 347 of file MemRegion.h.
|
inlineprotected |
Add cpts to store/load.
Definition at line 341 of file MemRegion.h.
|
protected |
Add indirect def an memory object in the function.
Add indirect def an memory object in the function
Definition at line 445 of file MemRegion.cpp.
|
protected |
Add indirect def an memory object in the function.
Add indirect def an memory object in the function
Definition at line 417 of file MemRegion.cpp.
|
protected |
Add indirect uses an memory object in the function.
Add indirect uses an memory object in the function
Definition at line 429 of file MemRegion.cpp.
|
protected |
Add/Get methods for side-effect of functions and callsites.
Add indirect uses an memory object in the function
Definition at line 405 of file MemRegion.cpp.
|
private |
Get all objects might pass into and pass out of callee(s) from a callsite
collect the pts chain of the callsite arguments
collect the pts chain of the return argument
Definition at line 477 of file MemRegion.cpp.
|
protected |
Collect all global variables for later escape analysis.
Collect globals for escape analysis
Definition at line 105 of file MemRegion.cpp.
|
protectedvirtual |
Generate regions for calls/rets.
Generate memory regions for calls
collect points-to information for callsites
handle all sub scc nodes of this rep node
Get mod-ref of all callsites calling callGraphNode
mods are treated as both def and use of memory objects
Definition at line 227 of file MemRegion.cpp.
|
protectedvirtual |
Generate regions for loads/stores.
Generate memory regions for loads/stores
if this function does not have any caller, then we do not care its MSSA
Definition at line 174 of file MemRegion.cpp.
Recursively collect all points-to of the whole struct fields
Definition at line 525 of file MemRegion.cpp.
|
protected |
Generate a memory region and put in into functions which use it.
Generate a memory region and put in into functions which use it
Definition at line 70 of file MemRegion.cpp.
|
private |
|
virtual |
Start generating memory regions.
Generate memory regions according to pointer analysis results Attach regions on loads/stores
collect mod-ref for loads/stores
collect mod-ref for calls
Partition memory regions
attach memory regions for loads/stores/calls
Definition at line 125 of file MemRegion.cpp.
|
inlineprotectedvirtual |
Get all aliased mem regions from function fun according to cpts.
Definition at line 309 of file MemRegion.h.
|
private |
Get reverse topo call graph scc.
Get the reverse topo order of scc call graph
Definition at line 462 of file MemRegion.cpp.
|
inlineprivate |
Return the pts chain of all callsite arguments.
Definition at line 255 of file MemRegion.h.
|
inline |
Definition at line 467 of file MemRegion.h.
|
inline |
Definition at line 463 of file MemRegion.h.
|
inlineprivate |
Return the pts chain of the return parameter of the callsite.
Definition at line 260 of file MemRegion.h.
Get all the objects in callee's modref escaped via global objects (the chain pts of globals)
Get all the objects in callee's modref escaped via global objects (the chain pts of globals) Otherwise, the object in callee's modref would not escape through globals
Definition at line 559 of file MemRegion.cpp.
|
inline |
|
inline |
Get Memory Region set.
Definition at line 443 of file MemRegion.h.
|
inlineprotected |
Definition at line 371 of file MemRegion.h.
Definition at line 447 of file MemRegion.h.
NodeBS MRGenerator::getModInfoForCall | ( | const CallICFGNode * | cs | ) |
getModRefInfo APIs
Collect mod ref for external callsite other than heap alloc external call
Obtain the mod sets for a call, used for external ModRefInfo queries
Definition at line 670 of file MemRegion.cpp.
ModRefInfo MRGenerator::getModRefInfo | ( | const CallICFGNode * | cs | ) |
Determine whether a CallSite instruction can mod or ref any memory location
Definition at line 719 of file MemRegion.cpp.
ModRefInfo MRGenerator::getModRefInfo | ( | const CallICFGNode * | cs, |
const SVFValue * | V | ||
) |
Determine whether a const CallICFGNode* instruction can mod or ref a specific memory location pointed by V
Definition at line 738 of file MemRegion.cpp.
ModRefInfo MRGenerator::getModRefInfo | ( | const CallICFGNode * | cs1, |
const CallICFGNode * | cs2 | ||
) |
Determine mod-ref relations between two const CallICFGNode* instructions
return NoModRef neither two callsites ref or mod any memory
Ref: cs1 ref memory mod by cs2
Mod: cs1 mod memory ref or mod by cs2
ModRef: cs1 ref and mod memory mod by cs2
Definition at line 772 of file MemRegion.cpp.
|
inlineprotected |
Get indirect mods of a callsite.
Definition at line 403 of file MemRegion.h.
|
inlineprotected |
Get indirect mods of a function.
Definition at line 393 of file MemRegion.h.
Get a memory region according to cpts.
Generate a memory region and put in into functions which use it
Definition at line 93 of file MemRegion.cpp.
|
inline |
Definition at line 420 of file MemRegion.h.
|
inline |
Definition at line 180 of file MemRegion.h.
|
inlineprotectedvirtual |
Get memory regions for call site ref according to cpts.
Reimplemented in SVF::DistinctMRG, and SVF::IntraDisjointMRG.
Definition at line 326 of file MemRegion.h.
|
inlineprotectedvirtual |
Get memory regions for a load statement according to cpts.
Reimplemented in SVF::InterDisjointMRG, SVF::DistinctMRG, and SVF::IntraDisjointMRG.
Definition at line 319 of file MemRegion.h.
SVFIR::SVFStmtList & MRGenerator::getPAGEdgesFromInst | ( | const ICFGNode * | node | ) |
Given an instruction, get all its the PAGEdge (statement) in sequence.
Definition at line 161 of file MemRegion.cpp.
|
inlineprotected |
Definition at line 367 of file MemRegion.h.
NodeBS MRGenerator::getRefInfoForCall | ( | const CallICFGNode * | cs | ) |
Obtain the ref sets for a call, used for external ModRefInfo queries
Definition at line 694 of file MemRegion.cpp.
|
inlineprotected |
Get indirect refs of a callsite.
Definition at line 398 of file MemRegion.h.
|
inlineprotected |
Get indirect refs of a function.
Definition at line 388 of file MemRegion.h.
Get superset cpts set.
Definition at line 186 of file MemRegion.h.
Definition at line 451 of file MemRegion.h.
|
protectedvirtual |
Get Mod-Ref of a callee function.
Get Mod-Ref of a callee function
if a callee is a heap allocator function, then its mod set of this callsite is the heap object.
otherwise, we find the mod/ref sets from the callee function, who has definition and been processed
Definition at line 603 of file MemRegion.cpp.
|
inlineprotected |
Definition at line 363 of file MemRegion.h.
|
inline |
Definition at line 459 of file MemRegion.h.
|
inlineprotected |
Has indirect mods of a callsite.
Definition at line 413 of file MemRegion.h.
|
inline |
Definition at line 455 of file MemRegion.h.
|
inlineprotected |
Has indirect refs of a callsite.
Definition at line 408 of file MemRegion.h.
Whether this instruction has SVFIR Edge.
Definition at line 151 of file MemRegion.cpp.
|
inlineprotectedvirtual |
Whether a region is aliased with a conditional points-to.
Definition at line 304 of file MemRegion.h.
|
private |
Whether the object node is a non-local object including global, heap, and stack variable in recursions
if the object is heap or global
or if the local variable of its callers or a local variable is in function recursion cycles
Definition at line 575 of file MemRegion.cpp.
|
protectedvirtual |
Mod-Ref analysis for callsite invoking this callGraphNode.
Call site mod-ref analysis Compute mod-ref of all callsites invoking this call graph node
add ref/mod set of callee to its invocation callsites at caller
handle direct callsites
handle indirect callsites
Definition at line 635 of file MemRegion.cpp.
|
protectedvirtual |
Partition regions.
Partition memory regions
Compute all superset of all condition points-to sets TODO: we may need some refined region partitioning algorithm here For now, we just collapse all refs/mods objects at callsites into one region Consider modularly partition memory regions to speed up analysis (only partition regions within function scope)
Generate memory regions according to condition pts after computing superset
Reimplemented in SVF::DistinctMRG, SVF::IntraDisjointMRG, and SVF::InterDisjointMRG.
Definition at line 315 of file MemRegion.cpp.
Given a condition pts, insert into cptsToRepCPtsMap for region generation.
Given a condition pts, insert into cptsToRepCPtsMap Always map it to its superset(rep) cpts according to existing items 1) map cpts to its superset(rep) which exists in the map, otherwise its superset is itself 2) adjust existing items in the map if their supersets are cpts
Definition at line 282 of file MemRegion.cpp.
|
protectedvirtual |
Update aliased regions for loads/stores/callsites.
Update aliased regions for loads/stores/callsites
update stores with its aliased regions
update callsites with its aliased regions
Definition at line 346 of file MemRegion.cpp.
|
private |
All global variable SVFIR node ids.
Definition at line 243 of file MemRegion.h.
|
private |
Map a pointer to its cached points-to chain;.
Definition at line 240 of file MemRegion.h.
|
private |
Definition at line 199 of file MemRegion.h.
|
private |
Definition at line 198 of file MemRegion.h.
|
private |
Map a callsite to its mods regions.
Definition at line 211 of file MemRegion.h.
|
private |
Map a callsite to it mods cpts set.
Definition at line 219 of file MemRegion.h.
|
private |
Map a callsite to its refs regions.
Definition at line 209 of file MemRegion.h.
|
private |
Map a callsite to it refs cpts set.
Definition at line 217 of file MemRegion.h.
|
protected |
Map a condition pts to its rep conditional pts (super set points-to)
Definition at line 280 of file MemRegion.h.
|
private |
Map a callsite to all its object might pass into its callees.
Definition at line 235 of file MemRegion.h.
|
private |
Map a callsite to all its object might return from its callees.
Definition at line 237 of file MemRegion.h.
|
private |
Map a callsite to its indirect defs of memory objects.
Definition at line 233 of file MemRegion.h.
|
private |
Map a callsite to its indirect uses of memory objects.
Definition at line 231 of file MemRegion.h.
|
private |
Map a function to its indirect defs of memory objects.
Definition at line 229 of file MemRegion.h.
|
private |
Map a function to all its memory regions.
Definition at line 203 of file MemRegion.h.
|
private |
Map a function to all of its conditional points-to sets.
Definition at line 222 of file MemRegion.h.
|
private |
Map a function to its indirect uses of memory objects.
Definition at line 227 of file MemRegion.h.
|
private |
Map a load SVFIR Edge to its memory regions sets in order for inserting mus in Memory SSA.
Definition at line 205 of file MemRegion.h.
|
private |
Map a load SVFIR Edge to its CPts set map.
Definition at line 213 of file MemRegion.h.
|
protected |
A set of All memory regions.
Definition at line 278 of file MemRegion.h.
|
private |
Map a PAGEdge to its fun.
Definition at line 224 of file MemRegion.h.
|
private |
Definition at line 197 of file MemRegion.h.
|
private |
Definition at line 200 of file MemRegion.h.
|
private |
Map a store SVFIR Edge to its memory regions sets in order for inserting chis in Memory SSA.
Definition at line 207 of file MemRegion.h.
|
private |
Map a store SVFIR Edge to its CPts set map.
Definition at line 215 of file MemRegion.h.