Static Value-Flow Analysis
|
#include <ObjTypeInference.h>
Public Types | |
typedef Set< const Value * > | ValueSet |
typedef Map< const Value *, ValueSet > | ValueToValueSet |
typedef ValueToValueSet | ValueToInferSites |
typedef ValueToValueSet | ValueToSources |
typedef Map< const Value *, const Type * > | ValueToType |
typedef std::pair< const Value *, bool > | ValueBoolPair |
typedef Map< const Value *, Set< std::string > > | ValueToClassNames |
typedef Map< const Value *, Set< const CallBase * > > | ObjToClsNameSources |
Public Member Functions | |
ObjTypeInference ()=default | |
~ObjTypeInference ()=default | |
const Type * | inferObjType (const Value *var) |
get or infer the type of the object pointed by the value | |
const Type * | inferPointsToType (const Value *var) |
void | validateTypeCheck (const CallBase *cs) |
validate type inference | |
void | typeSizeDiffTest (const PointerType *oPTy, const Type *iTy, const Value *val) |
const Type * | defaultType (const Value *val) |
default type | |
const Type * | ptrType () |
pointer type | |
const IntegerType * | int8Type () |
int8 type | |
LLVMContext & | getLLVMCtx () |
const Type * | selectLargestSizedType (Set< const Type * > &objTys) |
select the largest (conservative) type from all types | |
u32_t | objTyToNumFields (const Type *objTy) |
u32_t | getArgPosInCall (const CallBase *callBase, const Value *arg) |
Set< std::string > & | inferThisPtrClsName (const Value *thisPtr) |
get or infer the class names of thisptr | |
Protected Member Functions | |
Set< const Value * > & | bwFindAllocOrClsNameSources (const Value *startValue) |
Set< const CallBase * > & | fwFindClsNameSources (const Value *startValue) |
forward find class name sources starting from an allocation | |
Private Member Functions | |
const Type * | fwInferObjType (const Value *var) |
forward infer the type of the object pointed by var | |
Set< const Value * > & | bwfindAllocOfVar (const Value *var) |
backward collect all possible allocation sites (stack, static, heap) of var | |
bool | isAlloc (const SVF::Value *val) |
is allocation (stack, static, heap) | |
Definition at line 39 of file ObjTypeInference.h.
Definition at line 50 of file ObjTypeInference.h.
typedef std::pair<const Value *, bool> SVF::ObjTypeInference::ValueBoolPair |
Definition at line 48 of file ObjTypeInference.h.
Definition at line 43 of file ObjTypeInference.h.
Definition at line 49 of file ObjTypeInference.h.
Definition at line 45 of file ObjTypeInference.h.
Definition at line 46 of file ObjTypeInference.h.
Definition at line 47 of file ObjTypeInference.h.
Definition at line 44 of file ObjTypeInference.h.
|
explicitdefault |
|
default |
backward collect all possible allocation sites (stack, static, heap) of var
backward collect all possible allocation sites (stack, static, heap) of var
var |
Definition at line 529 of file ObjTypeInference.cpp.
|
protected |
find all possible allocations or class name sources (e.g., constructors/destructors or template functions) starting from a value
find all possible allocations or class name sources (e.g., constructors/destructors or template functions) if we already find class name sources, we don't need to find the allocations and forward find class name sources
startValue |
Definition at line 822 of file ObjTypeInference.cpp.
default type
Definition at line 114 of file ObjTypeInference.cpp.
|
protected |
forward find class name sources starting from an allocation
Definition at line 957 of file ObjTypeInference.cpp.
forward infer the type of the object pointed by var
forward infer the type of the object pointed by var
var |
Definition at line 201 of file ObjTypeInference.cpp.
Definition at line 699 of file ObjTypeInference.cpp.
LLVMContext & ObjTypeInference::getLLVMCtx | ( | ) |
Definition at line 125 of file ObjTypeInference.cpp.
get or infer the type of the object pointed by the value
get or infer the type of the object pointed by var if the start value is a source (alloc/global, heap, static), call fwInferObjType if not, find allocations and then forward get or infer types
val |
Definition at line 136 of file ObjTypeInference.cpp.
Definition at line 175 of file ObjTypeInference.cpp.
get or infer the class names of thisptr
get or infer the class names of thisptr; starting from :param:thisPtr
, will walk backwards to find all potential sources for the class name. Valid sources include global or stack variables, heap allocations, or C++ dynamic casts/constructors/destructors. If the source site is a global/stack/heap variable, find the corresponding constructor/destructor to extract the class' name from (since the type of the variable is not reliable but the demangled name is)
thisPtr |
thisPtr
could point to Definition at line 749 of file ObjTypeInference.cpp.
|
inline |
|
private |
is allocation (stack, static, heap)
Definition at line 651 of file ObjTypeInference.cpp.
For an C++ class, it can have variant elements depending on the vtable size, Hence we only handle non-cpp-class object, the type of the cpp class is treated as default PointerType
Definition at line 724 of file ObjTypeInference.cpp.
pointer type
Definition at line 83 of file ObjTypeInference.h.
select the largest (conservative) type from all types
Definition at line 708 of file ObjTypeInference.cpp.
void ObjTypeInference::typeSizeDiffTest | ( | const PointerType * | oPTy, |
const Type * | iTy, | ||
const Value * | val | ||
) |
Definition at line 685 of file ObjTypeInference.cpp.
validate type inference
validate type inference
cs | : stub malloc function with element number label |
Definition at line 660 of file ObjTypeInference.cpp.
|
private |
Definition at line 59 of file ObjTypeInference.h.
|
private |
Definition at line 57 of file ObjTypeInference.h.
|
private |
Definition at line 58 of file ObjTypeInference.h.
|
private |
Definition at line 56 of file ObjTypeInference.h.
|
private |
Definition at line 54 of file ObjTypeInference.h.
|
private |
Definition at line 55 of file ObjTypeInference.h.