SVF::MultiStageSlicer Class Reference

#include <MTASlicer.h>

Inheritance diagram for SVF::MultiStageSlicer:

Public Member Functions
	MultiStageSlicer (SVFIR *svfIr, AndersenBase *pta, MHP *mhp, LockAnalysis *lockAnalysis, SVFG *vfg=nullptr)
OrderedSet< const ICFGNode * >	runILASlicing (const OrderedSet< const SVFStmt * > &vulnerableStatements, const OrderedSet< const ICFGNode * > &threadVFSources={})
OrderedSet< const ICFGNode * >	runPTASlicing (const OrderedSet< const SVFStmt * > &vulnerableStatements)
const OrderedSet< const VFGNode * > &	getRetainedSVFGNodes (const OrderedSet< const SVFStmt * > &vulnerableStatements)
Public Member Functions inherited from SVF::MTASlicerBase
	MTASlicerBase (SVFIR *svfIr, AndersenBase *pta, MHP *mhp, LockAnalysis *lockAnalysis, SVFG *vfg=nullptr)
virtual	~MTASlicerBase ()

Private Attributes
OrderedSet< const VFGNode * >	retainedSVFGNodes
	memoised data-dependence slice
bool	retainedComputed = false

Additional Inherited Members
Protected Member Functions inherited from SVF::MTASlicerBase
OrderedSet< const ICFGNode * >	sliceDataDependenceOverVFG (const OrderedSet< const SVFStmt * > &seeds, SVFG *vfg)
OrderedSet< const VFGNode * >	computeDataDependenceSVFGNodes (const OrderedSet< const SVFStmt * > &seeds, SVFG *vfg)
OrderedSet< const ICFGNode * >	svfgNodesToICFGNodes (const OrderedSet< const VFGNode * > &nodes, const OrderedSet< const SVFStmt * > &seeds)
	Project the retained VFG nodes (plus the seeds) onto their ICFG nodes.
OrderedSet< const SVFStmt * >	getDependentThreadCreate (const SVFStmt *stmt)
OrderedSet< const TCTNode * >	getTCTNodeSetFromNode (const ICFGNode *node)
OrderedSet< const ICFGNode * >	getLockSet (const ICFGNode *node)
OrderedSet< const CallICFGNode * >	collectPthreadStatements (const OrderedSet< const SVFStmt * > &vulnerableStmts)
OrderedSet< const CallICFGNode * >	collectMutexStatements (const OrderedSet< const SVFStmt * > &vulnerableStmts)
std::pair< OrderedSet< const CallICFGNode * >, OrderedSet< const CallICFGNode * > >	collectCommonThreadStatements (const OrderedSet< const SVFStmt * > &vulnerableStatements)
OrderedSet< const ICFGNode * >	buildBackwardICFGNodeSet (const OrderedSet< const ICFGNode * > &vulnerableNodes)
OrderedSet< const ICFGNode * >	expandCallDependence (const OrderedSet< const ICFGNode * > &nodes)
OrderedSet< const ICFGNode * >	runDualSlicing (const OrderedSet< const ICFGNode * > &slicedNodes)
Protected Attributes inherited from SVF::MTASlicerBase
SVFIR *	svfIr
AndersenBase *	pta
MHP *	mhp
LockAnalysis *	lockAnalysis
CallGraph *	callGraph
SVFG *	vfg
	thread-aware VFG_pre (PTA/Single slicers; null for MTA)

Detailed Description

MultiStageSlicer - the multi-stage (differential) slicer of MSli: one class, two stages sharing one memoised data-dependence closure over VFG_pre. Stage 1 (ILA): runILASlicing – synchronization/dual slicing + function expansion, feeding the sliced MHP/lock. Stage 2 (FSPTA): runPTASlicing – backward data-dependence slice feeding the sliced flow-sensitive solve. Contrast: SingleSlicer below folds everything into ONE unified slice.

Definition at line 207 of file MTASlicer.h.

Constructor & Destructor Documentation

MultiStageSlicer()

SVF::MultiStageSlicer::MultiStageSlicer	(	SVFIR *	svfIr,
		AndersenBase *	pta,
		MHP *	mhp,
		LockAnalysis *	lockAnalysis,
		SVFG *	vfg = nullptr
	)

Definition at line 942 of file MTASlicer.cpp.

    : MTASlicerBase(svfIr, pta, mhp, lockAnalysis, vfg)
{
}

Member Function Documentation

getRetainedSVFGNodes()

const OrderedSet< const SVFGNode * > & SVF::MultiStageSlicer::getRetainedSVFGNodes

(

const OrderedSet< const SVFStmt * > &

vulnerableStatements

)

The FSPTA data-dependence slice at SVFG-node granularity (memoised). The ILA stage queries this first, to restrict the [THREAD-VF] sources to ThreadVF(VFG'_pre); runPTASlicing reuses the same set, so the backward closure over VFG_pre is computed once and shared across both stages.

Definition at line 1010 of file MTASlicer.cpp.

{
    if (!retainedComputed)
    {
        retainedSVFGNodes = computeDataDependenceSVFGNodes(vulnerableStatements, vfg);
        retainedComputed = true;
    }
    return retainedSVFGNodes;
}

runILASlicing()

OrderedSet< const ICFGNode * > SVF::MultiStageSlicer::runILASlicing	(	const OrderedSet< const SVFStmt * > &	vulnerableStatements,
		const OrderedSet< const ICFGNode * > &	threadVFSources = {}
	)

Stage 1: the ILA slice (dual slicing + function expansion for the IRView).

Parameters

vulnerableStatements	Set of vulnerable statements to start slicing from (the [INIT] rule: pre-analysis race statements).
threadVFSources	Extra ILA slicing sources from the [THREAD-VF] rule (MSli 4.2): statements whose MHP/lock-span results are queried during the main-phase thread-aware value-flow construction (endpoints and in-span non-interference witnesses collected while building VFG_pre).

Returns

Set of ICFG nodes in the slice (including call/ret and entry/exit nodes)

Definition at line 949 of file MTASlicer.cpp.

{
 
    // Step 1: Collect common pthread and mutex statements
    auto commonStmts = collectCommonThreadStatements(vulnerableStatements);
    const OrderedSet<const CallICFGNode*>& pthreadCallNodes = commonStmts.first;
    const OrderedSet<const CallICFGNode*>& mutexCallNodes = commonStmts.second;
 
    // Step 2: Form initial slice result (before function expansion). The ILA
    // slicing sources are the [INIT] race statements plus the [THREAD-VF]
    // sources (MSli §4.2) extracted while building VFG_pre: the endpoints and
    // in-span lock witnesses queried during main-phase value-flow construction.
    OrderedSet<const ICFGNode*> initialSliceResult;
    initialSliceResult.insert(pthreadCallNodes.begin(), pthreadCallNodes.end());
    for (const CallICFGNode* pthreadCallNode : pthreadCallNodes)
    {
        initialSliceResult.insert(pthreadCallNode->getRetICFGNode());
    }
    initialSliceResult.insert(mutexCallNodes.begin(), mutexCallNodes.end());
    for (const CallICFGNode* mutexCallNode : mutexCallNodes)
    {
        initialSliceResult.insert(mutexCallNode->getRetICFGNode());
    }
    collectLockFunctionMarkers(mutexCallNodes, initialSliceResult);
    for (const SVFStmt* stmt: vulnerableStatements)
    {
        initialSliceResult.insert(stmt->getICFGNode());
    }
    initialSliceResult.insert(threadVFSources.begin(), threadVFSources.end());
 
    // Retain loop-exit entry anchors. MHP seeds post-join interleaving directly at
    // the loop-exit block entry of each join in a loop; keeping those entries makes
    // the seed land on a kept node, so no runtime seed projection is needed. Reuses
    // the shared FunObjVar::getExitBlocksOfLoop.
    ThreadAPI* threadAPI = mhp->getThreadCallGraph()->getThreadAPI();
    for (const CallICFGNode* c : pthreadCallNodes)
    {
        if (!threadAPI->isTDJoin(c) || c->getBB() == nullptr) continue;
        std::vector<const SVFBasicBlock*> exitbbs;
        c->getFun()->getExitBlocksOfLoop(c->getBB(), exitbbs);
        for (const SVFBasicBlock* eb : exitbbs)
            if (!eb->getICFGNodeList().empty())
                initialSliceResult.insert(eb->front());
    }
 
    // Step 3: Perform dual slicing (temporal slicing)
    OrderedSet<const ICFGNode*> dualSlicedNodes = runDualSlicing(initialSliceResult);
 
    // Step 4: Expand keptNodes to include call/ret nodes and function entry/exit
    // nodes (call dependence).
    return expandCallDependence(dualSlicedNodes);
}

runPTASlicing()

OrderedSet< const ICFGNode * > SVF::MultiStageSlicer::runPTASlicing

(

const OrderedSet< const SVFStmt * > &

vulnerableStatements

)

Stage 2: the FSPTA slice (backward data dependence over the thread-aware VFG_pre; node set only, no function expansion).

Definition at line 1022 of file MTASlicer.cpp.

{
 
    // Step 1: paper-faithful (§4.3) data-dependence slice over the thread-aware
    // SVFG built once in pre-analysis (reusing the memoised SVFG-node closure).
    OrderedSet<const ICFGNode*> initialSliceResult =
        svfgNodesToICFGNodes(getRetainedSVFGNodes(vulnerableStatements), vulnerableStatements);
 
    // Retain the lock/unlock-function control-flow markers the sliced lock
    // analysis depends on (see collectLockFunctionMarkers); the data-dependence
    // SVFG slice does not otherwise keep them.
    collectLockFunctionMarkers(collectMutexStatements(vulnerableStatements), initialSliceResult);
 
    // Step 2: Perform dual slicing (temporal slicing)
    OrderedSet<const ICFGNode*> dualSlicedNodes = runDualSlicing(initialSliceResult);
 
    return dualSlicedNodes;
}

Member Data Documentation

retainedComputed

bool SVF::MultiStageSlicer::retainedComputed = false

private

Definition at line 245 of file MTASlicer.h.

retainedSVFGNodes

OrderedSet<const VFGNode*> SVF::MultiStageSlicer::retainedSVFGNodes

private

memoised data-dependence slice

Definition at line 244 of file MTASlicer.h.

---

The documentation for this class was generated from the following files:

• /home/runner/work/SVF/SVF/svf/include/MTA/MTASlicer.h
• /home/runner/work/SVF/SVF/svf/lib/MTA/MTASlicer.cpp