Static Value-Flow Analysis
Loading...
Searching...
No Matches
Public Types | Public Member Functions | Static Public Attributes | Protected Attributes | Static Protected Attributes | Private Member Functions | List of all members
SVF::PointerAnalysis Class Referenceabstract

#include <PointerAnalysis.h>

Inheritance diagram for SVF::PointerAnalysis:
SVF::CondPTAImpl< ContextCond > SVF::BVDataPTAImpl SVF::CondPTAImpl< Cond > SVF::ContextDDA SVF::AndersenBase SVF::CFLBase SVF::FlowDDA SVF::FlowSensitive SVF::Andersen SVF::Steensgaard SVF::TypeAnalysis SVF::CFLAlias SVF::CFLVF SVF::VersionedFlowSensitive SVF::AndersenSCD SVF::AndersenWaveDiff SVF::POCRAlias SVF::POCRHybrid SVF::AndersenSFR

Public Types

enum  PTATY {
  Andersen_BASE , Andersen_WPA , AndersenSCD_WPA , AndersenSFR_WPA ,
  AndersenWaveDiff_WPA , Steensgaard_WPA , CSCallString_WPA , CSSummary_WPA ,
  FSDATAFLOW_WPA , FSSPARSE_WPA , VFS_WPA , FSCS_WPA ,
  CFLFICI_WPA , CFLFSCI_WPA , CFLFSCS_WPA , TypeCPP_WPA ,
  FieldS_DDA , FlowS_DDA , PathS_DDA , Cxt_DDA ,
  Default_PTA
}
 Pointer analysis type list. More...
 
enum  PTAImplTy { BaseImpl , BVDataImpl , CondImpl }
 Implementation type: BVDataPTAImpl or CondPTAImpl. More...
 
typedef Set< const CallICFGNode * > CallSiteSet
 Indirect call edges type, map a callsite to a set of callees.
 
typedef SVFIR::CallSiteToFunPtrMap CallSiteToFunPtrMap
 
typedef Set< const FunObjVar * > FunctionSet
 
typedef OrderedMap< const CallICFGNode *, FunctionSetCallEdgeMap
 
typedef SCCDetection< CallGraph * > CallGraphSCC
 
typedef Set< const GlobalObjVar * > VTableSet
 
typedef Set< const FunObjVar * > VFunSet
 

Public Member Functions

ICFGgetICFG () const
 Get ICFG.
 
u32_t getNumOfResolvedIndCallEdge () const
 Return number of resolved indirect call edges.
 
CallGraphgetCallGraph () const
 Return call graph.
 
CallGraphSCCgetCallGraphSCC () const
 Return call graph SCC.
 
 PointerAnalysis (SVFIR *pag, PTATY ty=Default_PTA, bool alias_check=true)
 Constructor.
 
PTATY getAnalysisTy () const
 Type of pointer analysis.
 
PTAImplTy getImplTy () const
 Return implementation type of the pointer analysis.
 
bool printStat ()
 Whether print statistics.
 
void disablePrintStat ()
 Whether print statistics.
 
CallEdgeMapgetIndCallMap ()
 Get callees from an indirect callsite.
 
bool hasIndCSCallees (const CallICFGNode *cs) const
 
const FunctionSetgetIndCSCallees (const CallICFGNode *cs) const
 
virtual void resolveIndCalls (const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
 Resolve indirect call edges.
 
void callGraphSCCDetection ()
 PTACallGraph SCC related methods.
 
NodeID getCallGraphSCCRepNode (NodeID id) const
 Get SCC rep node of a SVFG node.
 
bool inSameCallGraphSCC (const FunObjVar *fun1, const FunObjVar *fun2)
 Return TRUE if this edge is inside a PTACallGraph SCC, i.e., src node and dst node are in the same SCC on the SVFG.
 
bool isInRecursion (const FunObjVar *fun) const
 
bool isLocalVarInRecursiveFun (NodeID id) const
 Whether a local variable is in function recursions.
 
virtual const std::string PTAName () const
 Return PTA name.
 
CommonCHGraphgetCHGraph () const
 get CHGraph
 
void getVFnsFromCHA (const CallICFGNode *cs, VFunSet &vfns)
 
void getVFnsFromPts (const CallICFGNode *cs, const PointsTo &target, VFunSet &vfns)
 
void connectVCallToVFns (const CallICFGNode *cs, const VFunSet &vfns, CallEdgeMap &newEdges)
 
virtual void resolveCPPIndCalls (const CallICFGNode *cs, const PointsTo &target, CallEdgeMap &newEdges)
 Resolve cpp indirect call edges.
 

Static Public Attributes

static const std::string aliasTestMayAlias = "MAYALIAS"
 
static const std::string aliasTestMayAliasMangled = "_Z8MAYALIASPvS_"
 
static const std::string aliasTestNoAlias = "NOALIAS"
 
static const std::string aliasTestNoAliasMangled = "_Z7NOALIASPvS_"
 
static const std::string aliasTestPartialAlias = "PARTIALALIAS"
 
static const std::string aliasTestPartialAliasMangled = "_Z12PARTIALALIASPvS_"
 
static const std::string aliasTestMustAlias = "MUSTALIAS"
 
static const std::string aliasTestMustAliasMangled = "_Z9MUSTALIASPvS_"
 
static const std::string aliasTestFailMayAlias = "EXPECTEDFAIL_MAYALIAS"
 
static const std::string aliasTestFailMayAliasMangled = "_Z21EXPECTEDFAIL_MAYALIASPvS_"
 
static const std::string aliasTestFailNoAlias = "EXPECTEDFAIL_NOALIAS"
 
static const std::string aliasTestFailNoAliasMangled = "_Z20EXPECTEDFAIL_NOALIASPvS_"
 

Protected Attributes

bool print_stat
 User input flags.
 
bool alias_validation
 Flag for validating points-to/alias results.
 
u32_t OnTheFlyIterBudgetForStat
 Flag for iteration budget for on-the-fly statistics.
 
PTATY ptaTy
 Pointer analysis Type.
 
PTAImplTy ptaImplTy
 PTA implementation type.
 
PTAStatstat
 Statistics.
 
CallGraphcallgraph
 Call graph used for pointer analysis.
 
CallGraphSCCcallGraphSCC
 SCC for PTACallGraph.
 
ICFGicfg
 Interprocedural control-flow graph.
 
CommonCHGraphchgraph
 CHGraph.
 

Static Protected Attributes

static SVFIRpag = nullptr
 SVFIR.
 

Private Member Functions

void destroy ()
 Release the memory.
 
SVFIRgetPAG () const
 
PTAStatgetStat () const
 Get PTA stat.
 
OrderedNodeSetgetAllValidPtrs ()
 Get all Valid Pointers for resolution.
 
virtual void initialize ()
 Initialization of a pointer analysis, including building symbol table and SVFIR etc.
 
virtual void finalize ()
 Finalization of a pointer analysis, including checking alias correctness.
 
virtual void analyze ()=0
 Start Analysis here (main part of pointer analysis). It needs to be implemented in child class.
 
virtual void computeDDAPts (NodeID)
 Compute points-to results on-demand, overridden by derived classes.
 
virtual AliasResult alias (const SVFVar *V1, const SVFVar *V2)=0
 Interface exposed to users of our pointer analysis, given Value infos.
 
virtual AliasResult alias (NodeID node1, NodeID node2)=0
 Interface exposed to users of our pointer analysis, given PAGNodeID.
 
virtual const PointsTogetPts (NodeID ptr)=0
 Get points-to targets of a pointer. It needs to be implemented in child class.
 
virtual const NodeSetgetRevPts (NodeID nodeId)=0
 
void printIndCSTargets (const CallICFGNode *cs, const FunctionSet &targets)
 Print targets of a function pointer.
 
virtual void dumpTopLevelPtsTo ()
 
virtual void dumpAllPts ()
 
virtual void dumpCPts ()
 
virtual void dumpPts (NodeID ptr, const PointsTo &pts)
 
void printIndCSTargets ()
 
void dumpAllTypes ()
 
void dumpStat ()
 Dump the statistics.
 
bool containBlackHoleNode (const PointsTo &pts)
 Determine whether a points-to contains a black hole or constant node.
 
bool containConstantNode (const PointsTo &pts)
 
virtual bool isBlkObjOrConstantObj (NodeID ptd) const
 
bool isHeapMemObj (NodeID id) const
 Whether this object is heap or array.
 
bool isArrayMemObj (NodeID id) const
 
bool isFIObjNode (NodeID id) const
 
NodeID getBaseObjVar (NodeID id)
 
NodeID getFIObjVar (NodeID id)
 
NodeID getGepObjVar (NodeID id, const APOffset &ap)
 
virtual const NodeBSgetAllFieldsObjVars (NodeID id)
 
void setObjFieldInsensitive (NodeID id)
 
bool isFieldInsensitive (NodeID id) const
 
const CallSiteToFunPtrMapgetIndirectCallsites () const
 Return all indirect callsites.
 
NodeID getFunPtr (const CallICFGNode *cs) const
 Return function pointer PAGNode at a callsite cs.
 
virtual void validateTests ()
 Alias check functions to verify correctness of pointer analysis.
 
virtual void validateSuccessTests (std::string fun)
 
virtual void validateExpectedFailureTests (std::string fun)
 
void resetObjFieldSensitive ()
 Reset all object node as field-sensitive.
 

Detailed Description

Definition at line 56 of file PointerAnalysis.h.

Member Typedef Documentation

◆ CallEdgeMap

Definition at line 104 of file PointerAnalysis.h.

◆ CallGraphSCC

Definition at line 105 of file PointerAnalysis.h.

◆ CallSiteSet

Indirect call edges type, map a callsite to a set of callees.

Definition at line 101 of file PointerAnalysis.h.

◆ CallSiteToFunPtrMap

Definition at line 102 of file PointerAnalysis.h.

◆ FunctionSet

Definition at line 103 of file PointerAnalysis.h.

◆ VFunSet

Definition at line 107 of file PointerAnalysis.h.

◆ VTableSet

Definition at line 106 of file PointerAnalysis.h.

Member Enumeration Documentation

◆ PTAImplTy

Implementation type: BVDataPTAImpl or CondPTAImpl.

Enumerator
BaseImpl 

Represents PointerAnalaysis.

BVDataImpl 

Represents BVDataPTAImpl.

CondImpl 

Represents CondPTAImpl.

Definition at line 92 of file PointerAnalysis.h.

93 {
94 BaseImpl,
96 CondImpl,
97 };
@ BaseImpl
Represents PointerAnalaysis.
@ BVDataImpl
Represents BVDataPTAImpl.
@ CondImpl
Represents CondPTAImpl.

◆ PTATY

Pointer analysis type list.

Enumerator
Andersen_BASE 

Base Andersen PTA.

Andersen_WPA 

Andersen PTA.

AndersenSCD_WPA 

Selective cycle detection andersen-style WPA.

AndersenSFR_WPA 

Stride-based field representation.

AndersenWaveDiff_WPA 

Diff wave propagation andersen-style WPA.

Steensgaard_WPA 

Steensgaard PTA.

CSCallString_WPA 

Call string based context sensitive WPA.

CSSummary_WPA 

Summary based context sensitive WPA.

FSDATAFLOW_WPA 

Traditional Dataflow-based flow sensitive WPA.

FSSPARSE_WPA 

Sparse flow sensitive WPA.

VFS_WPA 

Versioned sparse flow-sensitive WPA.

FSCS_WPA 

Flow-, context- sensitive WPA.

CFLFICI_WPA 

Flow-, context-, insensitive CFL-reachability-based analysis.

CFLFSCI_WPA 

Flow-insensitive, context-sensitive CFL-reachability-based analysis.

CFLFSCS_WPA 

Flow-, context-, CFL-reachability-based analysis.

TypeCPP_WPA 

Type-based analysis for C++.

FieldS_DDA 

Field sensitive DDA.

FlowS_DDA 

Flow sensitive DDA.

PathS_DDA 

Guarded value-flow DDA.

Cxt_DDA 

context sensitive DDA

Default_PTA 

default pta without any analysis

Definition at line 61 of file PointerAnalysis.h.

62 {
63 // Whole program analysis
74 VFS_WPA,
75 FSCS_WPA,
80
81 // Demand driven analysis
83 FlowS_DDA,
84 PathS_DDA,
85 Cxt_DDA,
86
87
89 };
@ Cxt_DDA
context sensitive DDA
@ CFLFICI_WPA
Flow-, context-, insensitive CFL-reachability-based analysis.
@ VFS_WPA
Versioned sparse flow-sensitive WPA.
@ FSCS_WPA
Flow-, context- sensitive WPA.
@ FSDATAFLOW_WPA
Traditional Dataflow-based flow sensitive WPA.
@ AndersenSCD_WPA
Selective cycle detection andersen-style WPA.
@ Andersen_BASE
Base Andersen PTA.
@ FlowS_DDA
Flow sensitive DDA.
@ Andersen_WPA
Andersen PTA.
@ CFLFSCS_WPA
Flow-, context-, CFL-reachability-based analysis.
@ FieldS_DDA
Field sensitive DDA.
@ AndersenWaveDiff_WPA
Diff wave propagation andersen-style WPA.
@ CSCallString_WPA
Call string based context sensitive WPA.
@ PathS_DDA
Guarded value-flow DDA.
@ TypeCPP_WPA
Type-based analysis for C++.
@ AndersenSFR_WPA
Stride-based field representation.
@ Steensgaard_WPA
Steensgaard PTA.
@ FSSPARSE_WPA
Sparse flow sensitive WPA.
@ Default_PTA
default pta without any analysis
@ CSSummary_WPA
Summary based context sensitive WPA.
@ CFLFSCI_WPA
Flow-insensitive, context-sensitive CFL-reachability-based analysis.

Constructor & Destructor Documentation

◆ PointerAnalysis()

PointerAnalysis::PointerAnalysis ( SVFIR p,
PTATY  ty = Default_PTA,
bool  alias_check = true 
)

Constructor.

Constructor

Definition at line 68 of file PointerAnalysis.cpp.

68 : ptaTy(ty), stat(nullptr), callgraph(nullptr),
69 callGraphSCC(nullptr), icfg(nullptr),
70 chgraph(nullptr)
71{
72 pag = p;
77}
cJSON * p
Definition cJSON.cpp:2559
static const Option< bool > EnableAliasCheck
Definition Options.h:130
static const Option< bool > PStat
Definition Options.h:119
static const Option< u32_t > StatBudget
Definition Options.h:120
CommonCHGraph * chgraph
CHGraph.
bool print_stat
User input flags.
PTAImplTy ptaImplTy
PTA implementation type.
PTAStat * stat
Statistics.
ICFG * icfg
Interprocedural control-flow graph.
CallGraph * callgraph
Call graph used for pointer analysis.
bool alias_validation
Flag for validating points-to/alias results.
static SVFIR * pag
SVFIR.
PTATY ptaTy
Pointer analysis Type.
CallGraphSCC * callGraphSCC
SCC for PTACallGraph.
u32_t OnTheFlyIterBudgetForStat
Flag for iteration budget for on-the-fly statistics.
llvm::IRBuilder IRBuilder
Definition BasicTypes.h:74

◆ ~PointerAnalysis()

PointerAnalysis::~PointerAnalysis ( )
virtual

Destructor.

Destructor

Definition at line 82 of file PointerAnalysis.cpp.

83{
84 destroy();
85 // do not delete the SVFIR for now
86 //delete pag;
87}
void destroy()
Release the memory.

Member Function Documentation

◆ alias() [1/2]

virtual AliasResult SVF::PointerAnalysis::alias ( const SVFVar V1,
const SVFVar V2 
)
pure virtual

Interface exposed to users of our pointer analysis, given Value infos.

Implemented in SVF::CondPTAImpl< Cond >, SVF::CondPTAImpl< ContextCond >, and SVF::BVDataPTAImpl.

◆ alias() [2/2]

virtual AliasResult SVF::PointerAnalysis::alias ( NodeID  node1,
NodeID  node2 
)
pure virtual

Interface exposed to users of our pointer analysis, given PAGNodeID.

Implemented in SVF::CFLAlias, SVF::CondPTAImpl< Cond >, SVF::CondPTAImpl< ContextCond >, and SVF::BVDataPTAImpl.

◆ analyze()

virtual void SVF::PointerAnalysis::analyze ( )
pure virtual

Start Analysis here (main part of pointer analysis). It needs to be implemented in child class.

Implemented in SVF::CFLBase, SVF::ContextDDA, SVF::FlowDDA, SVF::AndersenBase, SVF::FlowSensitive, and SVF::TypeAnalysis.

◆ callGraphSCCDetection()

void SVF::PointerAnalysis::callGraphSCCDetection ( )
inline

PTACallGraph SCC related methods.

PTACallGraph SCC detection

Definition at line 379 of file PointerAnalysis.h.

380 {
381 if(callGraphSCC==nullptr)
383
384 callGraphSCC->find();
385 }
SCCDetection< CallGraph * > CallGraphSCC

◆ computeDDAPts()

virtual void SVF::PointerAnalysis::computeDDAPts ( NodeID  )
inlinevirtual

Compute points-to results on-demand, overridden by derived classes.

Reimplemented in SVF::ContextDDA, and SVF::FlowDDA.

Definition at line 226 of file PointerAnalysis.h.

226{}

◆ connectVCallToVFns()

void PointerAnalysis::connectVCallToVFns ( const CallICFGNode cs,
const VFunSet vfns,
CallEdgeMap newEdges 
)

Definition at line 465 of file PointerAnalysis.cpp.

466{
468 for (VFunSet::const_iterator fit = vfns.begin(),
469 feit = vfns.end(); fit != feit; ++fit)
470 {
471 const FunObjVar* callee = *fit;
473 if (getIndCallMap()[cs].count(callee) > 0)
474 continue;
475 if(cs->arg_size() == callee->arg_size() ||
476 (cs->isVarArg() && callee->isVarArg()))
477 {
478 newEdges[cs].insert(callee);
479 getIndCallMap()[cs].insert(callee);
480 const CallICFGNode* callBlockNode = cs;
481 callgraph->addIndirectCallGraphEdge(callBlockNode, cs->getCaller(),callee);
482 }
483 }
484}
void addIndirectCallGraphEdge(const CallICFGNode *cs, const FunObjVar *callerFun, const FunObjVar *calleeFun)
Add indirect call edges.
bool isVarArg() const
Definition ICFGNode.h:517
const FunObjVar * getCaller() const
Return callsite.
Definition ICFGNode.h:464
u32_t arg_size() const
Definition ICFGNode.h:499
const FunObjVar * getDefFunForMultipleModule() const
CallEdgeMap & getIndCallMap()
Get callees from an indirect callsite.

◆ containBlackHoleNode()

bool SVF::PointerAnalysis::containBlackHoleNode ( const PointsTo pts)
inline

Determine whether a points-to contains a black hole or constant node.

Definition at line 282 of file PointerAnalysis.h.

283 {
284 return pts.test(pag->getBlackHoleNode());
285 }
NodeID getBlackHoleNode() const
Definition IRGraph.h:247

◆ containConstantNode()

bool SVF::PointerAnalysis::containConstantNode ( const PointsTo pts)
inline

Definition at line 286 of file PointerAnalysis.h.

287 {
288 return pts.test(pag->getConstantNode());
289 }
NodeID getConstantNode() const
Definition IRGraph.h:251

◆ destroy()

void PointerAnalysis::destroy ( )
private

Release the memory.

Definition at line 90 of file PointerAnalysis.cpp.

91{
92 delete callgraph;
93 callgraph = nullptr;
94
95 delete callGraphSCC;
96 callGraphSCC = nullptr;
97
98 delete stat;
99 stat = nullptr;
100}

◆ disablePrintStat()

void SVF::PointerAnalysis::disablePrintStat ( )
inline

Whether print statistics.

Definition at line 352 of file PointerAnalysis.h.

353 {
354 print_stat = false;
355 }

◆ dumpAllPts()

virtual void SVF::PointerAnalysis::dumpAllPts ( )
inlinevirtual

Reimplemented in SVF::BVDataPTAImpl.

Definition at line 248 of file PointerAnalysis.h.

248{}

◆ dumpAllTypes()

void PointerAnalysis::dumpAllTypes ( )

Definition at line 232 of file PointerAnalysis.cpp.

233{
234 for (OrderedNodeSet::iterator nIter = this->getAllValidPtrs().begin();
235 nIter != this->getAllValidPtrs().end(); ++nIter)
236 {
237 const PAGNode* node = getPAG()->getGNode(*nIter);
238 if (SVFUtil::isa<DummyObjVar, DummyValVar>(node))
239 continue;
240
241 outs() << "##<" << node->getName() << "> ";
242 outs() << "Source Loc: " << node->getSourceLoc();
243 outs() << "\nNodeID " << node->getId() << "\n";
244
245 const SVFType* type = node->getType();
247 }
248}
newitem type
Definition cJSON.cpp:2739
NodeType * getGNode(NodeID id) const
Get a node.
void printFlattenFields(const SVFType *type)
Debug method.
Definition IRGraph.cpp:73
SVFIR * getPAG() const
OrderedNodeSet & getAllValidPtrs()
Get all Valid Pointers for resolution.
NodeID getId() const
Get ID.
Definition SVFValue.h:158
virtual const SVFType * getType() const
Definition SVFValue.h:169
virtual const std::string getSourceLoc() const
Definition SVFValue.h:194
virtual const std::string & getName() const
Definition SVFValue.h:184
std::ostream & outs()
Overwrite llvm::outs()
Definition SVFUtil.h:52

◆ dumpCPts()

virtual void SVF::PointerAnalysis::dumpCPts ( )
inlinevirtual

Reimplemented in SVF::CondPTAImpl< Cond >, SVF::CondPTAImpl< ContextCond >, and SVF::BVDataPTAImpl.

Definition at line 249 of file PointerAnalysis.h.

249{}

◆ dumpPts()

void PointerAnalysis::dumpPts ( NodeID  ptr,
const PointsTo pts 
)
virtual

Dump points-to of top-level pointers (ValVar)

print the points-to set of node which has the maximum pts size.

Definition at line 253 of file PointerAnalysis.cpp.

254{
255
256 const PAGNode* node = pag->getGNode(ptr);
258 if (SVFUtil::isa<DummyObjVar> (node))
259 {
260 outs() << "##<Dummy Obj > id:" << node->getId();
261 }
262 else if (!SVFUtil::isa<DummyValVar>(node) && !SVFIR::pagReadFromTXT())
263 {
264 outs() << "##<" << node->getName() << "> ";
265 outs() << "Source Loc: " << node->getSourceLoc();
266 }
267 outs() << "\nPtr " << node->getId() << " ";
268
269 if (pts.empty())
270 {
271 outs() << "\t\tPointsTo: {empty}\n\n";
272 }
273 else
274 {
275 outs() << "\t\tPointsTo: { ";
276 for (PointsTo::iterator it = pts.begin(), eit = pts.end(); it != eit;
277 ++it)
278 outs() << *it << " ";
279 outs() << "}\n\n";
280 }
281
282 outs() << "";
283
284 for (PointsTo::iterator it = pts.begin(), eit = pts.end(); it != eit; ++it)
285 {
286 const PAGNode* node = pag->getGNode(*it);
287 if(SVFUtil::isa<ObjVar>(node) == false)
288 continue;
289 NodeID ptd = node->getId();
290 outs() << "!!Target NodeID " << ptd << "\t [";
291 const PAGNode* pagNode = pag->getGNode(ptd);
292 if (SVFUtil::isa<DummyValVar>(node))
293 outs() << "DummyVal\n";
294 else if (SVFUtil::isa<DummyObjVar>(node))
295 outs() << "Dummy Obj id: " << node->getId() << "]\n";
296 else
297 {
299 {
300 outs() << "<" << pagNode->getName() << "> ";
301 outs() << "Source Loc: "
302 << pagNode->getSourceLoc() << "] \n";
303 }
304 }
305 }
306}
static bool pagReadFromTXT()
Definition SVFIR.h:211
u32_t NodeID
Definition GeneralType.h:56

◆ dumpStat()

void PointerAnalysis::dumpStat ( )

Dump the statistics.

Definition at line 163 of file PointerAnalysis.cpp.

164{
165
166 if(print_stat && stat)
167 {
168 stat->performStat();
169 }
170}
void performStat() override
Definition PTAStat.cpp:52

◆ dumpTopLevelPtsTo()

virtual void SVF::PointerAnalysis::dumpTopLevelPtsTo ( )
inlinevirtual

◆ finalize()

void PointerAnalysis::finalize ( )
virtual

Finalization of a pointer analysis, including checking alias correctness.

Finalize the analysis after solving Given the alias results, verify whether it is correct or not using alias check functions

Print statistics

Dump results

Reimplemented in SVF::CFLAlias, SVF::CFLBase, SVF::CFLVF, SVF::CondPTAImpl< Cond >, SVF::CondPTAImpl< ContextCond >, SVF::Andersen, SVF::ContextDDA, SVF::FlowDDA, SVF::BVDataPTAImpl, SVF::AndersenBase, SVF::FlowSensitive, SVF::TypeAnalysis, and SVF::VersionedFlowSensitive.

Definition at line 176 of file PointerAnalysis.cpp.

177{
178
180 dumpStat();
181
183 if (Options::PTSPrint())
184 {
186 //dumpAllPts();
187 //dumpCPts();
188 }
189
190 if (Options::TypePrint())
191 dumpAllTypes();
192
194 dumpAllPts();
195
198
200
202 getCallGraph()->dump("callgraph_final");
203
206
209}
void dump(const std::string &filename)
Dump the graph.
void verifyCallGraph()
Issue a warning if the function which has indirect call sites can not be reached from program entry.
bool isBuiltFromFile()
Whether this SVFIR built from a txt file.
Definition IRGraph.h:150
static const Option< bool > CallGraphDotGraph
Definition Options.h:126
static const Option< bool > PTSPrint
Definition Options.h:116
static const Option< bool > PTSAllPrint
Definition Options.h:117
static const Option< bool > TypePrint
Definition Options.h:114
static Option< bool > UsePreCompFieldSensitive
Definition Options.h:129
static const Option< bool > FuncPointerPrint
Definition Options.h:115
virtual void validateTests()
Alias check functions to verify correctness of pointer analysis.
virtual void dumpTopLevelPtsTo()
CallGraph * getCallGraph() const
Return call graph.
void resetObjFieldSensitive()
Reset all object node as field-sensitive.
virtual void dumpAllPts()
void dumpStat()
Dump the statistics.

◆ getAllFieldsObjVars()

virtual const NodeBS & SVF::PointerAnalysis::getAllFieldsObjVars ( NodeID  id)
inlinevirtual

Definition at line 329 of file PointerAnalysis.h.

330 {
331 return pag->getAllFieldsObjVars(id);
332 }
NodeBS & getAllFieldsObjVars(const BaseObjVar *obj)
Get all fields of an object.
Definition SVFIR.cpp:483

◆ getAllValidPtrs()

OrderedNodeSet & SVF::PointerAnalysis::getAllValidPtrs ( )
inline

Get all Valid Pointers for resolution.

Definition at line 208 of file PointerAnalysis.h.

209 {
210 return pag->getAllValidPtrs();
211 }
OrderedNodeSet & getAllValidPtrs()
Return valid pointers.
Definition SVFIR.h:140

◆ getAnalysisTy()

PTATY SVF::PointerAnalysis::getAnalysisTy ( ) const
inline

Type of pointer analysis.

Definition at line 182 of file PointerAnalysis.h.

183 {
184 return ptaTy;
185 }

◆ getBaseObjVar()

NodeID SVF::PointerAnalysis::getBaseObjVar ( NodeID  id)
inline

Definition at line 317 of file PointerAnalysis.h.

318 {
319 return pag->getBaseObjVar(id);
320 }
NodeID getBaseObjVar(NodeID id) const
Base and Offset methods for Value and Object node.
Definition SVFIR.h:479

◆ getCallGraph()

CallGraph * SVF::PointerAnalysis::getCallGraph ( ) const
inline

Return call graph.

Definition at line 168 of file PointerAnalysis.h.

169 {
170 return callgraph;
171 }

◆ getCallGraphSCC()

CallGraphSCC * SVF::PointerAnalysis::getCallGraphSCC ( ) const
inline

Return call graph SCC.

Definition at line 173 of file PointerAnalysis.h.

174 {
175 return callGraphSCC;
176 }

◆ getCallGraphSCCRepNode()

NodeID SVF::PointerAnalysis::getCallGraphSCCRepNode ( NodeID  id) const
inline

Get SCC rep node of a SVFG node.

Definition at line 387 of file PointerAnalysis.h.

388 {
389 return callGraphSCC->repNode(id);
390 }

◆ getCHGraph()

CommonCHGraph * SVF::PointerAnalysis::getCHGraph ( ) const
inline

get CHGraph

Definition at line 413 of file PointerAnalysis.h.

414 {
415 return chgraph;
416 }

◆ getFIObjVar()

NodeID SVF::PointerAnalysis::getFIObjVar ( NodeID  id)
inline

Definition at line 321 of file PointerAnalysis.h.

322 {
323 return pag->getFIObjVar(id);
324 }
NodeID getFIObjVar(const BaseObjVar *obj) const
Get a field-insensitive obj SVFIR node according to a mem obj.
Definition SVFIR.h:449

◆ getFunPtr()

NodeID SVF::PointerAnalysis::getFunPtr ( const CallICFGNode cs) const
inlineprotected

Return function pointer PAGNode at a callsite cs.

Definition at line 262 of file PointerAnalysis.h.

263 {
264 return pag->getFunPtr(cs);
265 }
NodeID getFunPtr(const CallICFGNode *cs) const
Definition SVFIR.h:382

◆ getGepObjVar()

NodeID SVF::PointerAnalysis::getGepObjVar ( NodeID  id,
const APOffset ap 
)
inline

Definition at line 325 of file PointerAnalysis.h.

326 {
327 return pag->getGepObjVar(id, ap);
328 }
NodeID getGepObjVar(const BaseObjVar *baseObj, const APOffset &ap)
Get a field SVFIR Object node according to base mem obj and offset.
Definition SVFIR.cpp:439

◆ getICFG()

ICFG * SVF::PointerAnalysis::getICFG ( ) const
inline

Get ICFG.

Definition at line 158 of file PointerAnalysis.h.

159 {
160 return pag->getICFG();
161 }
ICFG * getICFG() const
Definition SVFIR.h:163

◆ getImplTy()

PTAImplTy SVF::PointerAnalysis::getImplTy ( ) const
inline

Return implementation type of the pointer analysis.

Definition at line 188 of file PointerAnalysis.h.

189 {
190 return ptaImplTy;
191 }

◆ getIndCallMap()

CallEdgeMap & SVF::PointerAnalysis::getIndCallMap ( )
inline

Get callees from an indirect callsite.

Definition at line 359 of file PointerAnalysis.h.

360 {
361 return getCallGraph()->getIndCallMap();
362 }
CallEdgeMap & getIndCallMap()
Get callees from an indirect callsite.
Definition CallGraph.h:319

◆ getIndCSCallees()

const FunctionSet & SVF::PointerAnalysis::getIndCSCallees ( const CallICFGNode cs) const
inline

Definition at line 367 of file PointerAnalysis.h.

368 {
369 return getCallGraph()->getIndCSCallees(cs);
370 }
const FunctionSet & getIndCSCallees(const CallICFGNode *cs) const
Definition CallGraph.h:327

◆ getIndirectCallsites()

const CallSiteToFunPtrMap & SVF::PointerAnalysis::getIndirectCallsites ( ) const
inlineprotected

Return all indirect callsites.

Definition at line 257 of file PointerAnalysis.h.

258 {
259 return pag->getIndirectCallsites();
260 }
const CallSiteToFunPtrMap & getIndirectCallsites() const
Add/get indirect callsites.
Definition SVFIR.h:378

◆ getNumOfResolvedIndCallEdge()

u32_t SVF::PointerAnalysis::getNumOfResolvedIndCallEdge ( ) const
inline

Return number of resolved indirect call edges.

Definition at line 163 of file PointerAnalysis.h.

164 {
166 }
u32_t getNumOfResolvedIndCallEdge() const
Definition CallGraph.h:339

◆ getPAG()

SVFIR * SVF::PointerAnalysis::getPAG ( ) const
inline

Get/set SVFIR

Definition at line 195 of file PointerAnalysis.h.

196 {
197 return pag;
198 }

◆ getPts()

virtual const PointsTo & SVF::PointerAnalysis::getPts ( NodeID  ptr)
pure virtual

Get points-to targets of a pointer. It needs to be implemented in child class.

Implemented in SVF::Andersen, SVF::BVDataPTAImpl, SVF::Steensgaard, SVF::CondPTAImpl< Cond >, and SVF::CondPTAImpl< ContextCond >.

◆ getRevPts()

virtual const NodeSet & SVF::PointerAnalysis::getRevPts ( NodeID  nodeId)
pure virtual

Given an object, get all the nodes having whose pointsto contains the object. Similar to getPts, this also needs to be implemented in child classes.

Implemented in SVF::CFLAlias, SVF::BVDataPTAImpl, SVF::CondPTAImpl< Cond >, and SVF::CondPTAImpl< ContextCond >.

◆ getStat()

PTAStat * SVF::PointerAnalysis::getStat ( ) const
inline

Get PTA stat.

Definition at line 202 of file PointerAnalysis.h.

203 {
204 return stat;
205 }

◆ getVFnsFromCHA()

void PointerAnalysis::getVFnsFromCHA ( const CallICFGNode cs,
VFunSet vfns 
)

Definition at line 421 of file PointerAnalysis.cpp.

422{
425}
virtual const VFunSet & getCSVFsBasedonCHA(const CallICFGNode *cs)=0
virtual bool csHasVFnsBasedonCHA(const CallICFGNode *cs)=0

◆ getVFnsFromPts()

void PointerAnalysis::getVFnsFromPts ( const CallICFGNode cs,
const PointsTo target,
VFunSet vfns 
)

Definition at line 430 of file PointerAnalysis.cpp.

431{
432
434 {
437 for (PointsTo::iterator it = target.begin(), eit = target.end(); it != eit; ++it)
438 {
439 const PAGNode *ptdnode = pag->getGNode(*it);
440 const GlobalObjVar* pVar = nullptr;
442 {
444
445 }
446 else if (isa<ValVar>(ptdnode) &&
448 pag->getBaseValVar(ptdnode->getId())))
449 {
452 pag->getBaseValVar(ptdnode->getId()))));
453 }
454
455 if (pVar && chaVtbls.find(pVar) != chaVtbls.end())
456 vtbls.insert(pVar);
457 }
459 }
460}
virtual const VTableSet & getCSVtblsBasedonCHA(const CallICFGNode *cs)=0
virtual void getVFnsFromVtbls(const CallICFGNode *cs, const VTableSet &vtbls, VFunSet &virtualFunctions)=0
virtual bool csHasVtblsBasedonCHA(const CallICFGNode *cs)=0
const BaseObjVar * getBaseObject(NodeID id) const
Definition SVFIR.h:423
const ValVar * getBaseValVar(NodeID id) const
Definition SVFIR.h:433
const ObjVar * getObjVarOfValVar(const ValVar *valVar)
Definition SVFUtil.cpp:431
Set< const GlobalObjVar * > VTableSet
Definition CHG.h:46

◆ hasIndCSCallees()

bool SVF::PointerAnalysis::hasIndCSCallees ( const CallICFGNode cs) const
inline

Definition at line 363 of file PointerAnalysis.h.

364 {
365 return getCallGraph()->hasIndCSCallees(cs);
366 }
bool hasIndCSCallees(const CallICFGNode *cs) const
Definition CallGraph.h:323

◆ initialize()

void PointerAnalysis::initialize ( )
virtual

Initialization of a pointer analysis, including building symbol table and SVFIR etc.

Initialization of pointer analysis

initialise pta call graph for every pointer analysis instance

Reimplemented in SVF::CFLAlias, SVF::CFLVF, SVF::Andersen, SVF::AndersenWaveDiff, SVF::AndersenSFR, SVF::ContextDDA, SVF::FlowDDA, SVF::AndersenBase, SVF::FlowSensitive, SVF::TypeAnalysis, and SVF::VersionedFlowSensitive.

Definition at line 105 of file PointerAnalysis.cpp.

106{
107 assert(pag && "SVFIR has not been built!");
108
109 chgraph = pag->getCHG();
110
113 {
115 callgraph = bd.buildThreadCallGraph();
116 }
117 else
118 {
120 callgraph = bd.buildPTACallGraph();
121 }
123
124 // dump callgraph
126 getCallGraph()->dump("callgraph_initial");
127}
static const Option< bool > EnableThreadCallGraph
Definition Options.h:132
void callGraphSCCDetection()
PTACallGraph SCC related methods.
CommonCHGraph * getCHG()
Definition SVFIR.h:173

◆ inSameCallGraphSCC()

bool SVF::PointerAnalysis::inSameCallGraphSCC ( const FunObjVar fun1,
const FunObjVar fun2 
)
inline

Return TRUE if this edge is inside a PTACallGraph SCC, i.e., src node and dst node are in the same SCC on the SVFG.

Definition at line 392 of file PointerAnalysis.h.

393 {
394 const CallGraphNode* src = callgraph->getCallGraphNode(fun1);
395 const CallGraphNode* dst = callgraph->getCallGraphNode(fun2);
396 return (getCallGraphSCCRepNode(src->getId()) == getCallGraphSCCRepNode(dst->getId()));
397 }
const CallGraphNode * getCallGraphNode(const std::string &name)
Get call graph node.
NodeID getCallGraphSCCRepNode(NodeID id) const
Get SCC rep node of a SVFG node.

◆ isArrayMemObj()

bool SVF::PointerAnalysis::isArrayMemObj ( NodeID  id) const
inline

Definition at line 303 of file PointerAnalysis.h.

304 {
305 const BaseObjVar* obj = pag->getBaseObject(id);
306 assert(obj && "base object is null??");
307 return obj->isArray();
308 }

◆ isBlkObjOrConstantObj()

virtual bool SVF::PointerAnalysis::isBlkObjOrConstantObj ( NodeID  ptd) const
inlinevirtual

Definition at line 290 of file PointerAnalysis.h.

291 {
293 }
bool isBlkObjOrConstantObj(NodeID id) const
Get black hole and constant id.
Definition SVFIR.h:462

◆ isFieldInsensitive()

bool SVF::PointerAnalysis::isFieldInsensitive ( NodeID  id) const
inline

Definition at line 338 of file PointerAnalysis.h.

339 {
340 const BaseObjVar* baseObj = pag->getBaseObject(id);
341 return baseObj->isFieldInsensitive();
342 }
bool isFieldInsensitive() const
Return true if its field limit is 0.

◆ isFIObjNode()

bool SVF::PointerAnalysis::isFIObjNode ( NodeID  id) const
inline

For field-sensitivity

Definition at line 313 of file PointerAnalysis.h.

314 {
315 return (SVFUtil::isa<BaseObjVar>(pag->getGNode(id)));
316 }

◆ isHeapMemObj()

bool SVF::PointerAnalysis::isHeapMemObj ( NodeID  id) const
inline

Whether this object is heap or array.

Definition at line 298 of file PointerAnalysis.h.

299 {
300 return pag->getBaseObject(id) && SVFUtil::isa<HeapObjVar, DummyObjVar>(pag->getBaseObject(id));
301 }

◆ isInRecursion()

bool SVF::PointerAnalysis::isInRecursion ( const FunObjVar fun) const
inline

Definition at line 398 of file PointerAnalysis.h.

399 {
400 return callGraphSCC->isInCycle(callgraph->getCallGraphNode(fun)->getId());
401 }

◆ isLocalVarInRecursiveFun()

bool PointerAnalysis::isLocalVarInRecursiveFun ( NodeID  id) const

Whether a local variable is in function recursions.

Return TRUE if this node is a local variable of recursive function.

Definition at line 133 of file PointerAnalysis.cpp.

134{
136 assert(baseObjVar && "base object not found!!");
137 if(SVFUtil::isa<StackObjVar>(baseObjVar))
138 {
139 if(const FunObjVar* svffun = pag->getGNode(id)->getFunction())
140 {
141 return callGraphSCC->isInCycle(getCallGraph()->getCallGraphNode(svffun)->getId());
142 }
143 }
144 return false;
145}
virtual const FunObjVar * getFunction() const
Get containing function, or null for globals/constants.

◆ printIndCSTargets() [1/2]

void PointerAnalysis::printIndCSTargets ( )

Print all indirect callsites

Definition at line 340 of file PointerAnalysis.cpp.

341{
342 outs() << "==================Function Pointer Targets==================\n";
344 CallEdgeMap::const_iterator it = callEdges.begin();
345 CallEdgeMap::const_iterator eit = callEdges.end();
346 for (; it != eit; ++it)
347 {
348 const CallICFGNode* cs = it->first;
349 const FunctionSet& targets = it->second;
351 }
352
354 CallSiteToFunPtrMap::const_iterator csIt = indCS.begin();
355 CallSiteToFunPtrMap::const_iterator csEit = indCS.end();
356 for (; csIt != csEit; ++csIt)
357 {
358 const CallICFGNode* cs = csIt->first;
359 if (hasIndCSCallees(cs) == false)
360 {
361 outs() << "\nNodeID: " << csIt->second;
362 outs() << "\nCallSite: ";
363 outs() << cs->toString();
364 outs() << "\tLocation: " << cs->getSourceLoc();
365 outs() << "\n\t!!!has no targets!!!\n";
366 }
367 }
368}
const std::string toString() const override
Definition ICFG.cpp:139
const std::string getSourceLoc() const override
Definition ICFGNode.h:582
OrderedMap< const CallICFGNode *, FunctionSet > CallEdgeMap
Set< const FunObjVar * > FunctionSet
const CallSiteToFunPtrMap & getIndirectCallsites() const
Return all indirect callsites.
bool hasIndCSCallees(const CallICFGNode *cs) const
SVFIR::CallSiteToFunPtrMap CallSiteToFunPtrMap

◆ printIndCSTargets() [2/2]

void PointerAnalysis::printIndCSTargets ( const CallICFGNode cs,
const FunctionSet targets 
)

Print targets of a function pointer.

Print indirect call targets at an indirect callsite

Definition at line 311 of file PointerAnalysis.cpp.

312{
313 outs() << "\nNodeID: " << getFunPtr(cs);
314 outs() << "\nCallSite: ";
315 outs() << cs->toString();
316 outs() << "\tLocation: " << cs->getSourceLoc();
317 outs() << "\t with Targets: ";
318
319 if (!targets.empty())
320 {
321 FunctionSet::const_iterator fit = targets.begin();
322 FunctionSet::const_iterator feit = targets.end();
323 for (; fit != feit; ++fit)
324 {
325 const FunObjVar* callee = *fit;
326 outs() << "\n\t" << callee->getName();
327 }
328 }
329 else
330 {
331 outs() << "\n\tNo Targets!";
332 }
333
334 outs() << "\n";
335}
NodeID getFunPtr(const CallICFGNode *cs) const
Return function pointer PAGNode at a callsite cs.

◆ printStat()

bool SVF::PointerAnalysis::printStat ( )
inline

Whether print statistics.

Definition at line 346 of file PointerAnalysis.h.

347 {
348 return print_stat;
349 }

◆ PTAName()

virtual const std::string SVF::PointerAnalysis::PTAName ( ) const
inlinevirtual

Return PTA name.

Reimplemented in SVF::Andersen, SVF::ContextDDA, SVF::FlowDDA, SVF::FlowSensitive, and SVF::VersionedFlowSensitive.

Definition at line 407 of file PointerAnalysis.h.

408 {
409 return "Pointer Analysis";
410 }

◆ resetObjFieldSensitive()

void PointerAnalysis::resetObjFieldSensitive ( )
protected

Reset all object node as field-sensitive.

Reset field sensitivity

Definition at line 150 of file PointerAnalysis.cpp.

151{
152 for (SVFIR::iterator nIter = pag->begin(); nIter != pag->end(); ++nIter)
153 {
154 if(ObjVar* node = SVFUtil::dyn_cast<ObjVar>(nIter->second))
155 const_cast<BaseObjVar*>(pag->getBaseObject(node->getId()))->setFieldSensitive();
156 }
157}
iterator begin()
Iterators.
IDToNodeMapTy::iterator iterator
Node Iterators.

◆ resolveCPPIndCalls()

void PointerAnalysis::resolveCPPIndCalls ( const CallICFGNode cs,
const PointsTo target,
CallEdgeMap newEdges 
)
virtual

Resolve cpp indirect call edges.

Definition at line 487 of file PointerAnalysis.cpp.

488{
489 assert(cs->isVirtualCall() && "not cpp virtual call");
490
493 getVFnsFromCHA(cs, vfns);
494 else
497}
bool isVirtualCall() const
Definition ICFGNode.h:521
static const Option< bool > ConnectVCallOnCHA
Definition Options.h:133
void getVFnsFromPts(const CallICFGNode *cs, const PointsTo &target, VFunSet &vfns)
void connectVCallToVFns(const CallICFGNode *cs, const VFunSet &vfns, CallEdgeMap &newEdges)
void getVFnsFromCHA(const CallICFGNode *cs, VFunSet &vfns)
Set< const FunObjVar * > VFunSet
Definition CHG.h:47

◆ resolveIndCalls()

void PointerAnalysis::resolveIndCalls ( const CallICFGNode cs,
const PointsTo target,
CallEdgeMap newEdges 
)
virtual

Resolve indirect call edges.

Resolve indirect calls

discover indirect pointer target

Definition at line 375 of file PointerAnalysis.cpp.

376{
377
378 assert(pag->isIndirectCallSites(cs) && "not an indirect callsite?");
380 for (PointsTo::iterator ii = target.begin(), ie = target.end();
381 ii != ie; ii++)
382 {
383
385 {
386 wrnMsg("Resolved Indirect Call Edges are Out-Of-Budget, please increase the limit");
387 return;
388 }
389
390 if(ObjVar* objPN = SVFUtil::dyn_cast<ObjVar>(pag->getGNode(*ii)))
391 {
392 const BaseObjVar* obj = pag->getBaseObject(objPN->getId());
393
394 if(obj->isFunction())
395 {
396 const FunObjVar* calleefun = SVFUtil::cast<FunObjVar>(obj)->getFunction();
398
399 if(SVFUtil::matchArgs(cs, callee) == false)
400 continue;
401
402 if(0 == getIndCallMap()[cs].count(callee))
403 {
404 newEdges[cs].insert(callee);
405 getIndCallMap()[cs].insert(callee);
406
408 // FIXME: do we need to update llvm call graph here?
409 // The indirect call is maintained by ourself, We may update llvm's when we need to
410 //PTACallGraphNode* callgraphNode = callgraph->getOrInsertFunction(cs.getCaller());
411 //callgraphNode->addCalledFunction(cs,callgraph->getOrInsertFunction(callee));
412 }
413 }
414 }
415 }
416}
int count
Definition cJSON.h:216
virtual const FunObjVar * getFunction() const
Get containing function, or null for globals/constants.
static const Option< u32_t > IndirectCallLimit
Definition Options.h:128
u32_t getNumOfResolvedIndCallEdge() const
Return number of resolved indirect call edges.
bool isIndirectCallSites(const CallICFGNode *cs) const
Definition SVFIR.h:394
bool matchArgs(const CallICFGNode *cs, const FunObjVar *callee)
Definition SVFUtil.cpp:308
std::string wrnMsg(const std::string &msg)
Returns warning message by converting a string into yellow string output.
Definition SVFUtil.cpp:63

◆ setObjFieldInsensitive()

void SVF::PointerAnalysis::setObjFieldInsensitive ( NodeID  id)
inline

Definition at line 333 of file PointerAnalysis.h.

334 {
335 BaseObjVar* baseObj = const_cast<BaseObjVar*>(pag->getBaseObject(id));
336 baseObj->setFieldInsensitive();
337 }

◆ validateExpectedFailureTests()

void PointerAnalysis::validateExpectedFailureTests ( std::string  fun)
protectedvirtual

Pointer analysis validator

Definition at line 568 of file PointerAnalysis.cpp.

569{
570
571 if (const FunObjVar* checkFun = pag->getFunObjVar(fun))
572 {
573 if(!checkFun->isUncalledFunction())
574 outs() << "[" << this->PTAName() << "] Checking " << fun << "\n";
575
576 for(const CallICFGNode* callNode : pag->getCallSiteSet())
577 {
578 if (callNode->getCalledFunction() == checkFun)
579 {
580 assert(callNode->arg_size() == 2
581 && "arguments should be two pointers!!");
582 const SVFVar* V1 = callNode->getArgument(0);
583 const SVFVar* V2 = callNode->getArgument(1);
584 AliasResult aliasRes = alias(V1->getId(), V2->getId());
585
586 bool expectedFailure = false;
588 {
589 // change to must alias when our analysis support it
591 expectedFailure = true;
592 }
593 else if (fun == aliasTestFailNoAlias || fun == aliasTestFailNoAliasMangled)
594 {
595 // change to partial alias when our analysis support it
597 expectedFailure = true;
598 }
599 else
600 assert(false && "not supported alias check!!");
601
602 NodeID id1 = V1->getId();
603 NodeID id2 = V2->getId();
604
605 if (expectedFailure)
606 outs() << sucMsg("\t EXPECTED-FAILURE :") << fun << " check <id:" << id1 << ", id:" << id2 << "> at ("
607 << callNode->getSourceLoc() << ")\n";
608 else
609 {
610 SVFUtil::errs() << errMsg("\t UNEXPECTED FAILURE :") << fun << " check <id:" << id1 << ", id:" << id2 << "> at ("
611 << callNode->getSourceLoc() << ")\n";
612 assert(false && "test case failed!");
613 }
614 }
615 }
616 }
617}
static const std::string aliasTestFailNoAlias
static const std::string aliasTestFailMayAlias
static const std::string aliasTestFailMayAliasMangled
virtual AliasResult alias(const SVFVar *V1, const SVFVar *V2)=0
Interface exposed to users of our pointer analysis, given Value infos.
virtual const std::string PTAName() const
Return PTA name.
static const std::string aliasTestFailNoAliasMangled
const FunObjVar * getFunObjVar(const std::string &name)
Definition SVFIR.cpp:47
std::string sucMsg(const std::string &msg)
Returns successful message by converting a string into green string output.
Definition SVFUtil.cpp:55
std::string errMsg(const std::string &msg)
Print error message by converting a string into red string output.
Definition SVFUtil.cpp:78
std::ostream & errs()
Overwrite llvm::errs()
Definition SVFUtil.h:58
AliasResult
Definition SVFType.h:541
@ PartialAlias
Definition SVFType.h:545
@ MustAlias
Definition SVFType.h:544
@ MayAlias
Definition SVFType.h:543
@ NoAlias
Definition SVFType.h:542

◆ validateSuccessTests()

void PointerAnalysis::validateSuccessTests ( std::string  fun)
protectedvirtual

Find the alias check functions annotated in the C files check whether the alias analysis results consistent with the alias check function itself

Definition at line 503 of file PointerAnalysis.cpp.

504{
505 // check for must alias cases, whether our alias analysis produce the correct results
506 if (const FunObjVar* checkFun = pag->getFunObjVar(fun))
507 {
508 if(!checkFun->isUncalledFunction())
509 outs() << "[" << this->PTAName() << "] Checking " << fun << "\n";
510
511 for(const CallICFGNode* callNode : pag->getCallSiteSet())
512 {
513 if (callNode->getCalledFunction() == checkFun)
514 {
515 assert(callNode->getNumArgOperands() == 2
516 && "arguments should be two pointers!!");
517 const SVFVar* V1 = callNode->getArgument(0);
518 const SVFVar* V2 = callNode->getArgument(1);
519 AliasResult aliasRes = alias(V1->getId(), V2->getId());
520
521 bool checkSuccessful = false;
522 if (fun == aliasTestMayAlias || fun == aliasTestMayAliasMangled)
523 {
525 checkSuccessful = true;
526 }
527 else if (fun == aliasTestNoAlias || fun == aliasTestNoAliasMangled)
528 {
530 checkSuccessful = true;
531 }
532 else if (fun == aliasTestMustAlias || fun == aliasTestMustAliasMangled)
533 {
534 // change to must alias when our analysis support it
536 checkSuccessful = true;
537 }
538 else if (fun == aliasTestPartialAlias || fun == aliasTestPartialAliasMangled)
539 {
540 // change to partial alias when our analysis support it
542 checkSuccessful = true;
543 }
544 else
545 assert(false && "not supported alias check!!");
546
547 NodeID id1 = V1->getId();
548 NodeID id2 = V2->getId();
549
550 if (checkSuccessful)
551 outs() << sucMsg("\t SUCCESS :") << fun << " check <id:" << id1 << ", id:" << id2 << "> at ("
552 << callNode->getSourceLoc() << ")\n";
553 else
554 {
555 SVFUtil::errs() << errMsg("\t FAILURE :") << fun
556 << " check <id:" << id1 << ", id:" << id2
557 << "> at (" << callNode->getSourceLoc() << ")\n";
558 assert(false && "test case failed!");
559 }
560 }
561 }
562 }
563}
static const std::string aliasTestNoAliasMangled
static const std::string aliasTestMayAliasMangled
static const std::string aliasTestMustAlias
static const std::string aliasTestMayAlias
static const std::string aliasTestPartialAlias
static const std::string aliasTestNoAlias
static const std::string aliasTestPartialAliasMangled
static const std::string aliasTestMustAliasMangled

◆ validateTests()

void PointerAnalysis::validateTests ( )
protectedvirtual

Member Data Documentation

◆ alias_validation

bool SVF::PointerAnalysis::alias_validation
protected

Flag for validating points-to/alias results.

Definition at line 134 of file PointerAnalysis.h.

◆ aliasTestFailMayAlias

const std::string PointerAnalysis::aliasTestFailMayAlias = "EXPECTEDFAIL_MAYALIAS"
static

Definition at line 118 of file PointerAnalysis.h.

◆ aliasTestFailMayAliasMangled

const std::string PointerAnalysis::aliasTestFailMayAliasMangled = "_Z21EXPECTEDFAIL_MAYALIASPvS_"
static

Definition at line 119 of file PointerAnalysis.h.

◆ aliasTestFailNoAlias

const std::string PointerAnalysis::aliasTestFailNoAlias = "EXPECTEDFAIL_NOALIAS"
static

Definition at line 120 of file PointerAnalysis.h.

◆ aliasTestFailNoAliasMangled

const std::string PointerAnalysis::aliasTestFailNoAliasMangled = "_Z20EXPECTEDFAIL_NOALIASPvS_"
static

Definition at line 121 of file PointerAnalysis.h.

◆ aliasTestMayAlias

const std::string PointerAnalysis::aliasTestMayAlias = "MAYALIAS"
static

Definition at line 110 of file PointerAnalysis.h.

◆ aliasTestMayAliasMangled

const std::string PointerAnalysis::aliasTestMayAliasMangled = "_Z8MAYALIASPvS_"
static

Definition at line 111 of file PointerAnalysis.h.

◆ aliasTestMustAlias

const std::string PointerAnalysis::aliasTestMustAlias = "MUSTALIAS"
static

Definition at line 116 of file PointerAnalysis.h.

◆ aliasTestMustAliasMangled

const std::string PointerAnalysis::aliasTestMustAliasMangled = "_Z9MUSTALIASPvS_"
static

Definition at line 117 of file PointerAnalysis.h.

◆ aliasTestNoAlias

const std::string PointerAnalysis::aliasTestNoAlias = "NOALIAS"
static

Definition at line 112 of file PointerAnalysis.h.

◆ aliasTestNoAliasMangled

const std::string PointerAnalysis::aliasTestNoAliasMangled = "_Z7NOALIASPvS_"
static

Definition at line 113 of file PointerAnalysis.h.

◆ aliasTestPartialAlias

const std::string PointerAnalysis::aliasTestPartialAlias = "PARTIALALIAS"
static

Definition at line 114 of file PointerAnalysis.h.

◆ aliasTestPartialAliasMangled

const std::string PointerAnalysis::aliasTestPartialAliasMangled = "_Z12PARTIALALIASPvS_"
static

Definition at line 115 of file PointerAnalysis.h.

◆ callgraph

CallGraph* SVF::PointerAnalysis::callgraph
protected

Call graph used for pointer analysis.

Definition at line 148 of file PointerAnalysis.h.

◆ callGraphSCC

CallGraphSCC* SVF::PointerAnalysis::callGraphSCC
protected

SCC for PTACallGraph.

Definition at line 150 of file PointerAnalysis.h.

◆ chgraph

CommonCHGraph* SVF::PointerAnalysis::chgraph
protected

CHGraph.

Definition at line 154 of file PointerAnalysis.h.

◆ icfg

ICFG* SVF::PointerAnalysis::icfg
protected

Interprocedural control-flow graph.

Definition at line 152 of file PointerAnalysis.h.

◆ OnTheFlyIterBudgetForStat

u32_t SVF::PointerAnalysis::OnTheFlyIterBudgetForStat
protected

Flag for iteration budget for on-the-fly statistics.

Definition at line 136 of file PointerAnalysis.h.

◆ pag

SVFIR * PointerAnalysis::pag = nullptr
staticprotected

SVFIR.

Definition at line 140 of file PointerAnalysis.h.

◆ print_stat

bool SVF::PointerAnalysis::print_stat
protected

User input flags.

Flag for printing the statistic results

Definition at line 132 of file PointerAnalysis.h.

◆ ptaImplTy

PTAImplTy SVF::PointerAnalysis::ptaImplTy
protected

PTA implementation type.

Definition at line 144 of file PointerAnalysis.h.

◆ ptaTy

PTATY SVF::PointerAnalysis::ptaTy
protected

Pointer analysis Type.

Definition at line 142 of file PointerAnalysis.h.

◆ stat

PTAStat* SVF::PointerAnalysis::stat
protected

Statistics.

Definition at line 146 of file PointerAnalysis.h.


The documentation for this class was generated from the following files: