SVF::SVFIRBuilder Class Reference

#include <SVFIRBuilder.h>

Inheritance diagram for SVF::SVFIRBuilder:

Public Member Functions
	SVFIRBuilder ()
	Constructor.
virtual	~SVFIRBuilder ()
	Destructor.
virtual SVFIR *	build ()
	Start building SVFIR here.
SVFIR *	getPAG () const
	Return SVFIR.
void	createFunObjVars ()
void	initFunObjVar ()
void	initialiseNodes ()
	Initialize nodes and edges.
void	initialiseBaseObjVars ()
void	initialiseValVars ()
void	initSVFBasicBlock (const Function *func)
void	initDomTree (FunObjVar *func, const Function *f)
void	addEdge (NodeID src, NodeID dst, SVFStmt::PEDGEK kind, APOffset offset=0, Instruction *cs=nullptr)
void	sanityCheck ()
	Sanity check for SVFIR.
NodeID	getValueNode (const Value *V)
	Get different kinds of node.
NodeID	getObjectNode (const Value *V)
	GetObject - Return the object node (stack/global/heap/function) according to a LLVM Value.
NodeID	getReturnNode (const FunObjVar *func)
	getReturnNode - Return the node representing the unique return value of a function.
NodeID	getVarargNode (const FunObjVar *func)
	getVarargNode - Return the node representing the unique variadic argument of a function.
virtual void	visitAllocaInst (AllocaInst &AI)
	Our visit overrides.
void	visitPHINode (PHINode &I)
void	visitStoreInst (StoreInst &I)
void	visitLoadInst (LoadInst &I)
void	visitGetElementPtrInst (GetElementPtrInst &I)
void	visitCallInst (CallInst &I)
void	visitInvokeInst (InvokeInst &II)
void	visitCallBrInst (CallBrInst &I)
void	visitCallSite (CallBase *cs)
void	visitReturnInst (ReturnInst &I)
void	visitCastInst (CastInst &I)
void	visitSelectInst (SelectInst &I)
void	visitExtractValueInst (ExtractValueInst &EVI)
void	visitBranchInst (BranchInst &I)
void	visitSwitchInst (SwitchInst &I)
	Preserve LLVM switch destinations and case values in BranchStmt.
void	visitInsertValueInst (InsertValueInst &I)
void	visitBinaryOperator (BinaryOperator &I)
void	visitUnaryOperator (UnaryOperator &I)
void	visitCmpInst (CmpInst &I)
void	visitVAArgInst (VAArgInst &)
void	visitVACopyInst (VACopyInst &)
void	visitVAEndInst (VAEndInst &)
void	visitVAStartInst (VAStartInst &)
void	visitFreezeInst (FreezeInst &I)
void	visitExtractElementInst (ExtractElementInst &I)
void	visitInsertElementInst (InsertElementInst &I)
void	visitShuffleVectorInst (ShuffleVectorInst &I)
void	visitLandingPadInst (LandingPadInst &I)
void	visitResumeInst (ResumeInst &)
	Instruction not that often.
void	visitUnreachableInst (UnreachableInst &)
void	visitFenceInst (FenceInst &I)
void	visitAtomicCmpXchgInst (AtomicCmpXchgInst &I)
void	visitAtomicRMWInst (AtomicRMWInst &I)
void	visitInstruction (Instruction &)
	Provide base case for our instruction visit.
void	updateCallGraph (CallGraph *callgraph)
	connect PAG edges based on callgraph

Protected Member Functions
void	visitGlobal ()
	Handle globals including (global variable and functions)
void	InitialGlobal (const GlobalVariable *gvar, Constant *C, u32_t offset)
NodeID	getGlobalVarField (const GlobalVariable *gvar, u32_t offset, SVFType *tpy)
void	processCE (const Value *val)
	Process constant expression.
u32_t	inferFieldIdxFromByteOffset (const llvm::GEPOperator *gepOp, DataLayout *dl, AccessPath &ap, APOffset idx)
	Infer field index from byteoffset.
bool	computeGepOffset (const User *V, AccessPath &ap)
	Compute offset of a gep instruction or gep constant expression.
const Value *	getBaseValueForExtArg (const Value *V)
	Get the base value of (i8* src and i8* dst) for external argument (e.g. memcpy(i8* dst, i8* src, int size))
void	handleDirectCall (CallBase *cs, const Function *F)
	Handle direct call.
void	handleIndCall (CallBase *cs)
	Handle indirect call.
virtual const Type *	getBaseTypeAndFlattenedFields (const Value *V, std::vector< AccessPath > &fields, const Value *szValue)
	Handle external call.
virtual void	addComplexConsForExt (Value *D, Value *S, const Value *sz)
virtual void	handleNondetArgStoreAtExtCall (const CallBase *cs, const CallICFGNode *callICFGNode)
virtual void	handleExtCall (const CallBase *cs, const Function *callee)
void	setCurrentLocation (const Value *val, const BasicBlock *bb)
	Set current basic block in order to keep track of control flow information.
void	setCurrentLocation (const Value *val, const SVFBasicBlock *bb)
const Value *	getCurrentValue () const
const SVFBasicBlock *	getCurrentBB () const
void	addGlobalBlackHoleAddrEdge (NodeID node, const ConstantExpr *int2Ptrce)
	Add global black hole Address edge.
NodeID	addNullPtrNode ()
	Add NullPtr PAGNode.
NodeID	getGepValVar (const Value *val, const AccessPath &ap, const SVFType *elementType)
NodeID	getDirectAccessFieldZeroValVar (const Value *ptr, const Type *accessTy)
void	setCurrentBBAndValueForPAGEdge (PAGEdge *edge)
void	addBlackHoleAddrEdge (NodeID node)
AddrStmt *	addAddrEdge (NodeID src, NodeID dst)
	Add Address edge.
AddrStmt *	addAddrWithStackArraySz (NodeID src, NodeID dst, llvm::AllocaInst &inst)
	Add Address edge from allocinst with arraysize like "%4 = alloca i8, i64 3".
AddrStmt *	addAddrWithHeapSz (NodeID src, NodeID dst, const CallBase *cs)
	Add Address edge from ext call with args like "%5 = call i8* @malloc(i64 noundef 5)".
CopyStmt *	addCopyEdge (NodeID src, NodeID dst, CopyStmt::CopyKind kind)
CopyStmt::CopyKind	getCopyKind (const Value *val)
void	addPhiStmt (NodeID res, NodeID opnd, const ICFGNode *pred)
	Add Copy edge.
void	addSelectStmt (NodeID res, NodeID op1, NodeID op2, NodeID cond)
	Add SelectStmt.
void	addCmpEdge (NodeID op1, NodeID op2, NodeID dst, u32_t predict)
	Add Copy edge.
void	addBinaryOPEdge (NodeID op1, NodeID op2, NodeID dst, u32_t opcode)
	Add Copy edge.
void	addUnaryOPEdge (NodeID src, NodeID dst, u32_t opcode)
	Add Unary edge.
void	addBranchStmt (NodeID br, NodeID cond, const BranchStmt::SuccAndCondPairVec &succs)
	Add Branch statement.
void	addLoadEdge (NodeID src, NodeID dst)
	Add Load edge.
void	addStoreEdge (NodeID src, NodeID dst)
	Add Store edge.
void	addCallEdge (NodeID src, NodeID dst, const CallICFGNode *cs, const FunEntryICFGNode *entry)
	Add Call edge.
void	addRetEdge (NodeID src, NodeID dst, const CallICFGNode *cs, const FunExitICFGNode *exit)
	Add Return edge.
void	addGepEdge (NodeID src, NodeID dst, const AccessPath &ap, bool constGep)
	Add Gep edge.
void	addNormalGepEdge (NodeID src, NodeID dst, const AccessPath &ap)
	Add Offset(Gep) edge.
void	addVariantGepEdge (NodeID src, NodeID dst, const AccessPath &ap)
	Add Variant(Gep) edge.
void	addThreadForkEdge (NodeID src, NodeID dst, const CallICFGNode *cs, const FunEntryICFGNode *entry)
	Add Thread fork edge for parameter passing.
void	addThreadJoinEdge (NodeID src, NodeID dst, const CallICFGNode *cs, const FunExitICFGNode *exit)
	Add Thread join edge for parameter passing.
AccessPath	getAccessPathFromBaseNode (NodeID nodeId)

Private Types
using	AggregateField = std::vector< unsigned >
using	AggregateFieldKey = std::pair< const Value *, AggregateField >
	Identify a field by its LLVM value and path, rather than by its type alone.
using	AggregateReturnFields = Map< const Function *, std::set< AggregateField > >
	Field paths extracted from each callee's returned aggregate.

Private Member Functions
bool	getAggregateFieldOperands (const AggregateFieldKey &field, std::vector< AggregateFieldKey > &operands)
	Describe one field definition without emitting any SVFIR statements.
bool	getAggregateFieldNode (const Value *aggregate, const AggregateField &indices, NodeID &node)
void	addExtractedFieldCopy (Instruction &inst)
void	initialiseAggregateReturns ()
AggregateReturnFields	discoverAggregateReturnFields ()
void	createAggregateReturnParams (const Function *fun, const std::set< AggregateField > &fields, const SVFType *pointerType)
void	createAggregateCallSlots (const Function *fun, const SVFType *pointerType)
void	addAggregateCallFields (const CallInst *call)
void	addAggregateReturnStores (ReturnInst &inst)
LLVMModuleSet *	llvmModuleSet ()

Static Private Member Functions
static std::optional< AggregateFieldKey >	getExtractedField (const Instruction &inst)
	Decode a pointer extraction; unsupported instructions have no field.

Private Attributes
SVFIR *	pag
const SVFBasicBlock *	curBB
	Current basic block during SVFIR construction when visiting the module.
const Value *	curVal
	Current Value during SVFIR construction when visiting the module.
Map< AggregateFieldKey, NodeID >	aggregateFieldNodes
	Reuse the same scalar SVFIR node for repeated requests for a field.
Map< const Function *, std::map< AggregateField, NodeID > >	aggregateReturnParams
	Output parameters of each modeled callee, in field-path order.
Map< const CallInst *, std::map< AggregateField, NodeID > >	aggregateCallArgs

Friends
class	GraphDBSVFIRBuilder

Detailed Description

SVFIR Builder to create SVF variables and statements and PAG

Definition at line 49 of file SVFIRBuilder.h.

Member Typedef Documentation

AggregateField

using SVF::SVFIRBuilder::AggregateField = std::vector<unsigned>

private

Zero-based indices through nested structs, arrays or fixed vector lanes. For {i32, {ptr, ptr}}, {1, 0} selects the first pointer in the inner struct. An empty path denotes a scalar pointer leaf during dependency traversal.

Definition at line 62 of file SVFIRBuilder.h.

AggregateFieldKey

using SVF::SVFIRBuilder::AggregateFieldKey = std::pair<const Value*, AggregateField>

private

Identify a field by its LLVM value and path, rather than by its type alone.

Definition at line 64 of file SVFIRBuilder.h.

AggregateReturnFields

using SVF::SVFIRBuilder::AggregateReturnFields = Map<const Function*, std::set<AggregateField> >

private

Field paths extracted from each callee's returned aggregate.

Definition at line 138 of file SVFIRBuilder.h.

Constructor & Destructor Documentation

SVFIRBuilder()

SVF::SVFIRBuilder::SVFIRBuilder ( )

inline

Constructor.

Definition at line 153 of file SVFIRBuilder.h.

                  : pag(SVFIR::getPAG()), curBB(nullptr),curVal(nullptr)
    {
    }

~SVFIRBuilder()

virtual SVF::SVFIRBuilder::~SVFIRBuilder ( )

inlinevirtual

Destructor.

Definition at line 157 of file SVFIRBuilder.h.

    {
    }

Member Function Documentation

addAddrEdge()

AddrStmt * SVF::SVFIRBuilder::addAddrEdge ( NodeID  src, NodeID  dst  )

inlineprotected

Add Address edge.

Definition at line 406 of file SVFIRBuilder.h.

    {
        if(AddrStmt *edge = pag->addAddrStmt(src, dst))
        {
            setCurrentBBAndValueForPAGEdge(edge);
            return edge;
        }
        return nullptr;
    }

addAddrWithHeapSz()

AddrStmt * SVF::SVFIRBuilder::addAddrWithHeapSz ( NodeID  src, NodeID  dst, const CallBase *  cs  )

inlineprotected

Add Address edge from ext call with args like "%5 = call i8* @malloc(i64 noundef 5)".

Definition at line 428 of file SVFIRBuilder.h.

    {
        // get name of called function
        AddrStmt* edge = addAddrEdge(src, dst);
 
        llvm::Function* calledFunc = cs->getCalledFunction();
        std::string functionName;
        if (calledFunc)
        {
            functionName = calledFunc->getName().str();
        }
        else
        {
            SVFUtil::writeWrnMsg("not support indirect call to add AddrStmt.\n");
        }
        if (functionName == "malloc")
        {
            if (cs->arg_size() > 0)
            {
                const llvm::Value* val = cs->getArgOperand(0);
                edge->addArrSize(pag->getGNode(getValueNode(val)));
            }
        }
        // Check if the function called is 'calloc' and process its arguments.
        // e.g. "%5 = call i8* @calloc(1, 8)", edge should add two SVFValue (1 and 8)
        else if (functionName == "calloc")
        {
            if (cs->arg_size() > 1)
            {
                edge->addArrSize(
                    pag->getGNode(getValueNode(cs->getArgOperand(0))));
                edge->addArrSize(
                    pag->getGNode(getValueNode(cs->getArgOperand(1))));
            }
        }
        else
        {
            if (cs->arg_size() > 0)
            {
                const llvm::Value* val = cs->getArgOperand(0);
                edge->addArrSize(pag->getGNode(getValueNode(val)));
            }
        }
        return edge;
    }

addAddrWithStackArraySz()

AddrStmt * SVF::SVFIRBuilder::addAddrWithStackArraySz ( NodeID  src, NodeID  dst, llvm::AllocaInst &  inst  )

inlineprotected

Add Address edge from allocinst with arraysize like "%4 = alloca i8, i64 3".

Definition at line 417 of file SVFIRBuilder.h.

    {
        AddrStmt* edge = addAddrEdge(src, dst);
        if (inst.getArraySize())
        {
            edge->addArrSize(pag->getGNode(getValueNode(inst.getArraySize())));
        }
        return edge;
    }

addAggregateCallFields()

void SVFIRBuilder::addAggregateCallFields ( const CallInst *  call )

private

Append the slot addresses of call as actual output arguments and pass each to the callee's output parameter. createAggregateCallSlots has already created the slots, their addresses and the snapshot loads.

Definition at line 1731 of file SVFIRBuilder.cpp.

{
    auto found = aggregateCallArgs.find(call);
    if (found == aggregateCallArgs.end())
        return;
    CallICFGNode* callNode = llvmModuleSet()->getCallICFGNode(call);
    const FunObjVar* callee = llvmModuleSet()->getFunObjVar(call->getCalledFunction());
    FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(callee);
    const auto& params = aggregateReturnParams.at(call->getCalledFunction());
    for (const auto& arg : found->second)
    {
        pag->addCallSiteArgs(callNode, pag->getValVar(arg.second));
        addCallEdge(arg.second, params.at(arg.first), callNode, entry);
    }
}

addAggregateReturnStores()

void SVFIRBuilder::addAggregateReturnStores ( ReturnInst &  inst )

private

Store shared field nodes into the callee's output parameters. An unsupported field gets its own fallback; supported siblings keep their shared definitions.

Definition at line 1749 of file SVFIRBuilder.cpp.

{
    auto found = aggregateReturnParams.find(inst.getFunction());
    if (found == aggregateReturnParams.end() || !inst.getReturnValue())
        return;
    // Keep each store on its own return path, before the shared function exit.
    ICFGNode* location = llvmModuleSet()->getICFGNode(&inst);
    for (const auto& field : found->second)
    {
        NodeID value;
        if (!getAggregateFieldNode(inst.getReturnValue(), field.first, value))
        {
            value = pag->addDummyValNode(NodeIDAllocator::get()->allocateValueId(), location);
            addBlackHoleAddrEdge(value);
        }
        addStoreEdge(value, field.second);
    }
}

addBinaryOPEdge()

void SVF::SVFIRBuilder::addBinaryOPEdge ( NodeID  op1, NodeID  op2, NodeID  dst, u32_t  opcode  )

inlineprotected

Add Copy edge.

Definition at line 541 of file SVFIRBuilder.h.

    {
        if(BinaryOPStmt *edge = pag->addBinaryOPStmt(op1, op2, dst, opcode))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addBlackHoleAddrEdge()

void SVF::SVFIRBuilder::addBlackHoleAddrEdge ( NodeID  node )

inlineprotected

Definition at line 399 of file SVFIRBuilder.h.

    {
        if(PAGEdge *edge = pag->addBlackHoleAddrStmt(node))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addBranchStmt()

void SVF::SVFIRBuilder::addBranchStmt ( NodeID  br, NodeID  cond, const BranchStmt::SuccAndCondPairVec &  succs  )

inlineprotected

Add Branch statement.

Definition at line 553 of file SVFIRBuilder.h.

    {
        if(BranchStmt *edge = pag->addBranchStmt(br, cond, succs))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addCallEdge()

void SVF::SVFIRBuilder::addCallEdge ( NodeID  src, NodeID  dst, const CallICFGNode *  cs, const FunEntryICFGNode *  entry  )

inlineprotected

Add Call edge.

Definition at line 577 of file SVFIRBuilder.h.

    {
        if (CallPE* edge = pag->addCallPE(src, dst, cs, entry))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addCmpEdge()

void SVF::SVFIRBuilder::addCmpEdge ( NodeID  op1, NodeID  op2, NodeID  dst, u32_t  predict  )

inlineprotected

Add Copy edge.

Definition at line 535 of file SVFIRBuilder.h.

    {
        if(CmpStmt *edge = pag->addCmpStmt(op1, op2, dst, predict))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addComplexConsForExt()

void SVFIRBuilder::addComplexConsForExt ( Value *  D, Value *  S, const Value *  szValue  )

protectedvirtual

Add the load/store constraints and temp. nodes for the complex constraint *D = *S (where D/S may point to structs).

If sz is 0, we will add edges for all fields.

Definition at line 318 of file SVFIRExtAPI.cpp.

{
    assert(D && S);
    NodeID vnD= getValueNode(D), vnS= getValueNode(S);
    if(!vnD || !vnS)
        return;
 
    std::vector<AccessPath> fields;
 
    //Get the max possible size of the copy, unless it was provided.
    std::vector<AccessPath> srcFields;
    std::vector<AccessPath> dstFields;
    const Type* stype = getBaseTypeAndFlattenedFields(S, srcFields, szValue);
    const Type* dtype = getBaseTypeAndFlattenedFields(D, dstFields, szValue);
    if(srcFields.size() > dstFields.size())
        fields = dstFields;
    else
        fields = srcFields;
 
    u32_t sz = fields.size();
 
    if (fields.size() == 1 && (LLVMUtil::isConstDataOrAggData(D) || LLVMUtil::isConstDataOrAggData(S)))
    {
        NodeID dummy = pag->addDummyValNode();
        addLoadEdge(vnD,dummy);
        addStoreEdge(dummy,vnS);
        return;
    }
 
    const Value* dstBase = getBaseValueForExtArg(D);
    const Value* srcBase = getBaseValueForExtArg(S);
    Value* dstFieldBase = LLVMUtil::isObject(dstBase) ? const_cast<Value*>(dstBase) : D;
    Value* srcFieldBase = LLVMUtil::isObject(srcBase) ? const_cast<Value*>(srcBase) : S;
    const Type* dstLayoutType = getMemcpyLayoutType(dstBase, dtype);
    const Type* srcLayoutType = getMemcpyLayoutType(srcBase, stype);
    const bool hasRemappedGlobalBase =
        (dstFieldBase != D && SVFUtil::isa<GlobalVariable>(dstFieldBase)) ||
        (srcFieldBase != S && SVFUtil::isa<GlobalVariable>(srcFieldBase));
    const bool useByteLayoutMemcpy =
        hasRemappedGlobalBase || (dstLayoutType != dtype) || (srcLayoutType != stype);
    if (useByteLayoutMemcpy)
    {
        const SVFType* dstSVFType = llvmModuleSet()->getSVFType(dstLayoutType);
        const SVFType* srcSVFType = llvmModuleSet()->getSVFType(srcLayoutType);
        std::vector<MemcpyField> dstMemcpyFields = getMemcpyFields(D, dstLayoutType, dstSVFType);
        std::vector<MemcpyField> srcMemcpyFields = getMemcpyFields(S, srcLayoutType, srcSVFType);
        if (!dstMemcpyFields.empty() && !srcMemcpyFields.empty())
        {
            std::unordered_map<APOffset, MemcpyField> srcFieldsByByteOffset;
            for (const auto& field : srcMemcpyFields)
                srcFieldsByByteOffset.emplace(field.byteOffset, field);
 
            const DataLayout& dl = llvmModuleSet()->getMainLLVMModule()->getDataLayout();
            APOffset copyBytes = std::min<APOffset>(
                                     static_cast<APOffset>(dl.getTypeAllocSize(const_cast<Type*>(dstLayoutType))),
                                     static_cast<APOffset>(dl.getTypeAllocSize(const_cast<Type*>(srcLayoutType))));
            if (szValue && SVFUtil::isa<ConstantInt>(szValue))
            {
                auto szIntVal = LLVMUtil::getIntegerValue(SVFUtil::cast<ConstantInt>(szValue));
                copyBytes = std::min(copyBytes, static_cast<APOffset>(szIntVal.first));
            }
 
            for (const auto& dstField : dstMemcpyFields)
            {
                if (dstField.byteOffset >= copyBytes)
                    continue;
                auto it = srcFieldsByByteOffset.find(dstField.byteOffset);
                if (it == srcFieldsByByteOffset.end())
                    continue;
 
                NodeID dField = getGepValVar(dstFieldBase, dstField.accessPath, dstField.elementType);
                NodeID sField = getGepValVar(srcFieldBase, it->second.accessPath, it->second.elementType);
                NodeID dummy = pag->addDummyValNode();
                addLoadEdge(sField, dummy);
                addStoreEdge(dummy, dField);
            }
            return;
        }
    }
 
    //For each field (i), add (Ti = *S + i) and (*D + i = Ti).
    for (u32_t index = 0; index < sz; index++)
    {
        LLVMModuleSet* llvmmodule = LLVMModuleSet::getLLVMModuleSet();
        const SVFType* dElementType = pag->getFlatternedElemType(llvmmodule->getSVFType(dtype),
                                      fields[index].getConstantStructFldIdx());
        const SVFType* sElementType = pag->getFlatternedElemType(llvmmodule->getSVFType(stype),
                                      fields[index].getConstantStructFldIdx());
        NodeID dField = getGepValVar(D,fields[index],dElementType);
        NodeID sField = getGepValVar(S,fields[index],sElementType);
        NodeID dummy = pag->addDummyValNode();
        addLoadEdge(sField,dummy);
        addStoreEdge(dummy,dField);
    }
}

addCopyEdge()

CopyStmt * SVF::SVFIRBuilder::addCopyEdge ( NodeID  src, NodeID  dst, CopyStmt::CopyKind  kind  )

inlineprotected

Definition at line 474 of file SVFIRBuilder.h.

    {
        if(CopyStmt *edge = pag->addCopyStmt(src, dst, kind))
        {
            setCurrentBBAndValueForPAGEdge(edge);
            return edge;
        }
        return nullptr;
    }

addEdge()

void SVF::SVFIRBuilder::addEdge	(	NodeID	src,
		NodeID	dst,
		SVFStmt::PEDGEK	kind,
		APOffset	offset = 0,
		Instruction *	cs = nullptr
	)

addExtractedFieldCopy()

void SVFIRBuilder::addExtractedFieldCopy ( Instruction &  inst )

private

Copy an extracted pointer from its shared field definition. Unsupported fields keep the existing black-hole fallback.

Definition at line 1797 of file SVFIRBuilder.cpp.

{
    NodeID dst = getValueNode(&inst);
    const auto field = getExtractedField(inst);
    NodeID src;
    if (field && getAggregateFieldNode(field->first, field->second, src))
        addCopyEdge(src, dst, CopyStmt::COPYVAL);
    else
        addBlackHoleAddrEdge(dst);
}

addGepEdge()

void SVF::SVFIRBuilder::addGepEdge ( NodeID  src, NodeID  dst, const AccessPath &  ap, bool  constGep  )

inlineprotected

Add Gep edge.

Definition at line 589 of file SVFIRBuilder.h.

    {
        if (GepStmt* edge = pag->addGepStmt(src, dst, ap, constGep))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addGlobalBlackHoleAddrEdge()

void SVF::SVFIRBuilder::addGlobalBlackHoleAddrEdge ( NodeID  node, const ConstantExpr *  int2Ptrce  )

inlineprotected

Add global black hole Address edge.

Definition at line 372 of file SVFIRBuilder.h.

    {
        const Value* cval = getCurrentValue();
        const SVFBasicBlock* cbb = getCurrentBB();
        setCurrentLocation(int2Ptrce,(SVFBasicBlock*) nullptr);
        addBlackHoleAddrEdge(node);
        setCurrentLocation(cval,cbb);
    }

addLoadEdge()

void SVF::SVFIRBuilder::addLoadEdge ( NodeID  src, NodeID  dst  )

inlineprotected

Add Load edge.

Definition at line 559 of file SVFIRBuilder.h.

    {
        if(LoadStmt *edge = pag->addLoadStmt(src, dst))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addNormalGepEdge()

void SVF::SVFIRBuilder::addNormalGepEdge ( NodeID  src, NodeID  dst, const AccessPath &  ap  )

inlineprotected

Add Offset(Gep) edge.

Definition at line 595 of file SVFIRBuilder.h.

    {
        if (GepStmt* edge = pag->addNormalGepStmt(src, dst, ap))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addNullPtrNode()

NodeID SVF::SVFIRBuilder::addNullPtrNode ( )

inlineprotected

Add NullPtr PAGNode.

Definition at line 382 of file SVFIRBuilder.h.

    {
        LLVMContext& cxt = llvmModuleSet()->getContext();
        ConstantPointerNull* constNull = ConstantPointerNull::get(PointerType::getUnqual(cxt));
        NodeID nullPtr = pag->addConstantNullPtrValNode(pag->getNullPtr(), nullptr, llvmModuleSet()->getSVFType(constNull->getType()));
        llvmModuleSet()->addToSVFVar2LLVMValueMap(constNull, pag->getGNode(pag->getNullPtr()));
        setCurrentLocation(constNull, (SVFBasicBlock*) nullptr);
        addBlackHoleAddrEdge(pag->getBlkPtr());
        return nullPtr;
    }

addPhiStmt()

void SVF::SVFIRBuilder::addPhiStmt ( NodeID  res, NodeID  opnd, const ICFGNode *  pred  )

inlineprotected

Add Copy edge.

If we already added this phi node, then skip this adding

Definition at line 522 of file SVFIRBuilder.h.

    {
        if(PhiStmt *edge = pag->addPhiStmt(res,opnd,pred))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addRetEdge()

void SVF::SVFIRBuilder::addRetEdge ( NodeID  src, NodeID  dst, const CallICFGNode *  cs, const FunExitICFGNode *  exit  )

inlineprotected

Add Return edge.

Definition at line 583 of file SVFIRBuilder.h.

    {
        if (RetPE* edge = pag->addRetPE(src, dst, cs, exit))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addSelectStmt()

void SVF::SVFIRBuilder::addSelectStmt ( NodeID  res, NodeID  op1, NodeID  op2, NodeID  cond  )

inlineprotected

Add SelectStmt.

Definition at line 529 of file SVFIRBuilder.h.

    {
        if(SelectStmt *edge = pag->addSelectStmt(res,op1,op2,cond))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addStoreEdge()

void SVF::SVFIRBuilder::addStoreEdge ( NodeID  src, NodeID  dst  )

inlineprotected

Add Store edge.

Definition at line 565 of file SVFIRBuilder.h.

    {
        ICFGNode* node;
        if (const Instruction* inst = SVFUtil::dyn_cast<Instruction>(curVal))
            node = llvmModuleSet()->getICFGNode(
                       SVFUtil::cast<Instruction>(inst));
        else
            node = nullptr;
        if (StoreStmt* edge = pag->addStoreStmt(src, dst, node))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addThreadForkEdge()

void SVF::SVFIRBuilder::addThreadForkEdge ( NodeID  src, NodeID  dst, const CallICFGNode *  cs, const FunEntryICFGNode *  entry  )

inlineprotected

Add Thread fork edge for parameter passing.

Definition at line 607 of file SVFIRBuilder.h.

    {
        if (TDForkPE* edge = pag->addThreadForkPE(src, dst, cs, entry))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addThreadJoinEdge()

void SVF::SVFIRBuilder::addThreadJoinEdge ( NodeID  src, NodeID  dst, const CallICFGNode *  cs, const FunExitICFGNode *  exit  )

inlineprotected

Add Thread join edge for parameter passing.

Definition at line 613 of file SVFIRBuilder.h.

    {
        if (TDJoinPE* edge = pag->addThreadJoinPE(src, dst, cs, exit))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addUnaryOPEdge()

void SVF::SVFIRBuilder::addUnaryOPEdge ( NodeID  src, NodeID  dst, u32_t  opcode  )

inlineprotected

Add Unary edge.

Definition at line 547 of file SVFIRBuilder.h.

    {
        if(UnaryOPStmt *edge = pag->addUnaryOPStmt(src, dst, opcode))
            setCurrentBBAndValueForPAGEdge(edge);
    }

addVariantGepEdge()

void SVF::SVFIRBuilder::addVariantGepEdge ( NodeID  src, NodeID  dst, const AccessPath &  ap  )

inlineprotected

Add Variant(Gep) edge.

Definition at line 601 of file SVFIRBuilder.h.

    {
        if (GepStmt* edge = pag->addVariantGepStmt(src, dst, ap))
            setCurrentBBAndValueForPAGEdge(edge);
    }

build()

SVFIR * SVFIRBuilder::build ( )

virtual

Start building SVFIR here.

Start building SVFIR here

build icfg

initial external library information initial SVFIR nodes

initial SVFIR edges: // handle globals

build callgraph

handle functions

collect return node of function fun

Return SVFIR node will not be created for function which can not reach the return instruction due to call to abort(), exit(), etc. In 176.gcc of SPEC 2000, function build_objc_string() from c-lang.c shows an example when fun.doesNotReturn() evaluates to TRUE because of abort().

To be noted, we do not record arguments which are in declared function without body TODO: what about external functions with SVFIR imported by commandline?

Definition at line 55 of file SVFIRBuilder.cpp.

{
    double startTime = SVFStat::getClk(true);
 
    DBOUT(DGENERAL, outs() << pasMsg("\t Building SVFIR ...\n"));
 
    // If the SVFIR has been built before, then we return the unique SVFIR of the program
    if(pag->getNodeNumAfterPAGBuild() > 1)
        return pag;
 
 
    createFunObjVars();
 
    ICFGBuilder icfgbuilder;
    pag->icfg = icfgbuilder.build();
 
    initialiseNodes();
    initialiseAggregateReturns();
    visitGlobal();
 
 
 
    CallGraphBuilder callGraphBuilder;
    std::vector<const FunObjVar*> funset;
    for (const auto& item: llvmModuleSet()->getFunctionSet())
    {
        funset.push_back(llvmModuleSet()->getFunObjVar(item));
    }
    pag->callGraph = callGraphBuilder.buildSVFIRCallGraph(funset);
 
    CHGraph* chg = new CHGraph();
    CHGBuilder chgbuilder(chg);
    chgbuilder.buildCHG();
    pag->setCHG(chg);
 
    for (Module& M : llvmModuleSet()->getLLVMModules())
    {
        for (Module::const_iterator F = M.begin(), E = M.end(); F != E; ++F)
        {
            const Function& fun = *F;
            const FunObjVar* svffun = llvmModuleSet()->getFunObjVar(&fun);
            if(!fun.isDeclaration())
            {
                if (fun.doesNotReturn() == false &&
                        fun.getReturnType()->isVoidTy() == false)
                {
                    pag->addFunRet(svffun,
                                   pag->getValVar(pag->getReturnNode(svffun)));
                }
 
                for (Function::const_arg_iterator I = fun.arg_begin(), E = fun.arg_end();
                        I != E; ++I)
                {
                    setCurrentLocation(&*I,&fun.getEntryBlock());
                    NodeID argValNodeId = llvmModuleSet()->getValueNode(&*I);
                    // if this is the function does not have caller (e.g. main)
                    // or a dead function, shall we create a black hole address edge for it?
                    // it is (1) too conservative, and (2) make FormalParmVFGNode defined at blackhole address PAGEdge.
                    // if(SVFUtil::ArgInNoCallerFunction(&*I)) {
                    //    if(I->getType()->isPointerTy())
                    //        addBlackHoleAddrEdge(argValNodeId);
                    //}
                    pag->addFunArgs(svffun,pag->getValVar(argValNodeId));
                }
                auto returns = aggregateReturnParams.find(&fun);
                if (returns != aggregateReturnParams.end())
                    for (const auto& field : returns->second)
                        pag->addFunArgs(svffun, pag->getValVar(field.second));
            }
            for (Function::const_iterator bit = fun.begin(), ebit = fun.end();
                    bit != ebit; ++bit)
            {
                const BasicBlock& bb = *bit;
                for (BasicBlock::const_iterator it = bb.begin(), eit = bb.end();
                        it != eit; ++it)
                {
                    const Instruction& inst = *it;
                    setCurrentLocation(&inst,&bb);
                    visit(const_cast<Instruction&>(inst));
                }
            }
        }
    }
 
    sanityCheck();
 
    pag->initialiseCandidatePointers();
 
    pag->setNodeNumAfterPAGBuild(pag->getTotalNodeNum());
 
    // dump SVFIR
    if (Options::PAGDotGraph())
        pag->dump("svfir_initial");
 
    // print to command line of the SVFIR graph
    if (Options::PAGPrint())
        pag->print();
 
    // dump ICFG
    if (Options::DumpICFG())
        pag->getICFG()->dump("icfg_initial");
 
    if (Options::LoopAnalysis())
    {
        LLVMLoopAnalysis loopAnalysis;
        loopAnalysis.build(pag->getICFG());
    }
 
    // dump SVFIR as JSON
    if (!Options::DumpJson().empty())
    {
        assert(false && "please implement SVFIRWriter::writeJsonToPath");
    }
 
    double endTime = SVFStat::getClk(true);
    SVFStat::timeOfBuildingSVFIR = (endTime - startTime) / TIMEINTERVAL;
 
    return pag;
}

computeGepOffset()

bool SVFIRBuilder::computeGepOffset ( const User *  V, AccessPath &  ap  )

protected

Compute offset of a gep instruction or gep constant expression.

Return the object node offset according to GEP insn (V). Given a gep edge p = q + i, if "i" is a constant then we return its offset size otherwise if "i" is a variable determined by runtime, then it is a variant offset Return TRUE if the offset of this GEP insn is a constant.

Definition at line 636 of file SVFIRBuilder.cpp.

{
    assert(V);
 
    const llvm::GEPOperator *gepOp = SVFUtil::dyn_cast<const llvm::GEPOperator>(V);
    DataLayout * dataLayout = getDataLayout(llvmModuleSet()->getMainLLVMModule());
    llvm::APInt byteOffset(dataLayout->getIndexSizeInBits(gepOp->getPointerAddressSpace()),0,true);
    if(gepOp && dataLayout && gepOp->accumulateConstantOffset(*dataLayout,byteOffset))
    {
        //s32_t bo = byteOffset.getSExtValue();
    }
 
    bool isConst = true;
 
    bool prevPtrOperand = false;
    for (bridge_gep_iterator gi = bridge_gep_begin(*V), ge = bridge_gep_end(*V);
            gi != ge; ++gi)
    {
        const Type* gepTy = *gi;
        const SVFType* svfGepTy = llvmModuleSet()->getSVFType(gepTy);
 
        assert((prevPtrOperand && svfGepTy->isPointerTy()) == false &&
               "Expect no more than one gep operand to be of a pointer type");
        if(!prevPtrOperand && svfGepTy->isPointerTy()) prevPtrOperand = true;
        const Value* offsetVal = gi.getOperand();
        assert(gepTy != offsetVal->getType() && "iteration and operand have the same type?");
 
        const ArrayType* inferredPtrArrayTy = nullptr;
        const SVFType* idxGepTy = svfGepTy;
        if (svfGepTy->isPointerTy() && gepOp->getSourceElementType()->isSingleValueType())
        {
            const Type* baseObjType =
                LLVMModuleSet::getLLVMModuleSet()->getTypeInference()->inferObjType(gepOp->getPointerOperand());
            if (const auto* arrTy = SVFUtil::dyn_cast<ArrayType>(baseObjType))
            {
                if (arrTy->getElementType()->isPointerTy())
                {
                    inferredPtrArrayTy = arrTy;
                    idxGepTy = llvmModuleSet()->getSVFType(arrTy);
                }
            }
        }
 
        ap.addOffsetVarAndGepTypePair(getPAG()->getValVar(llvmModuleSet()->getValueNode(offsetVal)), idxGepTy);
 
        //The int value of the current index operand
        const ConstantInt* op = SVFUtil::dyn_cast<ConstantInt>(offsetVal);
 
        // if Options::ModelConsts() is disabled. We will treat whole array as one,
        // but we can distinguish different field of an array of struct, e.g. s[1].f1 is different from s[0].f2
        if(const ArrayType* arrTy = SVFUtil::dyn_cast<ArrayType>(gepTy))
        {
            if (!Options::ModelArrays() && arrTy->getElementType()->isPointerTy())
                continue;
            if(!op || (arrTy->getArrayNumElements() <= (u32_t)LLVMUtil::getIntegerValue(op).first))
                continue;
            APOffset idx = (u32_t)LLVMUtil::getIntegerValue(op).first;
            u32_t offset = pag->getFlattenedElemIdx(llvmModuleSet()->getSVFType(arrTy), idx);
            ap.setFldIdx(ap.getConstantStructFldIdx() + offset);
        }
        else if (const StructType *ST = SVFUtil::dyn_cast<StructType>(gepTy))
        {
            assert(op && "non-const offset accessing a struct");
            // guard against negative or out-of-bounds struct indices
            // (e.g. rust hashbrown bucket back-offset: gep { ... }, ptr %p, i64 -1)
            // a negative i64 wraps to a huge uint64_t that overflows u32_t,
            // creating an invalid field index that severs points-to tracking
            uint64_t rawIdx = LLVMUtil::getIntegerValue(op).first;
            if (rawIdx >= ST->getNumElements())
            {
                isConst = false;
                continue;
            }
            APOffset idx = (u32_t)rawIdx;
            u32_t offset = pag->getFlattenedElemIdx(llvmModuleSet()->getSVFType(ST), idx);
            ap.setFldIdx(ap.getConstantStructFldIdx() + offset);
        }
        else if (gepTy->isSingleValueType())
        {
            if (inferredPtrArrayTy)
            {
                if (!op || (inferredPtrArrayTy->getArrayNumElements() <= (u32_t)LLVMUtil::getIntegerValue(op).first))
                    continue;
                APOffset idx = (u32_t)LLVMUtil::getIntegerValue(op).first;
                u32_t offset = pag->getFlattenedElemIdx(llvmModuleSet()->getSVFType(inferredPtrArrayTy), idx);
                ap.setFldIdx(ap.getConstantStructFldIdx() + offset);
                continue;
            }
            // If it's a non-constant offset access
            // If its point-to target is struct or array, it's likely an array accessing (%result = gep %struct.A* %a, i32 %non-const-index)
            // If its point-to target is single value (pointer arithmetic), then it's a variant gep (%result = gep i8* %p, i32 %non-const-index)
            if(!op && gepTy->isPointerTy() && gepOp->getSourceElementType()->isSingleValueType())
            {
                isConst = false;
            }
 
            // The actual index
            //s32_t idx = op->getSExtValue();
 
            // For pointer arithmetic we ignore the byte offset
            // consider using inferFieldIdxFromByteOffset(geopOp,dataLayout,ap,idx)?
            // ap.setFldIdx(ap.getConstantFieldIdx() + inferFieldIdxFromByteOffset(geopOp,idx));
        }
    }
    return isConst;
}

createAggregateCallSlots()

void SVFIRBuilder::createAggregateCallSlots ( const Function *  fun, const SVFType *  pointerType  )

private

At every call to fun, create a slot, its address and its snapshot for each output parameter (obj, A and V in the aggregate return example). The address is defined at the call, and the snapshot is loaded at the instruction after the call.

Definition at line 1670 of file SVFIRBuilder.cpp.

{
    const auto& params = aggregateReturnParams.at(fun);
    // LLVM use-list order can change on bitcode reload. Order calls by
    // their ICFG IDs so each call receives the same slot IDs on readback.
    std::vector<const CallInst*> calls;
    for (const User* user : fun->users())
        calls.push_back(SVFUtil::cast<CallInst>(user));
    std::sort(calls.begin(), calls.end(), [this](const CallInst* lhs,
              const CallInst* rhs)
    {
        return llvmModuleSet()->getCallICFGNode(lhs)->getId() <
               llvmModuleSet()->getCallICFGNode(rhs)->getId();
    });
    const Value* savedValue = curVal;
    const SVFBasicBlock* savedBB = curBB;
    // Include calls with unused results to keep actual/formal lists aligned.
    for (const CallInst* call : calls)
    {
        std::vector<const Instruction*> next;
        LLVMUtil::getNextInsts(call, next);
        assert(next.size() == 1 && "ordinary call must have one continuation");
        const Instruction* continuation = next.front();
        auto& args = aggregateCallArgs[call];
        ICFGNode* callNode = llvmModuleSet()->getCallICFGNode(call);
        ICFGNode* resumeNode = llvmModuleSet()->getICFGNode(continuation);
        for (const auto& param : params)
        {
            // DummyObjVar keeps the static slot nonlocal to the callee
            // in MemSSA. Later extracts read the SSA snapshot rather
            // than the reused slot contents.
            NodeID object = pag->addDummyObjNode(pointerType);
            pag->getAllFieldsObjVars(object).set(object);
            pag->getObjTypeInfo(object)->setNumOfElements(1);
            pag->getObjTypeInfo(object)->setByteSizeOfObj(
                pointerType->getByteSize());
            NodeID address = pag->addDummyValNode(
                                 NodeIDAllocator::get()->allocateValueId(), callNode);
            NodeID value = pag->addDummyValNode(
                               NodeIDAllocator::get()->allocateValueId(), resumeNode);
            args.emplace(param.first, address);
            // Call fields use the same identity as local aggregate fields.
            assert(!aggregateFieldNodes.count({call, param.first}) &&
                   "call field registered twice");
            aggregateFieldNodes.emplace(
                AggregateFieldKey{call, param.first}, value);
            setCurrentLocation(call, call->getParent());
            addAddrEdge(object, address);
            // Snapshots must precede field statements at the continuation,
            // even when LLVM block order differs from dominance order.
            setCurrentLocation(continuation, continuation->getParent());
            addLoadEdge(address, value);
        }
    }
    setCurrentLocation(savedValue, savedBB);
}

createAggregateReturnParams()

void SVFIRBuilder::createAggregateReturnParams ( const Function *  fun, const std::set< AggregateField > &  fields, const SVFType *  pointerType  )

private

Add one output parameter to fun for each demanded field, in field-path order (out_obj in the aggregate return example). The LLVM signature does not change.

Definition at line 1645 of file SVFIRBuilder.cpp.

{
    FunObjVar* svfFun =
        const_cast<FunObjVar*>(llvmModuleSet()->getFunObjVar(fun));
    const FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(svfFun);
    auto& params = aggregateReturnParams[fun];
    for (const AggregateField& field : fields)
    {
        NodeID id = NodeIDAllocator::get()->allocateValueId();
        pag->addArgValNode(id, svfFun->arg_size(), entry, svfFun, pointerType);
        auto* arg = SVFUtil::cast<ArgValVar>(pag->getGNode(id));
        svfFun->addArgument(arg);
        // Like RetValPN, the synthetic parameter uses its function as a
        // diagnostic source; it does not add or replace an LLVM argument.
        llvmModuleSet()->addToSVFVar2LLVMValueMap(fun, arg);
        arg->setName("aggregate_return_" + std::to_string(arg->getArgNo()));
        params.emplace(field, id);
    }
}

createFunObjVars()

void SVFIRBuilder::createFunObjVars

(

)

set fun in bb

Definition at line 334 of file SVFIRBuilder.cpp.

{
    std::vector<FunObjVar*> funset;
    // Iterate over all object symbols in the symbol table
    for (const auto* fun: llvmModuleSet()->getFunctionSet())
    {
        u32_t id = llvmModuleSet()->objSyms()[fun];
        // Debug output for adding object node
        DBOUT(DPAGBuild, outs() << "add obj node " << id << "\n");
 
        // Check if the value is a function and add a function object node
        pag->addFunObjNode(id, pag->getObjTypeInfo(id), nullptr);
        llvmModuleSet()->LLVMFun2FunObjVar[fun] = cast<FunObjVar>(pag->getGNode(id));
 
        FunObjVar *funObjVar = SVFUtil::cast<FunObjVar>(pag->getGNode(id));
        funset.push_back(funObjVar);
 
        funObjVar->initFunObjVar(fun->isDeclaration(), LLVMUtil::isIntrinsicFun(fun), fun->hasAddressTaken(),
                                 LLVMUtil::isUncalledFunction(fun), LLVMUtil::functionDoesNotRet(fun), fun->isVarArg(),
                                 SVFUtil::cast<SVFFunctionType>(llvmModuleSet()->getSVFType(fun->getFunctionType())),
                                 new SVFLoopAndDomInfo, nullptr, nullptr,
                                 {}, nullptr);
        BasicBlockGraph* bbGraph = new BasicBlockGraph();
        funObjVar->setBasicBlockGraph(bbGraph);
 
 
        for (const BasicBlock& bb : *fun)
        {
            llvmModuleSet()->addBasicBlock(funObjVar, &bb);
        }
 
        for (auto& bb: *funObjVar->bbGraph)
        {
            bb.second->setFun(funObjVar);
        }
        llvmModuleSet()->addToSVFVar2LLVMValueMap(fun, pag->getGNode(id));
    }
 
    initFunObjVar();
}

discoverAggregateReturnFields()

SVFIRBuilder::AggregateReturnFields SVFIRBuilder::discoverAggregateReturnFields ( )

private

Find the fields of each callee's returned aggregate that callers extract, such as field {0} of make in the aggregate return example. Paths that getAggregateFieldOperands cannot follow are skipped; getAggregateFieldNode later decides which extracted fields are modeled.

Definition at line 1599 of file SVFIRBuilder.cpp.

{
    std::vector<AggregateFieldKey> worklist;
    for (Module& module : llvmModuleSet()->getLLVMModules())
        for (const Function& fun : module)
            for (const BasicBlock& bb : fun)
                for (const Instruction& inst : bb)
                {
                    if (auto field = getExtractedField(inst))
                        worklist.push_back(std::move(*field));
                }
 
    // Discover callee demands without materializing local field definitions.
    // Calls cross into return operands; other producers use the shared grammar.
    AggregateReturnFields demands;
    Set<AggregateFieldKey> visited;
    while (!worklist.empty())
    {
        AggregateFieldKey field = std::move(worklist.back());
        worklist.pop_back();
        if (!visited.insert(field).second || field.second.empty())
            continue;
        if (const auto* call = SVFUtil::dyn_cast<CallInst>(field.first))
        {
            const Function* callee = call->getCalledFunction();
            if (!canModelAggregateReturn(callee) ||
                    !demands[callee].insert(field.second).second)
                continue;
            for (const BasicBlock& bb : *callee)
                if (const auto* ret = SVFUtil::dyn_cast<ReturnInst>(bb.getTerminator()))
                    if (ret->getReturnValue())
                        worklist.emplace_back(ret->getReturnValue(), field.second);
        }
        else
        {
            std::vector<AggregateFieldKey> operands;
            if (getAggregateFieldOperands(field, operands))
                worklist.insert(worklist.end(), operands.begin(), operands.end());
        }
    }
    return demands;
}

getAccessPathFromBaseNode()

AccessPath SVFIRBuilder::getAccessPathFromBaseNode ( NodeID  nodeId )

protected

Get a base SVFVar given a pointer Return the source node of its connected normal gep edge Otherwise return the node id itself s32_t offset : gep offset

if this node is already a base node

Definition at line 2471 of file SVFIRBuilder.cpp.

{
    SVFVar* node  = pag->getGNode(nodeId);
    SVFStmt::SVFStmtSetTy& geps = node->getIncomingEdges(SVFStmt::Gep);
    if(geps.empty())
        return AccessPath(0);
 
    assert(geps.size()==1 && "one node can only be connected by at most one gep edge!");
    SVFVar::iterator it = geps.begin();
    const GepStmt* gepEdge = SVFUtil::cast<GepStmt>(*it);
    if(gepEdge->isVariantFieldGep())
        return AccessPath(0);
    else
        return gepEdge->getAccessPath();
}

getAggregateFieldNode()

bool SVFIRBuilder::getAggregateFieldNode ( const Value *  aggregate, const AggregateField &  indices, NodeID &  node  )

private

Return the node for (aggregate, indices), reusing cached fields. Unsupported dependencies return false without changing SVFIR or node.

Here, the field node for (a, {0}) copies p; x copies that node: define ptr @field(ptr p) { a = insertvalue { ptr } poison, ptr p, 0 x = extractvalue { ptr } a, 0 ret ptr x }

Definition at line 1479 of file SVFIRBuilder.cpp.

{
    const AggregateFieldKey root{aggregate, indices};
    // Discovery order keeps field NodeIDs stable across -write-ander and
    // -read-ander runs; Value-pointer hash order can swap their points-to sets.
    std::vector<std::pair<AggregateFieldKey, std::vector<AggregateFieldKey>>>
    definitions;
    Set<AggregateFieldKey> discovered;
    std::vector<AggregateFieldKey> worklist{root};
    while (!worklist.empty())
    {
        AggregateFieldKey field = std::move(worklist.back());
        worklist.pop_back();
        if (aggregateFieldNodes.count(field) ||
                !discovered.insert(field).second)
            continue;
        const Type* type = getAggregateFieldType(field.first->getType(), field.second);
        if (!type || !type->isPointerTy())
            return false;
        definitions.emplace_back(field, std::vector<AggregateFieldKey>());
        auto& operands = definitions.back().second;
        if (!getAggregateFieldOperands(field, operands))
            return false;
        worklist.insert(worklist.end(), operands.begin(), operands.end());
    }
 
    // Validate the entire dependency graph before changing SVFIR. Allocate every
    // field before wiring definitions, including loop-carried Phi/Select cycles.
    for (const auto& definition : definitions)
    {
        const AggregateFieldKey& field = definition.first;
        NodeID id;
        if (field.second.empty())
            id = getValueNode(field.first);
        else if (SVFUtil::isa<Constant>(field.first))
            id = getValueNode(definition.second.front().first);
        else
        {
            const auto* producer = SVFUtil::cast<Instruction>(field.first);
            const Type* type = getAggregateFieldType(producer->getType(), field.second);
            id = NodeIDAllocator::get()->allocateValueId();
            pag->addValNode(id, llvmModuleSet()->getSVFType(type),
                            llvmModuleSet()->getICFGNode(producer));
            llvmModuleSet()->addToSVFVar2LLVMValueMap(producer, pag->getGNode(id));
        }
        aggregateFieldNodes.emplace(field, id);
    }
 
    const Value* savedValue = curVal;
    const SVFBasicBlock* savedBB = curBB;
    for (const auto& definition : definitions)
    {
        const AggregateFieldKey& field = definition.first;
        if (field.second.empty() || SVFUtil::isa<Constant>(field.first))
            continue;
        const auto* producer = SVFUtil::cast<Instruction>(field.first);
        const auto& operands = definition.second;
        NodeID dst = aggregateFieldNodes.at(field);
        setCurrentLocation(producer, producer->getParent());
        if (const auto* phi = SVFUtil::dyn_cast<PHINode>(producer))
        {
            for (unsigned i = 0; i < operands.size(); ++i)
                addPhiStmt(dst, aggregateFieldNodes.at(operands[i]),
                           llvmModuleSet()->getICFGNode(phi->getIncomingBlock(i)->getTerminator()));
        }
        else if (const auto* select = SVFUtil::dyn_cast<SelectInst>(producer))
            addSelectStmt(dst, aggregateFieldNodes.at(operands[0]),
                          aggregateFieldNodes.at(operands[1]), getValueNode(select->getCondition()));
        else
            addCopyEdge(aggregateFieldNodes.at(operands.front()), dst, CopyStmt::COPYVAL);
    }
    setCurrentLocation(savedValue, savedBB);
    node = aggregateFieldNodes.at(root);
    return true;
}

getAggregateFieldOperands()

bool SVFIRBuilder::getAggregateFieldOperands ( const AggregateFieldKey &  field, std::vector< AggregateFieldKey > &  operands  )

private

Describe one field definition without emitting any SVFIR statements.

Definition at line 1378 of file SVFIRBuilder.cpp.

{
    const Value* value = field.first;
    const AggregateField& path = field.second;
    if (path.empty())
        return value->getType()->isPointerTy() && !SVFUtil::isa<ConstantExpr>(value) &&
               !SVFUtil::isa<UndefValue>(value) && llvmModuleSet()->hasValueNode(value);
    // insertvalue and insertelement replace one field. For example, in
    //   %b = insertvalue {ptr, ptr} %a, ptr %q, 1
    // field {1} of %b is %q, and field {0} of %b is field {0} of %a.
    const Value* original = nullptr;
    const Value* inserted = nullptr;
    AggregateField insertedPath;
    if (const auto* insert = SVFUtil::dyn_cast<InsertValueInst>(value))
    {
        original = insert->getAggregateOperand();
        inserted = insert->getInsertedValueOperand();
        insertedPath.assign(insert->idx_begin(), insert->idx_end());
    }
    else if (const auto* insert = SVFUtil::dyn_cast<InsertElementInst>(value))
    {
        const auto lane = getFixedVectorLane(insert->getType(),
                                             insert->getOperand(2));
        if (!lane)
            return false;
        original = insert->getOperand(0);
        inserted = insert->getOperand(1);
        insertedPath = {*lane};
    }
 
    if (inserted)
    {
        const size_t commonLength = std::min(insertedPath.size(), path.size());
        if (!std::equal(insertedPath.begin(), insertedPath.begin() + commonLength, path.begin()))
            operands.emplace_back(original, path);
        else if (insertedPath.size() <= path.size())
            operands.emplace_back(inserted,
                                  AggregateField(path.begin() + insertedPath.size(), path.end()));
        else
            return false;
    }
    else if (const auto* extract = SVFUtil::dyn_cast<ExtractValueInst>(value))
    {
        AggregateField outer(extract->idx_begin(), extract->idx_end());
        outer.insert(outer.end(), path.begin(), path.end());
        operands.emplace_back(extract->getAggregateOperand(), std::move(outer));
    }
    else if (const auto* phi = SVFUtil::dyn_cast<PHINode>(value))
    {
        for (const Value* incoming : phi->incoming_values())
            operands.emplace_back(incoming, path);
    }
    else if (const auto* select = SVFUtil::dyn_cast<SelectInst>(value))
    {
        if (!select->getCondition()->getType()->isIntegerTy(1))
            return false;
        operands.emplace_back(select->getTrueValue(), path);
        operands.emplace_back(select->getFalseValue(), path);
    }
    else if (const auto* freeze = SVFUtil::dyn_cast<FreezeInst>(value))
        operands.emplace_back(freeze->getOperand(0), path);
    else if (const auto* shuffle = SVFUtil::dyn_cast<ShuffleVectorInst>(value))
    {
        const auto* vector = SVFUtil::dyn_cast<llvm::FixedVectorType>(shuffle->getOperand(0)->getType());
        if (!vector || path.size() != 1)
            return false;
        int index = shuffle->getMaskValue(path.front());
        if (index < 0)
            return false;
        unsigned width = vector->getNumElements();
        operands.emplace_back(shuffle->getOperand(static_cast<unsigned>(index) / width),
                              AggregateField{static_cast<unsigned>(index) % width});
    }
    else if (const auto* constant = SVFUtil::dyn_cast<Constant>(value))
    {
        for (unsigned index : path)
        {
            constant = constant->getAggregateElement(index);
            if (!constant)
                return false;
        }
        operands.emplace_back(constant, AggregateField{});
    }
    else
        // Aggregate arguments, calls and loads need their own field interfaces.
        return false;
    return !operands.empty();
}

getBaseTypeAndFlattenedFields()

const Type * SVFIRBuilder::getBaseTypeAndFlattenedFields ( const Value *  V, std::vector< AccessPath > &  fields, const Value *  szValue  )

protectedvirtual

Handle external call.

Find the base type and the max possible offset of an object pointed to by (V).

use user-specified size for this copy operation if the size is a constaint int

MaxFieldLimit == 0 denotes field-insensitive analysis, not an empty memory model. The lower bound of one keeps a representative AccessPath; using zero would drop the memcpy/memset effect entirely.

Unsound scalability trade-off: AccessPaths beyond MaxFieldLimit are omitted, so their external-memory effects are not represented in the SVFIR.

Definition at line 273 of file SVFIRExtAPI.cpp.

{
    assert(V);
    const Value* value = getBaseValueForExtArg(V);
    const Type *objType = LLVMModuleSet::getLLVMModuleSet()->getTypeInference()->inferObjType(value);
    u32_t numOfElems = pag->getNumOfFlattenElements(LLVMModuleSet::getLLVMModuleSet()->getSVFType(objType));
    if(szValue && SVFUtil::isa<ConstantInt>(szValue))
    {
        auto szIntVal = LLVMUtil::getIntegerValue(SVFUtil::cast<ConstantInt>(szValue));
        numOfElems = (numOfElems > szIntVal.first) ? szIntVal.first : numOfElems;
    }
    numOfElems = std::min(numOfElems, std::max(Options::MaxFieldLimit(), u32_t{1}));
 
    LLVMContext& context = LLVMModuleSet::getLLVMModuleSet()->getContext();
    for(u32_t ei = 0; ei < numOfElems; ei++)
    {
        AccessPath ls(ei);
        // make a ConstantInt and create char for the content type due to byte-wise copy
        const ConstantInt* offset = ConstantInt::get(context, llvm::APInt(32, ei));
        if (!llvmModuleSet()->hasValueNode(offset))
        {
            SymbolTableBuilder builder(pag);
            builder.collectSym(offset);
            NodeID id = llvmModuleSet()->getValueNode(offset);
            pag->addConstantIntValNode(id, LLVMUtil::getIntegerValue(offset), nullptr, llvmModuleSet()->getSVFType(offset->getType()));
            llvmModuleSet()->addToSVFVar2LLVMValueMap(offset,
                    pag->getGNode(id));
        }
        ls.addOffsetVarAndGepTypePair(getPAG()->getValVar(llvmModuleSet()->getValueNode(offset)), nullptr);
        fields.push_back(ls);
    }
    return objType;
}

getBaseValueForExtArg()

const Value * SVFIRBuilder::getBaseValueForExtArg ( const Value *  V )

protected

Get the base value of (i8* src and i8* dst) for external argument (e.g. memcpy(i8* dst, i8* src, int size))

Example 1:

%0 = getelementptr inbounds struct.outer, struct.inner base, i32 0, i32 0 call void @llvm.memcpy(ptr inner, ptr %0, i64 24, i1 false) The base value for %0 is base. Note: the base is recognized as the base value if the offset (field index) is 0

Example 2: https://github.com/SVF-tools/SVF/issues/1650 https://github.com/SVF-tools/SVF/pull/1652

@i1 = dso_local global struct.inner { i32 0, ptr @f1, ptr @f2 } @n1 = dso_local global struct.outer { i32 0, ptr @i1 }

inner = alloca struct.inner %0 = load ptr, ptr getelementptr inbounds (struct.outer, ptr @n1, i32 0, i32 1) call void @llvm.memcpy(ptr inner, ptr %0, i64 24, i1 false)

The base value for %0 is @i1

Example 3:

@conststruct = internal global <{ [40 x i8], [4 x i8], [4 x i8], [2512 x i8] }> <{ [40 x i8] undef, [4 x i8] zeroinitializer, [4 x i8] undef, [2512 x i8] zeroinitializer }>, align 8

%0 = load ptr, ptr getelementptr inbounds (<{ [40 x i8], [4 x i8], [4 x i8], [2512 x i8] }>, ptr @conststruct, i64 0, i32 0, i64 16)

The base value for %0 is still %0

Definition at line 2098 of file SVFIRBuilder.cpp.

{
    const Value*  value = stripAllCasts(V);
    assert(value && "null ptr?");
    auto getGlobalFieldFromByteOffset =
        [this](const GlobalVariable* glob, int64_t byteOffset) -> const Value*
    {
        if (!glob || !glob->hasInitializer())
            return nullptr;
 
        auto* initializer = SVFUtil::dyn_cast<ConstantStruct>(glob->getInitializer());
        auto* structType = SVFUtil::dyn_cast<StructType>(glob->getValueType());
        if (!initializer || !structType)
            return nullptr;
 
        DataLayout* dataLayout = getDataLayout(llvmModuleSet()->getMainLLVMModule());
        const StructLayout* layout =
        dataLayout->getStructLayout(const_cast<StructType*>(structType));
        for (u32_t fieldIdx = 0; fieldIdx < initializer->getNumOperands(); ++fieldIdx)
        {
            if (layout->getElementOffset(fieldIdx) != static_cast<uint64_t>(byteOffset))
                continue;
            if (auto* ptrValue =
                    SVFUtil::dyn_cast<llvm::GlobalVariable>(initializer->getOperand(fieldIdx)))
                return ptrValue;
            return nullptr;
        }
        return nullptr;
    };
 
    if(const GetElementPtrInst* gep = SVFUtil::dyn_cast<GetElementPtrInst>(value))
    {
        APOffset totalidx = 0;
        for (bridge_gep_iterator gi = bridge_gep_begin(gep), ge = bridge_gep_end(gep); gi != ge; ++gi)
        {
            if(const ConstantInt* op = SVFUtil::dyn_cast<ConstantInt>(gi.getOperand()))
                totalidx += LLVMUtil::getIntegerValue(op).first;
        }
        if(totalidx == 0 && !SVFUtil::isa<StructType>(value->getType()))
            value = gep->getPointerOperand();
    }
    else if (const LoadInst* load = SVFUtil::dyn_cast<LoadInst>(value))
    {
        const Value* loadP = load->getPointerOperand();
        if (const GetElementPtrInst* gep = SVFUtil::dyn_cast<GetElementPtrInst>(loadP))
        {
            DataLayout* dataLayout = getDataLayout(llvmModuleSet()->getMainLLVMModule());
            llvm::APInt byteOffset(dataLayout->getIndexSizeInBits(gep->getPointerAddressSpace()), 0, true);
            const bool hasByteOffset = dataLayout && gep->accumulateConstantOffset(*dataLayout, byteOffset);
 
            const Value * pointer_operand = gep->getPointerOperand();
            if (auto *glob = SVFUtil::dyn_cast<GlobalVariable>(pointer_operand))
            {
                if (hasByteOffset)
                {
                    if (const Value* ptrValue = getGlobalFieldFromByteOffset(glob, byteOffset.getSExtValue()))
                        return ptrValue;
                }
            }
            else if (hasByteOffset && !byteOffset.isNegative() &&
                     SVFUtil::isa<AllocaInst>(pointer_operand) && load->getType()->isPointerTy())
            {
                const u64_t offset = byteOffset.getZExtValue();
                const u64_t accessBytes = dataLayout->getPointerSize(gep->getPointerAddressSpace());
 
                auto isCoveredByMemcpy = [offset, accessBytes](const CallBase* cs) -> bool
                {
                    if (cs->arg_size() < 3)
                        return false;
 
                    const auto* copySize = SVFUtil::dyn_cast<ConstantInt>(cs->getArgOperand(2));
                    if (!copySize)
                    {
                        return false;
                    }
 
                    const u64_t copyBytes = copySize->getZExtValue();
                    return copyBytes >= accessBytes && copyBytes - accessBytes >= offset;
                };
 
                auto hasInterveningWrite = [load](const Instruction* from) -> bool
                {
                    if (from->getParent() != load->getParent() || !from->comesBefore(load))
                        return true;
 
                    auto it = from->getIterator();
                    const auto end = load->getIterator();
                    while (++it != end)
                    {
                        if (it->mayWriteToMemory())
                            return true;
                    }
                    return false;
                };
 
                for (const auto& use : pointer_operand->users())
                {
                    const auto* cs = SVFUtil::dyn_cast<CallBase>(use);
                    if (!cs || cs->getParent() != load->getParent() ||
                            cs->arg_size() < 1 ||
                            stripAllCasts(cs->getArgOperand(0)) != pointer_operand)
                        continue;
 
                    const Function* calledFun = cs->getCalledFunction();
                    if (!LLVMUtil::isMemcpyExtFun(calledFun) || !isCoveredByMemcpy(cs) ||
                            hasInterveningWrite(cs))
                        continue;
 
                    const Value* copiedFrom = getBaseValueForExtArg(cs->getArgOperand(1));
                    if (const auto* copiedGlob = SVFUtil::dyn_cast<GlobalVariable>(copiedFrom))
                    {
                        if (const Value* ptrValue =
                                    getGlobalFieldFromByteOffset(copiedGlob, byteOffset.getSExtValue()))
                            return ptrValue;
                    }
                }
            }
        }
    }
 
    return value;
}

getCopyKind()

CopyStmt::CopyKind SVF::SVFIRBuilder::getCopyKind ( const Value *  val )

inlineprotected

Definition at line 484 of file SVFIRBuilder.h.

    {
        // COPYVAL, ZEXT, SEXT, BITCAST, FPTRUNC, FPTOUI, FPTOSI, UITOFP, SITOFP, INTTOPTR, PTRTOINT
        if (const Instruction* inst = SVFUtil::dyn_cast<Instruction>(val))
        {
            switch (inst->getOpcode())
            {
            case Instruction::ZExt:
                return CopyStmt::ZEXT;
            case Instruction::SExt:
                return CopyStmt::SEXT;
            case Instruction::BitCast:
                return CopyStmt::BITCAST;
            case Instruction ::Trunc:
                return CopyStmt::TRUNC;
            case Instruction::FPTrunc:
                return CopyStmt::FPTRUNC;
            case Instruction::FPToUI:
                return CopyStmt::FPTOUI;
            case Instruction::FPToSI:
                return CopyStmt::FPTOSI;
            case Instruction::UIToFP:
                return CopyStmt::UITOFP;
            case Instruction::SIToFP:
                return CopyStmt::SITOFP;
            case Instruction::IntToPtr:
                return CopyStmt::INTTOPTR;
            case Instruction::PtrToInt:
                return CopyStmt::PTRTOINT;
            default:
                return CopyStmt::COPYVAL;
            }
        }
        assert (false && "Unknown cast inst!");
        abort();
    }

getCurrentBB()

const SVFBasicBlock * SVF::SVFIRBuilder::getCurrentBB ( ) const

inlineprotected

Definition at line 366 of file SVFIRBuilder.h.

    {
        return curBB;
    }

getCurrentValue()

const Value * SVF::SVFIRBuilder::getCurrentValue ( ) const

inlineprotected

Definition at line 362 of file SVFIRBuilder.h.

    {
        return curVal;
    }

getDirectAccessFieldZeroValVar()

NodeID SVFIRBuilder::getDirectAccessFieldZeroValVar ( const Value *  ptr, const Type *  accessTy  )

protected

Definition at line 2341 of file SVFIRBuilder.cpp.

{
    if (!Options::ModelArrays() || SVFUtil::isa<llvm::GEPOperator>(ptr))
        return 0;
 
    const Type* objTy =
        LLVMModuleSet::getLLVMModuleSet()->getTypeInference()->inferObjType(ptr);
    const ArrayType* arrTy = SVFUtil::dyn_cast<ArrayType>(objTy);
    if (!arrTy || !arrTy->getElementType()->isPointerTy() ||
            arrTy->getElementType() != accessTy)
        return 0;
 
    AccessPath ap(0, llvmModuleSet()->getSVFType(arrTy));
    return getGepValVar(ptr, ap, llvmModuleSet()->getSVFType(accessTy));
}

getExtractedField()

std::optional< SVFIRBuilder::AggregateFieldKey > SVFIRBuilder::getExtractedField ( const Instruction &  inst )

staticprivate

Decode a pointer extraction; unsupported instructions have no field.

Get the aggregate and field path that a pointer extractvalue, or a pointer extractelement with a constant index, reads. For example, x = extractvalue {ptr, ptr} a, 0 reads field {0} of a.

Definition at line 1773 of file SVFIRBuilder.cpp.

{
    if (!inst.getType()->isPointerTy())
        return std::nullopt;
    if (const auto* extract = SVFUtil::dyn_cast<ExtractValueInst>(&inst))
    {
        return AggregateFieldKey
        {
            extract->getAggregateOperand(),
            AggregateField(extract->idx_begin(), extract->idx_end())};
    }
    const auto* extract = SVFUtil::dyn_cast<ExtractElementInst>(&inst);
    if (!extract)
        return std::nullopt;
    const auto lane = getFixedVectorLane(extract->getVectorOperandType(),
                                         extract->getIndexOperand());
    if (!lane)
        return std::nullopt;
    return AggregateFieldKey{extract->getVectorOperand(),
                             AggregateField{*lane}};
}

getGepValVar()

NodeID SVFIRBuilder::getGepValVar ( const Value *  val, const AccessPath &  ap, const SVFType *  elementType  )

protected

Add a temp field value node according to base value and offset this node is after the initial node method, it is out of scope of symInfo table

Definition at line 2293 of file SVFIRBuilder.cpp.

{
    NodeID base = getValueNode(val);
    NodeID gepval = pag->getGepValVar(llvmModuleSet()->getValueNode(curVal), base, ap);
    if (gepval==UINT_MAX)
    {
        assert(((int) UINT_MAX)==-1 && "maximum limit of unsigned int is not -1?");
        /*
         * getGepValVar can only be called from two places:
         * 1. SVFIRBuilder::addComplexConsForExt to handle external calls
         * 2. SVFIRBuilder::getGlobalVarField to initialize global variable
         * so curVal can only be
         * 1. Instruction
         * 2. GlobalVariable
         */
        assert(
            (SVFUtil::isa<Instruction>(curVal) || SVFUtil::isa<GlobalVariable>(curVal)) && "curVal not an instruction or a globalvariable?");
 
        // We assume every GepValNode and its GepEdge to the baseNode are unique across the whole program
        // We preserve the current BB information to restore it after creating the gepNode
        const Value* cval = getCurrentValue();
        const SVFBasicBlock* cbb = getCurrentBB();
        setCurrentLocation(curVal, (SVFBasicBlock*) nullptr);
        LLVMModuleSet* llvmmodule = llvmModuleSet();
        const ICFGNode* node = nullptr;
        if (const Instruction* inst = SVFUtil::dyn_cast<Instruction>(curVal))
        {
            if (llvmmodule->hasICFGNode(inst))
            {
                node = llvmmodule->getICFGNode(inst);
            }
        }
        else if (SVFUtil::isa<GlobalVariable>(curVal))
        {
            // GEP on a global variable: the resulting GepValVar belongs to the global ICFG node.
            node = pag->getICFG()->getGlobalICFGNode();
        }
        NodeID gepNode = pag->addGepValNode(llvmModuleSet()->getValueNode(curVal), cast<ValVar>(pag->getGNode(getValueNode(val))), ap,
                                            NodeIDAllocator::get()->allocateValueId(),
                                            llvmmodule->getSVFType(PointerType::getUnqual(llvmmodule->getContext())), node);
        addGepEdge(base, gepNode, ap, true);
        setCurrentLocation(cval, cbb);
        return gepNode;
    }
    else
        return gepval;
}

getGlobalVarField()

NodeID SVFIRBuilder::getGlobalVarField ( const GlobalVariable *  gvar, u32_t  offset, SVFType *  tpy  )

protected

Get the field of the global variable node FIXME:Here we only get the field that actually used in the program We ignore the initialization of global variable field that not used in the program

if we did not find the constant expression in the program, then we need to create a gep node for this field

Definition at line 880 of file SVFIRBuilder.cpp.

{
 
    // if the global variable do not have any field needs to be initialized
    if (offset == 0 && gvar->getInitializer()->getType()->isSingleValueType())
    {
        return getValueNode(gvar);
    }
    else
    {
        return getGepValVar(gvar, AccessPath(offset), tpy);
    }
}

getObjectNode()

NodeID SVF::SVFIRBuilder::getObjectNode ( const Value *  V )

inline

GetObject - Return the object node (stack/global/heap/function) according to a LLVM Value.

Definition at line 203 of file SVFIRBuilder.h.

    {
        return llvmModuleSet()->getObjectNode(V);
    }

getPAG()

SVFIR * SVF::SVFIRBuilder::getPAG ( ) const

inline

Return SVFIR.

Definition at line 165 of file SVFIRBuilder.h.

    {
        return pag;
    }

getReturnNode()

NodeID SVF::SVFIRBuilder::getReturnNode ( const FunObjVar *  func )

inline

getReturnNode - Return the node representing the unique return value of a function.

Definition at line 209 of file SVFIRBuilder.h.

    {
        return pag->getReturnNode(func);
    }

getValueNode()

NodeID SVF::SVFIRBuilder::getValueNode ( const Value *  V )

inline

Get different kinds of node.

Definition at line 193 of file SVFIRBuilder.h.

    {
        // first handle gep edge if val if a constant expression
        processCE(V);
 
        // strip off the constant cast and return the value node
        return llvmModuleSet()->getValueNode(V);
    }

getVarargNode()

NodeID SVF::SVFIRBuilder::getVarargNode ( const FunObjVar *  func )

inline

getVarargNode - Return the node representing the unique variadic argument of a function.

Definition at line 215 of file SVFIRBuilder.h.

    {
        return pag->getVarargNode(func);
    }

handleDirectCall()

void SVFIRBuilder::handleDirectCall ( CallBase *  cs, const Function *  F  )

protected

Handle direct call.

Add the constraints for a direct, non-external call.

FIXME: this assertion should be placed for correct checking except bug program like 188.ammp, 300.twolf

Definition at line 2003 of file SVFIRBuilder.cpp.

{
 
    assert(F);
    CallICFGNode* callICFGNode = llvmModuleSet()->getCallICFGNode(cs);
    const FunObjVar* svffun = llvmModuleSet()->getFunObjVar(F);
    DBOUT(DPAGBuild, outs() << "handle direct call " << LLVMUtil::dumpValue(cs)
          << " callee " << F->getName().str() << "\n");
 
    //Only handle the ret.val. if it's used as a ptr.
    NodeID dstrec = getValueNode(cs);
    //Does it actually return a ptr?
    if (!cs->getType()->isVoidTy())
    {
        NodeID srcret = getReturnNode(svffun);
        FunExitICFGNode* exitICFGNode = pag->getICFG()->getFunExitICFGNode(svffun);
        addRetEdge(srcret, dstrec,callICFGNode, exitICFGNode);
    }
    //Iterators for the actual and formal parameters
    u32_t itA = 0, ieA = cs->arg_size();
    Function::const_arg_iterator itF = F->arg_begin(), ieF = F->arg_end();
    //Go through the fixed parameters.
    DBOUT(DPAGBuild, outs() << "      args:");
    for (; itF != ieF; ++itA, ++itF)
    {
        //Some programs (e.g. Linux kernel) leave unneeded parameters empty.
        if (itA == ieA)
        {
            DBOUT(DPAGBuild, outs() << " !! not enough args\n");
            break;
        }
        const Value* AA = cs->getArgOperand(itA), *FA = &*itF; //current actual/formal arg
 
        DBOUT(DPAGBuild, outs() << "process actual parm "
              << LLVMUtil::dumpValue(AA) << "\n");
 
        NodeID dstFA = getValueNode(FA);
        NodeID srcAA = getValueNode(AA);
        FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(svffun);
        addCallEdge(srcAA, dstFA, callICFGNode, entry);
    }
    //Any remaining actual args must be varargs.
    if (F->isVarArg())
    {
        NodeID vaF = getVarargNode(svffun);
        DBOUT(DPAGBuild, outs() << "\n      varargs:");
        for (; itA != ieA; ++itA)
        {
            const Value* AA = cs->getArgOperand(itA);
            NodeID vnAA = getValueNode(AA);
            FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(svffun);
            addCallEdge(vnAA,vaF, callICFGNode,entry);
        }
    }
    if(itA != ieA)
    {
        writeWrnMsg("too many args to non-vararg func.");
        writeWrnMsg("(" + callICFGNode->getSourceLoc() + ")");
 
    }
}

handleExtCall()

void SVFIRBuilder::handleExtCall ( const CallBase *  cs, const Function *  callee  )

protectedvirtual

pthread_create has 1 arg. apr_thread_create has 2 arg.

Connect actual parameter to formal parameter of the start routine

handle indirect calls at pthread create APIs e.g., pthread_create(&t1, nullptr, fp, ...); const Value* fun = ThreadAPI::getThreadAPI()->getForkedFun(inst); if(!SVFUtilisa<Function>(fun)) pag->addIndirectCallsites(cs,pag->getValueNode(fun));

If forkedFun does not pass to spawnee as function type but as void pointer remember to update inter-procedural callgraph/SVFIR/SVFG etc. when indirect call targets are resolved We don't connect the callgraph here, further investigation is need to handle mod-ref during SVFG construction.

TODO: inter-procedural SVFIR edges for thread joins

Definition at line 471 of file SVFIRExtAPI.cpp.

{
    const CallICFGNode *callICFGNode = llvmModuleSet()->getCallICFGNode(cs);
 
    if (hasNondetArgStoreAtExtCall(callICFGNode))
    {
        handleNondetArgStoreAtExtCall(cs, callICFGNode);
    }
    else if (isHeapAllocExtCallViaRet(callICFGNode))
    {
        NodeID val = llvmModuleSet()->getValueNode(cs);
        NodeID obj = llvmModuleSet()->getObjectNode(cs);
        addAddrWithHeapSz(obj, val, cs);
    }
    else if (isHeapAllocExtCallViaArg(callICFGNode))
    {
        u32_t arg_pos = LLVMUtil::getHeapAllocHoldingArgPosition(callee);
        Value* arg = cs->getArgOperand(arg_pos);
        if (cs->getArgOperand(arg_pos)->getType()->isPointerTy())
        {
            NodeID vnArg = llvmModuleSet()->getValueNode(arg);
            NodeID dummy = pag->addDummyValNode();
            NodeID obj = pag->addDummyObjNode(llvmModuleSet()->getSVFType(cs->getArgOperand(arg_pos)->getType()));
            if (vnArg && dummy && obj)
            {
                addAddrWithHeapSz(obj, dummy, cs);
                addStoreEdge(dummy, vnArg);
            }
        }
        else
        {
            writeWrnMsg("Arg receiving new object must be pointer type");
        }
    }
    else if (LLVMUtil::isMemcpyExtFun(callee))
    {
        // Side-effects similar to void *memcpy(void *dest, const void * src, size_t n)
        // which  copies n characters from memory area 'src' to memory area 'dest'.
        if(callee->getName().find("iconv") != std::string::npos)
            addComplexConsForExt(cs->getArgOperand(3), cs->getArgOperand(1), nullptr);
        else if(callee->getName().find("bcopy") != std::string::npos)
            addComplexConsForExt(cs->getArgOperand(1), cs->getArgOperand(0), cs->getArgOperand(2));
        if(cs->arg_size() == 3)
            addComplexConsForExt(cs->getArgOperand(0), cs->getArgOperand(1), cs->getArgOperand(2));
        else
            addComplexConsForExt(cs->getArgOperand(0), cs->getArgOperand(1), nullptr);
        if(SVFUtil::isa<PointerType>(cs->getType()))
            addCopyEdge(getValueNode(cs->getArgOperand(0)), getValueNode(cs), CopyStmt::COPYVAL);
    }
    else if (llvmModuleSet()->hasExtFuncAnnotation(callee, "STRLEN"))
    {
        // strlen(p) and wcslen(p) read characters, not just p's address.
        // For char s[4]="ABC", represent reads of s[0..3] so a write
        // to s[1] in a callee can reach this call through the SVFG.
        std::vector<AccessPath> fields;
        const Value* arg = cs->getArgOperand(0);
        const Type* type = getBaseTypeAndFlattenedFields(arg, fields, nullptr);
        for (const AccessPath& field : fields)
        {
            const SVFType* elementType = pag->getFlatternedElemType(
                                             llvmModuleSet()->getSVFType(type),
                                             field.getConstantStructFldIdx());
            NodeID address = getGepValVar(arg, field, elementType);
            addLoadEdge(address, pag->addDummyValNode());
        }
    }
    else if(LLVMUtil::isMemsetExtFun(callee))
    {
        // Side-effects similar to memset(void *str, int c, size_t n)
        // which copies the character c (an unsigned char) to the first n characters of the string pointed to, by the argument str
        std::vector<AccessPath> dstFields;
        const Type *dtype = getBaseTypeAndFlattenedFields(cs->getArgOperand(0), dstFields, cs->getArgOperand(2));
        u32_t sz = dstFields.size();
        //For each field (i), add store edge *(arg0 + i) = arg1
        for (u32_t index = 0; index < sz; index++)
        {
            LLVMModuleSet* llvmmodule = LLVMModuleSet::getLLVMModuleSet();
            const SVFType* dElementType = pag->getFlatternedElemType(llvmmodule->getSVFType(dtype),
                                          dstFields[index].getConstantStructFldIdx());
            NodeID dField = getGepValVar(cs->getArgOperand(0), dstFields[index], dElementType);
            addStoreEdge(getValueNode(cs->getArgOperand(1)),dField);
        }
        if(SVFUtil::isa<PointerType>(cs->getType()))
            addCopyEdge(getValueNode(cs->getArgOperand(0)), getValueNode(cs), CopyStmt::COPYVAL);
    }
    else if(callee->getName().compare("dlsym") == 0)
    {
        /*
        Side-effects of void* dlsym( void* handle, const char* funName),
        Locate the function with the name "funName," then add a "copy" edge between the callsite and that function.
        dlsym() example:
            int main() {
                // Open the shared library
                void* handle = dlopen("./my_shared_library.so", RTLD_LAZY);
                // Find the function address
                void (*myFunctionPtr)() = (void (*)())dlsym(handle, "myFunction");
                // Call the function
                myFunctionPtr();
            }
        */
        const Value* src = cs->getArgOperand(1);
        if(const GetElementPtrInst* gep = SVFUtil::dyn_cast<GetElementPtrInst>(src))
            src = stripConstantCasts(gep->getPointerOperand());
 
        auto getHookFn = [](const Value* src)->const Function*
        {
            if (!SVFUtil::isa<GlobalVariable>(src))
                return nullptr;
 
            auto *glob = SVFUtil::cast<GlobalVariable>(src);
            if (!glob->hasInitializer() || !SVFUtil::isa<ConstantDataArray>(glob->getInitializer()))
                return nullptr;
 
            auto *constarray = SVFUtil::cast<ConstantDataArray>(glob->getInitializer());
            return LLVMUtil::getProgFunction(constarray->getAsCString().str());
        };
 
        if (const Function *fn = getHookFn(src))
        {
            NodeID srcNode = getValueNode(fn);
            addCopyEdge(srcNode,  getValueNode(cs), CopyStmt::COPYVAL);
        }
    }
    else if(callee->getName().find("_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_") != std::string::npos)
    {
        // The purpose of this function is to insert a new node into the red-black tree and then rebalance the tree to ensure that the red-black tree properties are maintained.
        assert(cs->arg_size() == 4 && "_Rb_tree_insert_and_rebalance should have 4 arguments.\n");
 
        // We have vArg3 points to the entry of _Rb_tree_node_base { color; parent; left; right; }.
        // Now we calculate the offset from base to vArg3
        NodeID vnArg3 = llvmModuleSet()->getValueNode(cs->getArgOperand(3));
        APOffset offset =
            getAccessPathFromBaseNode(vnArg3).getConstantStructFldIdx();
 
        // We get all flattened fields of base
        vector<AccessPath> fields =  pag->getTypeLocSetsMap(vnArg3).second;
 
        // We summarize the side effects: arg3->parent = arg1, arg3->left = arg1, arg3->right = arg1
        // Note that arg0 is aligned with "offset".
        for (APOffset i = offset + 1; i <= offset + 3; ++i)
        {
            if((u32_t)i >= fields.size())
                break;
            const SVFType* elementType = pag->getFlatternedElemType(pag->getTypeLocSetsMap(vnArg3).first,
                                         fields[i].getConstantStructFldIdx());
            NodeID vnD = getGepValVar(cs->getArgOperand(3), fields[i], elementType);
            NodeID vnS = llvmModuleSet()->getValueNode(cs->getArgOperand(1));
            if(vnD && vnS)
                addStoreEdge(vnS,vnD);
        }
    }
 
    if (isThreadForkCall(callICFGNode))
    {
        const ValVar* valVar = getForkedFun(callICFGNode);
        if (const FunValVar* funcValVar = SVFUtil::dyn_cast<FunValVar>(valVar))
        {
            const FunObjVar* forkedFun = funcValVar->getFunction()->getDefFunForMultipleModule();
            const SVFVar* actualParm = getActualParmAtForkSite(callICFGNode);
            assert((forkedFun->arg_size() <= 2) && "Size of formal parameter of start routine should be one");
            if (forkedFun->arg_size() <= 2 && forkedFun->arg_size() >= 1)
            {
                const ArgValVar* formalParm = forkedFun->getArg(0);
                if (actualParm->isPointer() && formalParm->getType()->isPointerTy())
                {
                    FunEntryICFGNode *entry = pag->getICFG()->getFunEntryICFGNode(forkedFun);
                    addThreadForkEdge(actualParm->getId(), formalParm->getId(), callICFGNode, entry);
                }
            }
        }
        else
        {
        }
    }
 
}

handleIndCall()

void SVFIRBuilder::handleIndCall ( CallBase *  cs )

protected

Handle indirect call.

Indirect call is resolved on-the-fly during pointer analysis

Definition at line 2224 of file SVFIRBuilder.cpp.

{
    const CallICFGNode* cbn = llvmModuleSet()->getCallICFGNode(cs);
    NodeID indFunPtrId = llvmModuleSet()->getValueNode(cs->getCalledOperand());
    const_cast<CallICFGNode*>(cbn)->setIndFunPtr(pag->getGNode(indFunPtrId));
    pag->addIndirectCallsites(cbn,indFunPtrId);
}

handleNondetArgStoreAtExtCall()

void SVFIRBuilder::handleNondetArgStoreAtExtCall ( const CallBase *  cs, const CallICFGNode *  callICFGNode  )

protectedvirtual

Definition at line 415 of file SVFIRExtAPI.cpp.

{
    Set<u32_t> storeTopArgs;
    NodeID src = pag->getBlkPtr();
    const FunObjVar* extFun = callICFGNode->getCalledFunction();
    if (extFun)
    {
        for (const std::string& annotation :
                ExtAPI::getExtAPI()->getExtFuncAnnotations(extFun))
        {
            u32_t annotatedFormatArg = 0;
            if (parseScanfFormatArg(annotation, annotatedFormatArg))
            {
                if (annotatedFormatArg < cs->arg_size())
                {
                    src = pag->getBlkPtr();
                    if (!scanfMayStorePointer(cs, annotatedFormatArg))
                    {
                        // scanf("%d", &n) writes a number, not a pointer. Copy BlkPtr
                        // into a non-pointer variable so AE still sees an unknown value.
                        src = pag->addValNode(NodeIDAllocator::get()->allocateValueId(), SVFType::getSVFInt8Type(), callICFGNode);
                        // Keep the call's LLVM value available when printing this variable.
                        llvmModuleSet()->addToSVFVar2LLVMValueMap(cs, pag->getGNode(src));
                        addCopyEdge(pag->getBlkPtr(), src, CopyStmt::COPYVAL);
                    }
                }
                continue;
            }
 
            u32_t firstArg = 0;
            if (!parseNondetArgStoreAtExtCall(annotation, firstArg))
                continue;
            if (firstArg >= cs->arg_size())
                continue;
 
            for (u32_t argIdx = firstArg; argIdx < cs->arg_size(); ++argIdx)
                storeTopArgs.insert(argIdx);
        }
    }
 
    for (u32_t argIdx : storeTopArgs)
    {
        const Value* arg = cs->getArgOperand(argIdx);
        if (!arg->getType()->isPointerTy())
            continue;
 
        const Type* storedType =
            LLVMModuleSet::getLLVMModuleSet()->getTypeInference()->inferObjType(arg);
        NodeID dst = getValueNode(arg);
        if (NodeID fieldZero = getDirectAccessFieldZeroValVar(arg, storedType))
            dst = fieldZero;
        if (src && dst)
            addStoreEdge(src, dst);
    }
}

inferFieldIdxFromByteOffset()

u32_t SVFIRBuilder::inferFieldIdxFromByteOffset ( const llvm::GEPOperator *  gepOp, DataLayout *  dl, AccessPath &  ap, APOffset  idx  )

protected

Infer field index from byteoffset.

Definition at line 625 of file SVFIRBuilder.cpp.

{
    return 0;
}

initDomTree()

void SVFIRBuilder::initDomTree	(	FunObjVar *	func,
		const Function *	f
	)

Definition at line 262 of file SVFIRBuilder.cpp.

{
    if (fun->isDeclaration())
        return;
    //process and stored dt & df
    DominanceFrontier df;
    DominatorTree& dt = llvmModuleSet()->getDomTree(fun);
    df.analyze(dt);
    LoopInfo loopInfo = LoopInfo(dt);
    PostDominatorTree pdt = PostDominatorTree(const_cast<Function&>(*fun));
    SVFLoopAndDomInfo* ld = svffun->getLoopAndDomInfo();
 
    Map<const SVFBasicBlock*,Set<const SVFBasicBlock*>> & dfBBsMap = ld->getDomFrontierMap();
    for (DominanceFrontierBase::const_iterator dfIter = df.begin(), eDfIter = df.end(); dfIter != eDfIter; dfIter++)
    {
        const BasicBlock* keyBB = dfIter->first;
#if LLVM_VERSION_MAJOR > 16
        const llvm::SetVector<llvm::BasicBlock* >& domSet = dfIter->second;
#else
        const std::set<BasicBlock* >& domSet = dfIter->second;
#endif
        Set<const SVFBasicBlock*>& valueBasicBlocks = dfBBsMap[llvmModuleSet()->getSVFBasicBlock(keyBB)];
        for (const BasicBlock* bbValue:domSet)
        {
            valueBasicBlocks.insert(llvmModuleSet()->getSVFBasicBlock(bbValue));
        }
    }
    std::vector<const SVFBasicBlock*> reachableBBs;
    LLVMUtil::getFunReachableBBs(fun, reachableBBs);
    ld->setReachableBBs(reachableBBs);
 
    for (Function::const_iterator bit = fun->begin(), beit = fun->end(); bit!=beit; ++bit)
    {
        const BasicBlock &bb = *bit;
        SVFBasicBlock* svfBB = llvmModuleSet()->getSVFBasicBlock(&bb);
        if (DomTreeNode* dtNode = dt.getNode(&bb))
        {
            SVFLoopAndDomInfo::BBSet& bbSet = ld->getDomTreeMap()[svfBB];
            for (const auto domBB : *dtNode)
            {
                const auto* domSVFBB = llvmModuleSet()->getSVFBasicBlock(domBB->getBlock());
                bbSet.insert(domSVFBB);
            }
        }
 
        if (DomTreeNode* pdtNode = pdt.getNode(&bb))
        {
            u32_t level = pdtNode->getLevel();
            ld->getBBPDomLevel()[svfBB] = level;
            BasicBlock* idomBB = pdtNode->getIDom()->getBlock();
            const SVFBasicBlock* idom = idomBB == NULL ? NULL: llvmModuleSet()->getSVFBasicBlock(idomBB);
            ld->getBB2PIdom()[svfBB] = idom;
 
            SVFLoopAndDomInfo::BBSet& bbSet = ld->getPostDomTreeMap()[svfBB];
            for (const auto domBB : *pdtNode)
            {
                const auto* domSVFBB = llvmModuleSet()->getSVFBasicBlock(domBB->getBlock());
                bbSet.insert(domSVFBB);
            }
        }
 
        if (const Loop* loop = loopInfo.getLoopFor(&bb))
        {
            for (const BasicBlock* loopBlock : loop->getBlocks())
            {
                const SVFBasicBlock* loopbb = llvmModuleSet()->getSVFBasicBlock(loopBlock);
                ld->addToBB2LoopMap(svfBB, loopbb);
            }
        }
    }
}

initFunObjVar()

void SVFIRBuilder::initFunObjVar

(

)

Function

set realDefFun for all functions

Definition at line 191 of file SVFIRBuilder.cpp.

{
    for (Module& mod : llvmModuleSet()->getLLVMModules())
    {
        for (const Function& f : mod.functions())
        {
            FunObjVar* svffun = const_cast<FunObjVar*>(llvmModuleSet()->getFunObjVar(&f));
            initSVFBasicBlock(&f);
 
            if (!LLVMUtil::isExtCall(&f))
            {
                initDomTree(svffun, &f);
            }
            const Function *realfun = llvmModuleSet()->getRealDefFun(&f);
            svffun->setRelDefFun(realfun == nullptr ? nullptr : llvmModuleSet()->getFunObjVar(realfun));
        }
    }
 
    // Store annotations of functions in extapi.bc
    for (const auto& pair : llvmModuleSet()->ExtFun2Annotations)
    {
        ExtAPI::getExtAPI()->setExtFuncAnnotations(llvmModuleSet()->getFunObjVar(pair.first), pair.second);
    }
 
}

InitialGlobal()

void SVFIRBuilder::InitialGlobal ( const GlobalVariable *  gvar, Constant *  C, u32_t  offset  )

protected

src should not point to anything yet

Definition at line 907 of file SVFIRBuilder.cpp.

{
    DBOUT(DPAGBuild, outs() << "global " << LLVMUtil::dumpValue(gvar)
          << " constant initializer: "
          << LLVMUtil::dumpValue(C) << "\n");
    if (C->getType()->isSingleValueType())
    {
        NodeID src = getValueNode(C);
        // get the field value if it is available, otherwise we create a dummy field node.
        setCurrentLocation(gvar, (SVFBasicBlock*) nullptr);
        NodeID field = getGlobalVarField(gvar, offset, llvmModuleSet()->getSVFType(C->getType()));
 
        if (SVFUtil::isa<GlobalVariable, Function>(C))
        {
            setCurrentLocation(C, (SVFBasicBlock*) nullptr);
            addStoreEdge(src, field);
        }
        else if (SVFUtil::isa<ConstantExpr>(C))
        {
            // add gep edge of C1 itself is a constant expression
            processCE(C);
            setCurrentLocation(C, (SVFBasicBlock*) nullptr);
            addStoreEdge(src, field);
        }
        else if (SVFUtil::isa<BlockAddress>(C))
        {
            // blockaddress instruction (e.g. i8* blockaddress(@run_vm, %182))
            // is treated as constant data object for now, see LLVMUtil.h:397, SymbolTableInfo.cpp:674 and SVFIRBuilder.cpp:183-194
            processCE(C);
            setCurrentLocation(C, (SVFBasicBlock*) nullptr);
            addAddrEdge(pag->getConstantNode(), src);
        }
        else
        {
            setCurrentLocation(C, (SVFBasicBlock*) nullptr);
            addStoreEdge(src, field);
            if (C->getType()->isPtrOrPtrVectorTy() && src != pag->getNullPtr())
                addCopyEdge(pag->getNullPtr(), src, CopyStmt::COPYVAL);
        }
    }
    else if (SVFUtil::isa<ConstantArray, ConstantStruct>(C))
    {
        if(cppUtil::isValVtbl(gvar) && !Options::VtableInSVFIR())
            return;
        for (u32_t i = 0, e = C->getNumOperands(); i != e; i++)
        {
            u32_t off = pag->getFlattenedElemIdx(llvmModuleSet()->getSVFType(C->getType()), i);
            InitialGlobal(gvar, SVFUtil::cast<Constant>(C->getOperand(i)), offset + off);
        }
    }
    else if(ConstantData* data = SVFUtil::dyn_cast<ConstantData>(C))
    {
        if(Options::ModelConsts())
        {
            if(ConstantDataSequential* seq = SVFUtil::dyn_cast<ConstantDataSequential>(data))
            {
                for(u32_t i = 0; i < seq->getNumElements(); i++)
                {
                    u32_t off = pag->getFlattenedElemIdx(llvmModuleSet()->getSVFType(C->getType()), i);
                    Constant* ct = seq->getElementAsConstant(i);
                    InitialGlobal(gvar, ct, offset + off);
                }
            }
            else
            {
                assert((SVFUtil::isa<ConstantAggregateZero, UndefValue>(data)) && "Single value type data should have been handled!");
            }
        }
    }
    else
    {
        //TODO:assert(SVFUtil::isa<ConstantVector>(C),"what else do we have");
    }
}

initialiseAggregateReturns()

void SVFIRBuilder::initialiseAggregateReturns ( )

private

Discover demanded fields and preallocate output parameters, slots and snapshots before visiting instructions. See the aggregate return example in SVFIRBuilder.h.

Definition at line 1577 of file SVFIRBuilder.cpp.

{
    const auto demands = discoverAggregateReturnFields();
    const SVFType* pointerType = llvmModuleSet()->getSVFType(
                                     PointerType::getUnqual(llvmModuleSet()->getContext()));
    // Serialized points-to sets use NodeIDs. Allocate in function order,
    // independent of pointer-keyed hash table iteration.
    for (const Function* fun : llvmModuleSet()->getFunctionSet())
    {
        auto found = demands.find(fun);
        if (found == demands.end())
            continue;
        createAggregateReturnParams(fun, found->second, pointerType);
        createAggregateCallSlots(fun, pointerType);
    }
}

initialiseBaseObjVars()

void SVFIRBuilder::initialiseBaseObjVars

(

)

Definition at line 376 of file SVFIRBuilder.cpp.

{
    // Iterate over all object symbols in the symbol table
    for (LLVMModuleSet::ValueToIDMapTy::iterator iter =
                llvmModuleSet()->objSyms().begin(); iter != llvmModuleSet()->objSyms().end();
            ++iter)
    {
        // Debug output for adding object node
        DBOUT(DPAGBuild, outs() << "add obj node " << iter->second << "\n");
 
        // Skip blackhole and constant symbols
        if(iter->second == pag->blackholeSymID() || iter->second == pag->constantSymID())
            continue;
 
        // Get the LLVM value corresponding to the symbol
        const Value* llvmValue = iter->first;
 
        const ICFGNode* icfgNode = nullptr;
        if (const Instruction* inst = SVFUtil::dyn_cast<Instruction>(llvmValue))
        {
            if(llvmModuleSet()->hasICFGNode(inst))
                icfgNode = llvmModuleSet()->getICFGNode(inst);
        }
 
        // Check if the value is a function and add a function object node
        if (SVFUtil::dyn_cast<Function>(llvmValue))
        {
            // already one
        }
        // Check if the value is a heap object and add a heap object node
        else if (LLVMUtil::isHeapObj(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addHeapObjNode(iter->second, pag->getObjTypeInfo(id), icfgNode);
        }
        // Check if the value is an alloca instruction and add a stack object node
        else if (LLVMUtil::isStackObj(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addStackObjNode(iter->second, pag->getObjTypeInfo(id), icfgNode);
        }
        else if (auto fpValue = SVFUtil::dyn_cast<ConstantFP>(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addConstantFPObjNode(iter->second, pag->getObjTypeInfo(id),  LLVMUtil::getDoubleValue(fpValue), icfgNode);
        }
        else if (auto intValue = SVFUtil::dyn_cast<ConstantInt>(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addConstantIntObjNode(iter->second, pag->getObjTypeInfo(id), LLVMUtil::getIntegerValue(intValue), icfgNode);
        }
        else if (SVFUtil::isa<ConstantPointerNull>(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addConstantNullPtrObjNode(iter->second, pag->getObjTypeInfo(id), icfgNode);
        }
        else if (SVFUtil::isa<GlobalValue>(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addGlobalObjNode(iter->second, pag->getObjTypeInfo(id), icfgNode);
        }
        else if (SVFUtil::isa<ConstantData, ConstantExpr, MetadataAsValue, BlockAddress, ConstantAggregate>(llvmValue))
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addConstantDataObjNode(iter->second, pag->getObjTypeInfo(id), icfgNode);
        }
        // Add a generic object node for other types of values
        else
        {
            NodeID id = llvmModuleSet()->getObjectNode(iter->first);
            pag->addObjNode(iter->second, pag->getObjTypeInfo(id), icfgNode);
        }
        llvmModuleSet()->addToSVFVar2LLVMValueMap(llvmValue, pag->getGNode(iter->second));
    }
 
}

initialiseNodes()

void SVFIRBuilder::initialiseNodes

(

)

Initialize nodes and edges.

add address edges for constant nodes.

add argvalvar for svffunctions

Definition at line 535 of file SVFIRBuilder.cpp.

{
    DBOUT(DPAGBuild, outs() << "Initialise SVFIR Nodes ...\n");
 
 
    pag->addBlackholeObjNode();
    pag->addConstantObjNode();
    pag->addBlackholePtrNode();
    addNullPtrNode();
 
    initialiseBaseObjVars();
    initialiseValVars();
 
    for (LLVMModuleSet::FunToIDMapTy::iterator iter =
                llvmModuleSet()->retSyms().begin(); iter != llvmModuleSet()->retSyms().end();
            ++iter)
    {
        const Value* llvmValue = iter->first;
        // retSyms keys are Function*, not Instruction, so dyn_cast<Instruction> always fails.
        // RetValPN represents the callee's return value, defined at FunExitICFGNode.
        // External functions have no exit node, so keep nullptr.
        const FunObjVar* funObjVar = llvmModuleSet()->getFunObjVar(SVFUtil::cast<Function>(llvmValue));
        const ICFGNode* icfgNode = funObjVar->isDeclaration() ? nullptr : pag->getICFG()->getFunExitICFGNode(funObjVar);
        DBOUT(DPAGBuild, outs() << "add ret node " << iter->second << "\n");
        pag->addRetNode(iter->second,
                        funObjVar,
                        llvmModuleSet()->getSVFType(iter->first->getType()), icfgNode);
        llvmModuleSet()->addToSVFVar2LLVMValueMap(llvmValue, pag->getGNode(iter->second));
        pag->returnFunObjSymMap[funObjVar] = iter->second;
    }
 
    for (LLVMModuleSet::FunToIDMapTy::iterator iter =
                llvmModuleSet()->varargSyms().begin();
            iter != llvmModuleSet()->varargSyms().end(); ++iter)
    {
        const Value* llvmValue = iter->first;
        // varargSyms keys are Function*, not Instruction.
        // Variadic arguments are received at the function entry point.
        // External functions have no entry node, so keep nullptr.
        const FunObjVar* funObjVar = llvmModuleSet()->getFunObjVar(SVFUtil::cast<Function>(llvmValue));
        const ICFGNode* icfgNode = funObjVar->isDeclaration() ? nullptr : pag->getICFG()->getFunEntryICFGNode(funObjVar);
        DBOUT(DPAGBuild, outs() << "add vararg node " << iter->second << "\n");
        pag->addVarargNode(iter->second,
                           funObjVar,
                           llvmModuleSet()->getSVFType(iter->first->getType()), icfgNode);
        llvmModuleSet()->addToSVFVar2LLVMValueMap(llvmValue, pag->getGNode(iter->second));
        pag->varargFunObjSymMap[funObjVar] = iter->second;
    }
 
    for (LLVMModuleSet::ValueToIDMapTy::iterator iter =
                llvmModuleSet()->objSyms().begin(); iter != llvmModuleSet()->objSyms().end(); ++iter)
    {
        DBOUT(DPAGBuild, outs() << "add address edges for constant node " << iter->second << "\n");
        const Value* val = iter->first;
        if (isConstantObjSym(val))
        {
            NodeID ptr = llvmModuleSet()->getValueNode(val);
            if(ptr!= pag->getBlkPtr() && ptr!= pag->getNullPtr())
            {
                setCurrentLocation(val, (SVFBasicBlock*) nullptr);
                addAddrEdge(iter->second, ptr);
            }
        }
    }
 
    assert(pag->getTotalNodeNum() >= pag->getTotalSymNum()
           && "not all node have been initialized!!!");
 
    for (auto& fun: llvmModuleSet()->getFunctionSet())
    {
        for (const Argument& arg : fun->args())
        {
            const_cast<FunObjVar*>(llvmModuleSet()->getFunObjVar(fun))->addArgument(SVFUtil::cast<ArgValVar>(
                        pag->getGNode(llvmModuleSet()->getValueNode(&arg))));
        }
    }
 
}

initialiseValVars()

void SVFIRBuilder::initialiseValVars

(

)

Definition at line 453 of file SVFIRBuilder.cpp.

{
    // Iterate over all value symbols in the symbol table
    for (LLVMModuleSet::ValueToIDMapTy::iterator iter =
                llvmModuleSet()->valSyms().begin(); iter != llvmModuleSet()->valSyms().end();
            ++iter)
    {
        // Debug output for adding value node
        DBOUT(DPAGBuild, outs() << "add val node " << iter->second << "\n");
 
        // Skip blackhole and null pointer symbols
        if(iter->second == pag->blkPtrSymID() || iter->second == pag->nullPtrSymID())
            continue;
 
        const ICFGNode* icfgNode = nullptr;
        auto llvmValue = iter->first;
 
        // Check if the value is a function and get its call graph node
        if (const Function* func = SVFUtil::dyn_cast<Function>(llvmValue))
        {
            pag->addFunValNode(iter->second, icfgNode, llvmModuleSet()->getFunObjVar(func), llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (auto argval = SVFUtil::dyn_cast<Argument>(llvmValue))
        {
            // Formal params are defined at FunEntryICFGNode (where CallPE copies actual args).
            // External (declaration-only) functions have no entry node, so keep nullptr.
            const FunObjVar* funObj = llvmModuleSet()->getFunObjVar(argval->getParent());
            const ICFGNode* entryNode = funObj->isDeclaration() ? nullptr : pag->getICFG()->getFunEntryICFGNode(funObj);
            pag->addArgValNode(
                iter->second, argval->getArgNo(), entryNode,
                funObj, llvmModuleSet()->getSVFType(llvmValue->getType()));
            if (!argval->hasName())
                pag->getGNode(iter->second)->setName("arg_" + std::to_string(argval->getArgNo()));
        }
        else if (auto fpValue = SVFUtil::dyn_cast<ConstantFP>(llvmValue))
        {
            pag->addConstantFPValNode(iter->second, LLVMUtil::getDoubleValue(fpValue), icfgNode, llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (auto intValue = SVFUtil::dyn_cast<ConstantInt>(llvmValue))
        {
            pag->addConstantIntValNode(iter->second, LLVMUtil::getIntegerValue(intValue), icfgNode, llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (SVFUtil::isa<ConstantPointerNull>(llvmValue))
        {
            pag->addConstantNullPtrValNode(iter->second, icfgNode, llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (SVFUtil::isa<GlobalValue>(llvmValue))
        {
            // Global variables are defined at the global ICFG node.
            pag->addGlobalValNode(iter->second, pag->getICFG()->getGlobalICFGNode(),
                                  llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (SVFUtil::isa<ConstantData, ConstantExpr, MetadataAsValue, BlockAddress, ConstantAggregate>(llvmValue))
        {
            pag->addConstantDataValNode(iter->second, icfgNode, llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (SVFUtil::isa<InlineAsm>(llvmValue) ||
                 SVFUtil::isa<DSOLocalEquivalent>(llvmValue) ||
                 SVFUtil::isa<NoCFIValue>(llvmValue))
        {
            pag->addAsmPCValNode(iter->second, llvmModuleSet()->getSVFType(llvmValue->getType()));
        }
        else if (const Instruction* inst = SVFUtil::dyn_cast<Instruction>(llvmValue))
        {
            if (LLVMUtil::isIntrinsicInst(inst))
                pag->addIntrinsicValNode(iter->second, llvmModuleSet()->getSVFType(llvmValue->getType()));
            else
            {
                assert(llvmModuleSet()->hasICFGNode(inst) && "LLVM instruction is not associated with an ICFGNode");
                icfgNode = llvmModuleSet()->getICFGNode(inst);
                pag->addValNode(iter->second, llvmModuleSet()->getSVFType(llvmValue->getType()), icfgNode);
            }
        }
        llvmModuleSet()->addToSVFVar2LLVMValueMap(llvmValue,
                pag->getGNode(iter->second));
    }
}

initSVFBasicBlock()

void SVFIRBuilder::initSVFBasicBlock

(

const Function *

func

)

set exit block: exit basic block must have no successors and have a return instruction

Definition at line 219 of file SVFIRBuilder.cpp.

{
    FunObjVar *svfFun = const_cast<FunObjVar *>(llvmModuleSet()->getFunObjVar(func));
    for (Function::const_iterator bit = func->begin(), ebit = func->end(); bit != ebit; ++bit)
    {
        const BasicBlock* bb = &*bit;
        SVFBasicBlock* svfbb = llvmModuleSet()->getSVFBasicBlock(bb);
        for (succ_const_iterator succ_it = succ_begin(bb); succ_it != succ_end(bb); succ_it++)
        {
            const SVFBasicBlock* svf_scc_bb = llvmModuleSet()->getSVFBasicBlock(*succ_it);
            svfbb->addSuccBasicBlock(svf_scc_bb);
        }
        for (const_pred_iterator pred_it = pred_begin(bb); pred_it != pred_end(bb); pred_it++)
        {
            const SVFBasicBlock* svf_pred_bb = llvmModuleSet()->getSVFBasicBlock(*pred_it);
            svfbb->addPredBasicBlock(svf_pred_bb);
        }
 
        if (svfbb->getSuccessors().empty())
        {
            if (LLVMUtil::basicBlockHasRetInst(bb))
            {
                assert((LLVMUtil::functionDoesNotRet(func) ||
                        SVFUtil::isa<ReturnInst>(bb->back())) &&
                       "last inst must be return inst");
                svfFun->setExitBlock(svfbb);
            }
        }
    }
    // For no return functions, we set the last block as exit BB
    // This ensures that each function that has definition must have an exit BB
    if (svfFun->hasBasicBlock() && svfFun->exitBlock == nullptr)
    {
        SVFBasicBlock* retBB = const_cast<SVFBasicBlock*>(svfFun->back());
        assert((LLVMUtil::functionDoesNotRet(func) ||
                SVFUtil::isa<ReturnInst>(&func->back().back())) &&
               "last inst must be return inst");
        svfFun->setExitBlock(retBB);
    }
}

llvmModuleSet()

LLVMModuleSet * SVF::SVFIRBuilder::llvmModuleSet ( )

inlineprivate

Definition at line 623 of file SVFIRBuilder.h.

    {
        return LLVMModuleSet::getLLVMModuleSet();
    }

processCE()

void SVFIRBuilder::processCE ( const Value *  val )

protected

Process constant expression.

Handle constant expression, and connect the gep edge

Definition at line 746 of file SVFIRBuilder.cpp.

{
    if (const Constant* ref = SVFUtil::dyn_cast<Constant>(val))
    {
        if (const ConstantExpr* gepce = isGepConstantExpr(ref))
        {
            DBOUT(DPAGBuild, outs() << "handle gep constant expression "
                  << LLVMUtil::dumpValue(ref) << "\n");
            const Constant* opnd = gepce->getOperand(0);
            // handle recursive constant express case (gep (bitcast (gep X 1)) 1)
            processCE(opnd);
            auto &GEPOp = llvm::cast<llvm::GEPOperator>(*gepce);
            Type *pType = GEPOp.getSourceElementType();
            AccessPath ap(0, llvmModuleSet()->getSVFType(pType));
            bool constGep = computeGepOffset(gepce, ap);
            // must invoke pag methods here, otherwise it will be a dead recursion cycle
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(gepce, (SVFBasicBlock*) nullptr);
            /*
             * The gep edge created are like constexpr (same edge may appear at multiple callsites)
             * so bb/inst of this edge may be rewritten several times, we treat it as global here.
             */
            addGepEdge(llvmModuleSet()->getValueNode(opnd), llvmModuleSet()->getValueNode(gepce), ap, constGep);
            setCurrentLocation(cval, cbb);
        }
        else if (const ConstantExpr* castce = isCastConstantExpr(ref))
        {
            DBOUT(DPAGBuild, outs() << "handle cast constant expression "
                  << LLVMUtil::dumpValue(ref) << "\n");
            const Constant* opnd = castce->getOperand(0);
            processCE(opnd);
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(castce, (SVFBasicBlock*) nullptr);
            addCopyEdge(llvmModuleSet()->getValueNode(opnd), llvmModuleSet()->getValueNode(castce), CopyStmt::BITCAST);
            setCurrentLocation(cval, cbb);
        }
        else if (const ConstantExpr* selectce = isSelectConstantExpr(ref))
        {
            DBOUT(DPAGBuild, outs() << "handle select constant expression "
                  << LLVMUtil::dumpValue(ref) << "\n");
            const Constant* src1 = selectce->getOperand(1);
            const Constant* src2 = selectce->getOperand(2);
            processCE(src1);
            processCE(src2);
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(selectce, (SVFBasicBlock*) nullptr);
            NodeID cond = llvmModuleSet()->getValueNode(selectce->getOperand(0));
            NodeID nsrc1 = llvmModuleSet()->getValueNode(src1);
            NodeID nsrc2 = llvmModuleSet()->getValueNode(src2);
            NodeID nres = llvmModuleSet()->getValueNode(selectce);
            addSelectStmt(nres,nsrc1, nsrc2, cond);
            setCurrentLocation(cval, cbb);
        }
        // if we meet a int2ptr, then it points-to black hole
        else if (const ConstantExpr* int2Ptrce = isInt2PtrConstantExpr(ref))
        {
            const Constant* opnd = int2Ptrce->getOperand(0);
            processCE(opnd);
            const SVFBasicBlock* cbb = getCurrentBB();
            const Value* cval = getCurrentValue();
            setCurrentLocation(int2Ptrce, (SVFBasicBlock*) nullptr);
            addCopyEdge(llvmModuleSet()->getValueNode(opnd), llvmModuleSet()->getValueNode(int2Ptrce), CopyStmt::INTTOPTR);
            setCurrentLocation(cval, cbb);
        }
        else if (const ConstantExpr* ptr2Intce = isPtr2IntConstantExpr(ref))
        {
            const Constant* opnd = ptr2Intce->getOperand(0);
            processCE(opnd);
            const SVFBasicBlock* cbb = getCurrentBB();
            const Value* cval = getCurrentValue();
            setCurrentLocation(ptr2Intce, (SVFBasicBlock*) nullptr);
            addCopyEdge(llvmModuleSet()->getValueNode(opnd), llvmModuleSet()->getValueNode(ptr2Intce), CopyStmt::PTRTOINT);
            setCurrentLocation(cval, cbb);
        }
        else if(isTruncConstantExpr(ref) || isCmpConstantExpr(ref))
        {
            // we don't handle trunc and cmp instruction for now
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(ref, (SVFBasicBlock*) nullptr);
            NodeID dst = llvmModuleSet()->getValueNode(ref);
            addBlackHoleAddrEdge(dst);
            setCurrentLocation(cval, cbb);
        }
        else if (isBinaryConstantExpr(ref))
        {
            // we don't handle binary constant expression like add(x,y) now
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(ref, (SVFBasicBlock*) nullptr);
            NodeID dst = llvmModuleSet()->getValueNode(ref);
            addBlackHoleAddrEdge(dst);
            setCurrentLocation(cval, cbb);
        }
        else if (isUnaryConstantExpr(ref))
        {
            // we don't handle unary constant expression like fneg(x) now
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(ref, (SVFBasicBlock*) nullptr);
            NodeID dst = llvmModuleSet()->getValueNode(ref);
            addBlackHoleAddrEdge(dst);
            setCurrentLocation(cval, cbb);
        }
        else if (SVFUtil::isa<ConstantAggregate>(ref))
        {
            // we don't handle constant aggregate like constant vectors
        }
        else if (SVFUtil::isa<BlockAddress>(ref))
        {
            // blockaddress instruction (e.g. i8* blockaddress(@run_vm, %182))
            // is treated as constant data object for now, see LLVMUtil.h:397, SymbolTableInfo.cpp:674 and SVFIRBuilder.cpp:183-194
            const Value* cval = getCurrentValue();
            const SVFBasicBlock* cbb = getCurrentBB();
            setCurrentLocation(ref, (SVFBasicBlock*) nullptr);
            NodeID dst = llvmModuleSet()->getValueNode(ref);
            addAddrEdge(pag->getConstantNode(), dst);
            setCurrentLocation(cval, cbb);
        }
        else
        {
            if(SVFUtil::isa<ConstantExpr>(val))
                assert(false && "we don't handle all other constant expression for now!");
        }
    }
}

sanityCheck()

void SVFIRBuilder::sanityCheck

(

)

Sanity check for SVFIR.

Definition at line 2267 of file SVFIRBuilder.cpp.

{
    for (SVFIR::iterator nIter = pag->begin(); nIter != pag->end(); ++nIter)
    {
        (void) pag->getGNode(nIter->first);
        //TODO::
        // (1)  every source(root) node of a pag tree should be object node
        //       if a node has no incoming edge, but has outgoing edges
        //       then it has to be an object node.
        // (2)  make sure every variable should be initialized
        //      otherwise it causes the a null pointer, the aliasing relation may not be captured
        //      when loading a pointer value should make sure
        //      some value has been store into this pointer before
        //      q = load p, some value should stored into p first like store w p;
        // (3)  make sure PAGNode should not have a const expr value (pointer should have unique def)
        // (4)  look closely into addComplexConsForExt, make sure program locations(e.g.,inst bb)
        //      are set correctly for dummy gepval node
        // (5)  reduce unnecessary copy edge (const casts) and ensure correctness.
    }
}

setCurrentBBAndValueForPAGEdge()

void SVFIRBuilder::setCurrentBBAndValueForPAGEdge ( PAGEdge *  edge )

protected

We assume every GepValVar and its GepStmt are unique across whole program

Only the return-value Phi merges at the shared function exit. Aggregate field stores, fallback addresses and a snapshot load before an immediate return belong to the individual return instruction.

CallPE is placed at FunEntryICFGNode (phi-like merging of actual params)

CallPE is phi-like at FunEntryICFGNode. Collect it on each CallCFGEdge whose call site appears as an operand, so the edge knows which params are passed.

Definition at line 2371 of file SVFIRBuilder.cpp.

{
    if (SVFIR::pagReadFromTXT())
        return;
 
    assert(curVal && "current Val is nullptr?");
    edge->setBB(curBB!=nullptr ? curBB : nullptr);
    edge->setValue(pag->getGNode(llvmModuleSet()->getValueNode(curVal)));
    ICFGNode* icfgNode = pag->getICFG()->getGlobalICFGNode();
    LLVMModuleSet* llvmMS = llvmModuleSet();
    if (const Instruction* curInst = SVFUtil::dyn_cast<Instruction>(curVal))
    {
        const FunObjVar* srcFun = edge->getSrcNode()->getFunction();
        const FunObjVar* dstFun = edge->getDstNode()->getFunction();
        if(srcFun!=nullptr && !SVFUtil::isa<RetPE>(edge) && !SVFUtil::isa<FunValVar>(edge->getSrcNode()) && !SVFUtil::isa<FunObjVar>(edge->getSrcNode()))
        {
            assert(srcFun==llvmMS->getFunObjVar(curInst->getFunction()) && "SrcNode of the PAGEdge not in the same function?");
        }
        if(dstFun!=nullptr && !SVFUtil::isa<CallPE>(edge) && !SVFUtil::isa<RetValPN>(edge->getDstNode()))
        {
            assert(dstFun==llvmMS->getFunObjVar(curInst->getFunction()) && "DstNode of the PAGEdge not in the same function?");
        }
 
        if (!(SVFUtil::isa<GepStmt>(edge) && SVFUtil::isa<GepValVar>(edge->getDstNode())))
            assert(curBB && "instruction does not have a basic block??");
 
        if(SVFUtil::isa<ReturnInst>(curInst) && SVFUtil::isa<PhiStmt>(edge))
        {
            icfgNode = pag->getICFG()->getFunExitICFGNode(llvmMS->getFunObjVar(curInst->getFunction()));
        }
        else if(const CallPE* callPE = SVFUtil::dyn_cast<CallPE>(edge))
        {
            icfgNode = const_cast<FunEntryICFGNode*>(callPE->getFunEntryICFGNode());
        }
        else if(SVFUtil::isa<RetPE>(edge))
        {
            icfgNode = llvmMS->getRetICFGNode(SVFUtil::cast<Instruction>(curInst));
        }
        else
        {
            icfgNode = llvmMS->getICFGNode(SVFUtil::cast<Instruction>(curInst));
        }
    }
    else if (const Argument* arg = SVFUtil::dyn_cast<Argument>(curVal))
    {
        assert(curBB && (curBB->getParent()->getEntryBlock() == curBB));
        icfgNode = pag->getICFG()->getFunEntryICFGNode(
                       llvmModuleSet()->getFunObjVar(SVFUtil::cast<Function>(arg->getParent())));
    }
    else if (SVFUtil::isa<Constant>(curVal) ||
             SVFUtil::isa<Function>(curVal) ||
             SVFUtil::isa<MetadataAsValue>(curVal))
    {
        if (!curBB)
            pag->addGlobalPAGEdge(edge);
        else
        {
            icfgNode = const_cast<ICFGNode*>(curBB->front());
        }
    }
    else
    {
        assert(false && "what else value can we have?");
    }
 
    pag->addToSVFStmtList(icfgNode,edge);
    icfgNode->addSVFStmt(edge);
    if(const CallPE* callPE = SVFUtil::dyn_cast<CallPE>(edge))
    {
        FunEntryICFGNode* entryNode = const_cast<FunEntryICFGNode*>(callPE->getFunEntryICFGNode());
        for(u32_t i = 0; i < callPE->getOpVarNum(); i++)
        {
            CallICFGNode* callNode = const_cast<CallICFGNode*>(callPE->getOpCallICFGNode(i));
            if(ICFGEdge* icfgEdge = pag->getICFG()->hasInterICFGEdge(callNode, entryNode, ICFGEdge::CallCF))
                SVFUtil::cast<CallCFGEdge>(icfgEdge)->addCallPE(callPE);
        }
    }
    else if(const RetPE* retPE = SVFUtil::dyn_cast<RetPE>(edge))
    {
        RetICFGNode* retNode = const_cast<RetICFGNode*>(retPE->getCallSite()->getRetICFGNode());
        FunExitICFGNode* exitNode = const_cast<FunExitICFGNode*>(retPE->getFunExitICFGNode());
        if(ICFGEdge* edge = pag->getICFG()->hasInterICFGEdge(exitNode, retNode, ICFGEdge::RetCF))
            SVFUtil::cast<RetCFGEdge>(edge)->addRetPE(retPE);
    }
}

setCurrentLocation() [1/2]

void SVF::SVFIRBuilder::setCurrentLocation ( const Value *  val, const BasicBlock *  bb  )

inlineprotected

Set current basic block in order to keep track of control flow information.

Definition at line 352 of file SVFIRBuilder.h.

    {
        curBB = (bb == nullptr? nullptr : llvmModuleSet()->getSVFBasicBlock(bb));
        curVal = (val == nullptr ? nullptr: val);
    }

setCurrentLocation() [2/2]

void SVF::SVFIRBuilder::setCurrentLocation ( const Value *  val, const SVFBasicBlock *  bb  )

inlineprotected

Definition at line 357 of file SVFIRBuilder.h.

    {
        curBB = bb;
        curVal = val;
    }

updateCallGraph()

void SVFIRBuilder::updateCallGraph

(

CallGraph *

callgraph

)

connect PAG edges based on callgraph

Definition at line 2232 of file SVFIRBuilder.cpp.

{
    CallGraph::CallEdgeMap::const_iterator iter = callgraph->getIndCallMap().begin();
    CallGraph::CallEdgeMap::const_iterator eiter = callgraph->getIndCallMap().end();
    for (; iter != eiter; iter++)
    {
        const CallICFGNode* callBlock = iter->first;
        const CallBase* callbase = SVFUtil::cast<CallBase>(llvmModuleSet()->getLLVMValue(callBlock));
        assert(callBlock->isIndirectCall() && "this is not an indirect call?");
        const CallGraph::FunctionSet& functions = iter->second;
        for (CallGraph::FunctionSet::const_iterator func_iter = functions.begin(); func_iter != functions.end(); func_iter++)
        {
            const Function* callee = SVFUtil::cast<Function>(llvmModuleSet()->getLLVMValue(*func_iter));
 
            if (isExtCall(*func_iter))
            {
                setCurrentLocation(callee, callee->empty() ? nullptr : &callee->getEntryBlock());
                handleExtCall(callbase, callee);
            }
            else
            {
                setCurrentLocation(llvmModuleSet()->getLLVMValue(callBlock), callBlock->getBB());
                handleDirectCall(const_cast<CallBase*>(callbase), callee);
            }
        }
    }
 
    // dump SVFIR
    if (Options::PAGDotGraph())
        pag->dump("svfir_final");
}

visitAllocaInst()

void SVFIRBuilder::visitAllocaInst ( AllocaInst &  inst )

virtual

Our visit overrides.

Visit alloca instructions Add edge V (dst) <– O (src), V here is a value node on SVFIR, O is object node on SVFIR

Definition at line 1041 of file SVFIRBuilder.cpp.

{
 
    // AllocaInst should always be a pointer type
    assert(SVFUtil::isa<PointerType>(inst.getType()));
 
    DBOUT(DPAGBuild,
          outs() << "process alloca " << LLVMUtil::dumpValue(&inst) << "\n");
    NodeID dst = getValueNode(&inst);
 
    NodeID src = getObjectNode(&inst);
 
    addAddrWithStackArraySz(src, dst, inst);
 
}

visitAtomicCmpXchgInst()

void SVF::SVFIRBuilder::visitAtomicCmpXchgInst ( AtomicCmpXchgInst &  I )

inline

Definition at line 296 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitAtomicRMWInst()

void SVF::SVFIRBuilder::visitAtomicRMWInst ( AtomicRMWInst &  I )

inline

Definition at line 300 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitBinaryOperator()

void SVFIRBuilder::visitBinaryOperator

(

BinaryOperator &

inst

)

Visit Binary Operator

Definition at line 1181 of file SVFIRBuilder.cpp.

{
    NodeID dst = getValueNode(&inst);
    assert(inst.getNumOperands() == 2 && "not two operands for BinaryOperator?");
    Value* op1 = inst.getOperand(0);
    NodeID op1Node = getValueNode(op1);
    Value* op2 = inst.getOperand(1);
    NodeID op2Node = getValueNode(op2);
    u32_t opcode = inst.getOpcode();
    addBinaryOPEdge(op1Node, op2Node, dst, opcode);
}

visitBranchInst()

void SVFIRBuilder::visitBranchInst

(

BranchInst &

inst

)

Branch and switch instructions are treated as UnaryOP br cmp label if.then, label if.else

set conditional svf var

Definition at line 1847 of file SVFIRBuilder.cpp.

{
    NodeID brinst = getValueNode(&inst);
    NodeID cond;
    if (inst.isConditional())
        cond = getValueNode(inst.getCondition());
    else
        cond = pag->getNullPtr();
 
    assert(inst.getNumSuccessors() <= 2 && "if/else has more than two branches?");
 
    BranchStmt::SuccAndCondPairVec successors;
    std::vector<const Instruction*> nextInsts;
    LLVMUtil::getNextInsts(&inst, nextInsts);
    u32_t branchID = 0;
    for (const Instruction* succInst : nextInsts)
    {
        assert(branchID <= 1 && "if/else has more than two branches?");
        const ICFGNode* icfgNode = llvmModuleSet()->getICFGNode(succInst);
        successors.push_back(std::make_pair(icfgNode, 1-branchID));
        branchID++;
    }
    addBranchStmt(brinst, cond, successors);
    if (inst.isConditional())
    {
        for (auto& edge : llvmModuleSet()->getICFGNode(&inst)->getOutEdges())
        {
            if (IntraCFGEdge* intraEdge = SVFUtil::dyn_cast<IntraCFGEdge>(edge))
            {
                intraEdge->setConditionVar(pag->getGNode(cond));
            }
        }
    }
}

visitCallBrInst()

void SVFIRBuilder::visitCallBrInst

(

CallBrInst &

I

)

Definition at line 1249 of file SVFIRBuilder.cpp.

{
    visitCallSite(&i);
}

visitCallInst()

void SVFIRBuilder::visitCallInst

(

CallInst &

I

)

Definition at line 1239 of file SVFIRBuilder.cpp.

{
    visitCallSite(&i);
}

visitCallSite()

void SVFIRBuilder::visitCallSite

(

CallBase *

cs

)

Collect callsite arguments and returns

Definition at line 1257 of file SVFIRBuilder.cpp.

{
 
    // skip llvm intrinsics
    if(isIntrinsicInst(cs))
        return;
 
    DBOUT(DPAGBuild,
          outs() << "process callsite " << LLVMUtil::dumpValue(cs) << "\n");
 
    CallICFGNode* callBlockNode = llvmModuleSet()->getCallICFGNode(cs);
    RetICFGNode* retBlockNode = llvmModuleSet()->getRetICFGNode(cs);
 
    pag->addCallSite(callBlockNode);
 
    for (u32_t i = 0; i < cs->arg_size(); i++)
        pag->addCallSiteArgs(
            callBlockNode,
            pag->getValVar(getValueNode(cs->getArgOperand(i))));
 
    if(!cs->getType()->isVoidTy())
        pag->addCallSiteRets(retBlockNode,pag->getValVar(getValueNode(cs)));
 
    if (const auto* call = SVFUtil::dyn_cast<CallInst>(cs))
        addAggregateCallFields(call);
 
    if (callBlockNode->isVirtualCall())
    {
        const Value* value = cppUtil::getVCallVtblPtr(cs);
        callBlockNode->setVtablePtr(pag->getGNode(getValueNode(value)));
    }
    if (const Function *callee = LLVMUtil::getCallee(cs))
    {
        if (LLVMUtil::isExtCall(callee))
        {
            handleExtCall(cs, callee);
        }
        else
        {
            handleDirectCall(cs, callee);
        }
    }
    else
    {
        //If the callee was not identified as a function (null F), this is indirect.
        handleIndCall(cs);
    }
}

visitCastInst()

void SVFIRBuilder::visitCastInst

(

CastInst &

I

)

Definition at line 1166 of file SVFIRBuilder.cpp.

{
 
    DBOUT(DPAGBuild,
          outs() << "process cast " << LLVMUtil::dumpValue(&inst) << "\n");
    NodeID dst = getValueNode(&inst);
 
    const Value* opnd = inst.getOperand(0);
    NodeID src = getValueNode(opnd);
    addCopyEdge(src, dst, getCopyKind(&inst));
}

visitCmpInst()

void SVFIRBuilder::visitCmpInst

(

CmpInst &

inst

)

Visit compare instruction

Definition at line 1209 of file SVFIRBuilder.cpp.

{
    NodeID dst = getValueNode(&inst);
    assert(inst.getNumOperands() == 2 && "not two operands for compare instruction?");
    Value* op1 = inst.getOperand(0);
    NodeID op1Node = getValueNode(op1);
    Value* op2 = inst.getOperand(1);
    NodeID op2Node = getValueNode(op2);
    u32_t predicate = inst.getPredicate();
    addCmpEdge(op1Node, op2Node, dst, predicate);
}

visitExtractElementInst()

void SVFIRBuilder::visitExtractElementInst

(

ExtractElementInst &

inst

)

Extract a constant pointer lane using the same field model as extractvalue. For example: a = insertelement <2 x ptr> poison, ptr p, i32 0 b = insertelement <2 x ptr> poison, ptr q, i32 0 s = select i1 cond, <2 x ptr> a, <2 x ptr> b r = extractelement <2 x ptr> s, i32 0

Lane 0 is AggregateField{0}: its copies and conditional SelectStmt are defined at a, b and s, then this visitor copies the lane into r. Dynamic indices, scalable vectors and unsupported lane definitions keep the existing fallback.

Definition at line 1838 of file SVFIRBuilder.cpp.

{
    addExtractedFieldCopy(inst);
}

visitExtractValueInst()

void SVFIRBuilder::visitExtractValueInst

(

ExtractValueInst &

inst

)

Extract a pointer from a register aggregate using its shared field definition. For example: a = insertvalue {ptr} poison, ptr p, 0 b = insertvalue {ptr} poison, ptr q, 0 s = select i1 cond, {ptr} a, {ptr} b r = extractvalue {ptr} s, 0

getAggregateFieldNode(s, {0}, field) creates field copies at a and b and a SelectStmt with cond at s. This visitor adds one CopyStmt from field to r. Further extracts of s's field 0 reuse that definition. Unsupported fields keep the existing black-hole fallback.

Definition at line 1821 of file SVFIRBuilder.cpp.

{
    addExtractedFieldCopy(inst);
}

visitFenceInst()

void SVF::SVFIRBuilder::visitFenceInst ( FenceInst &  I )

inline

Definition at line 292 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitFreezeInst()

void SVFIRBuilder::visitFreezeInst

(

FreezeInst &

inst

)

<result> = freeze ty <val> If <val> is undef or poison, ‘freeze’ returns an arbitrary, but fixed value of type ty Otherwise, this instruction is a no-op and returns the input <val>

<result> = freeze ty <val> If <val> is undef or poison, ‘freeze’ returns an arbitrary, but fixed value of type ty Otherwise, this instruction is a no-op and returns the input <val> For now, we assume <val> is never a poison or undef.

Definition at line 1988 of file SVFIRBuilder.cpp.

{
    NodeID dst = getValueNode(&inst);
    for (u32_t i = 0; i < inst.getNumOperands(); i++)
    {
        Value* opnd = inst.getOperand(i);
        NodeID src = getValueNode(opnd);
        addCopyEdge(src, dst, CopyStmt::COPYVAL);
    }
}

visitGetElementPtrInst()

void SVFIRBuilder::visitGetElementPtrInst

(

GetElementPtrInst &

inst

)

Visit getelementptr instructions

Definition at line 1126 of file SVFIRBuilder.cpp.

{
 
    NodeID dst = getValueNode(&inst);
    // GetElementPtrInst should always be a pointer or a vector contains pointers
    // for now we don't handle vector type here
    if(SVFUtil::isa<VectorType>(inst.getType()))
    {
        addBlackHoleAddrEdge(dst);
        return;
    }
 
    assert(SVFUtil::isa<PointerType>(inst.getType()));
 
    DBOUT(DPAGBuild,
          outs() << "process gep " << LLVMUtil::dumpValue(&inst) << "\n");
 
    NodeID src = getValueNode(inst.getPointerOperand());
 
    AccessPath ap(0, llvmModuleSet()->getSVFType(inst.getSourceElementType()));
    bool constGep = computeGepOffset(&inst, ap);
    if (constGep && ap.getConstantStructFldIdx() == 0 && !Options::ModelArrays())
    {
        const Type* baseObjType =
            LLVMModuleSet::getLLVMModuleSet()->getTypeInference()->inferObjType(inst.getPointerOperand());
        if (const auto* arrTy = SVFUtil::dyn_cast<ArrayType>(baseObjType))
        {
            if (arrTy->getElementType()->isPointerTy())
            {
                addCopyEdge(src, dst, CopyStmt::COPYVAL);
                return;
            }
        }
    }
    addGepEdge(src, dst, ap, constGep);
}

visitGlobal()

void SVFIRBuilder::visitGlobal ( )

protected

Handle globals including (global variable and functions)

Visit global variables for building SVFIR

initialize global variable

initialize global functions

Definition at line 987 of file SVFIRBuilder.cpp.

{
 
    for (Module &M : llvmModuleSet()->getLLVMModules())
    {
        for (Module::global_iterator I = M.global_begin(), E = M.global_end(); I != E; ++I)
        {
            GlobalVariable *gvar = &*I;
            NodeID idx = getValueNode(gvar);
            NodeID obj = getObjectNode(gvar);
 
            setCurrentLocation(gvar, (SVFBasicBlock*) nullptr);
            addAddrEdge(obj, idx);
 
            if (gvar->hasInitializer())
            {
                Constant *C = gvar->getInitializer();
                DBOUT(DPAGBuild, outs() << "add global var node "
                      << LLVMUtil::dumpValue(gvar) << "\n");
                InitialGlobal(gvar, C, 0);
            }
        }
 
 
        for (Module::const_iterator I = M.begin(), E = M.end(); I != E; ++I)
        {
            const Function* fun = &*I;
            NodeID idx = getValueNode(fun);
            NodeID obj = getObjectNode(fun);
 
            DBOUT(DPAGBuild, outs() << "add global function node " << fun->getName().str() << "\n");
            setCurrentLocation(fun, (SVFBasicBlock*) nullptr);
            addAddrEdge(obj, idx);
        }
 
        // Handle global aliases (due to linkage of multiple bc files), e.g., @x = internal alias @y. We need to add a copy from y to x.
        for (Module::alias_iterator I = M.alias_begin(), E = M.alias_end(); I != E; I++)
        {
            const GlobalAlias* alias = &*I;
            NodeID dst = llvmModuleSet()->getValueNode(alias);
            NodeID src = llvmModuleSet()->getValueNode(alias->getAliasee());
            processCE(alias->getAliasee());
            setCurrentLocation(alias, (SVFBasicBlock*) nullptr);
            addCopyEdge(src, dst, CopyStmt::COPYVAL);
        }
    }
}

visitInsertElementInst()

void SVF::SVFIRBuilder::visitInsertElementInst ( InsertElementInst &  I )

inline

Keep the whole vector defined for full-SVFG consumers. getAggregateFieldNode models supported pointer lanes separately; those definitions do not read this fallback.

Definition at line 272 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitInsertValueInst()

void SVF::SVFIRBuilder::visitInsertValueInst ( InsertValueInst &  I )

inline

Keep the whole aggregate defined for full-SVFG consumers. getAggregateFieldNode models demanded pointer fields separately; those definitions do not read this fallback.

Definition at line 243 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitInstruction()

void SVF::SVFIRBuilder::visitInstruction ( Instruction &  )

inline

Provide base case for our instruction visit.

Definition at line 306 of file SVFIRBuilder.h.

    {
        // If a new instruction is added to LLVM that we don't handle.
        // TODO: ignore here:
    }

visitInvokeInst()

void SVFIRBuilder::visitInvokeInst

(

InvokeInst &

II

)

Definition at line 1244 of file SVFIRBuilder.cpp.

{
    visitCallSite(&i);
}

visitLandingPadInst()

void SVF::SVFIRBuilder::visitLandingPadInst ( LandingPadInst &  I )

inline

Definition at line 280 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitLoadInst()

void SVFIRBuilder::visitLoadInst

(

LoadInst &

I

)

Definition at line 1086 of file SVFIRBuilder.cpp.

{
    DBOUT(DPAGBuild,
          outs() << "process load " << LLVMUtil::dumpValue(&inst) << "\n");
 
    NodeID dst = getValueNode(&inst);
 
    NodeID src = getValueNode(inst.getPointerOperand());
    const Type* loadedTy = inst.getType();
    if (NodeID fieldZero = getDirectAccessFieldZeroValVar(inst.getPointerOperand(), loadedTy))
        src = fieldZero;
 
    addLoadEdge(src, dst);
}

visitPHINode()

void SVFIRBuilder::visitPHINode

(

PHINode &

inst

)

Visit phi instructions

Definition at line 1060 of file SVFIRBuilder.cpp.

{
 
    DBOUT(DPAGBuild,
          outs() << "process phi " << LLVMUtil::dumpValue(&inst) << "\n");
 
    NodeID dst = getValueNode(&inst);
 
    for (u32_t i = 0; i < inst.getNumIncomingValues(); ++i)
    {
        const Value* val = inst.getIncomingValue(i);
        const Instruction* incomingInst = SVFUtil::dyn_cast<Instruction>(val);
        bool matched = (incomingInst == nullptr ||
                        incomingInst->getFunction() == inst.getFunction());
        (void) matched; // Suppress warning of unused variable under release build
        assert(matched && "incomingInst's Function incorrect");
        const Instruction* predInst = &inst.getIncomingBlock(i)->back();
        const ICFGNode* icfgNode = llvmModuleSet()->getICFGNode(predInst);
        NodeID src = getValueNode(val);
        addPhiStmt(dst,src,icfgNode);
    }
}

visitResumeInst()

void SVF::SVFIRBuilder::visitResumeInst ( ResumeInst &  )

inline

Instruction not that often.

Definition at line 286 of file SVFIRBuilder.h.

    {
    }

visitReturnInst()

void SVFIRBuilder::visitReturnInst

(

ReturnInst &

inst

)

Visit return instructions of a function

Definition at line 1310 of file SVFIRBuilder.cpp.

{
 
    // ReturnInst itself should always not be a pointer type
    assert(!SVFUtil::isa<PointerType>(inst.getType()));
 
    DBOUT(DPAGBuild,
          outs() << "process return " << LLVMUtil::dumpValue(&inst) << "\n");
 
    addAggregateReturnStores(inst);
 
    if(Value* src = inst.getReturnValue())
    {
        const FunObjVar *F = llvmModuleSet()->getFunObjVar(inst.getParent()->getParent());
 
        NodeID rnF = getReturnNode(F);
        NodeID vnS = getValueNode(src);
        const ICFGNode* icfgNode = llvmModuleSet()->getICFGNode(&inst);
        //vnS may be null if src is a null ptr
        addPhiStmt(rnF,vnS,icfgNode);
    }
}

visitSelectInst()

void SVFIRBuilder::visitSelectInst

(

SelectInst &

inst

)

Visit select instructions

Two operands have same incoming basic block, both are the current BB

Definition at line 1225 of file SVFIRBuilder.cpp.

{
 
    DBOUT(DPAGBuild,
          outs() << "process select " << LLVMUtil::dumpValue(&inst) << "\n");
 
    NodeID dst = getValueNode(&inst);
    NodeID src1 = getValueNode(inst.getTrueValue());
    NodeID src2 = getValueNode(inst.getFalseValue());
    NodeID cond = getValueNode(inst.getCondition());
    addSelectStmt(dst,src1,src2, cond);
}

visitShuffleVectorInst()

void SVF::SVFIRBuilder::visitShuffleVectorInst ( ShuffleVectorInst &  I )

inline

Definition at line 276 of file SVFIRBuilder.h.

    {
        addBlackHoleAddrEdge(getValueNode(&I));
    }

visitStoreInst()

void SVFIRBuilder::visitStoreInst

(

StoreInst &

inst

)

Visit store instructions

Definition at line 1104 of file SVFIRBuilder.cpp.

{
    // StoreInst itself should always not be a pointer type
    assert(!SVFUtil::isa<PointerType>(inst.getType()));
 
    DBOUT(DPAGBuild,
          outs() << "process store " << LLVMUtil::dumpValue(&inst) << "\n");
 
    NodeID dst = getValueNode(inst.getPointerOperand());
    const Type* storedTy = inst.getValueOperand()->getType();
    if (NodeID fieldZero = getDirectAccessFieldZeroValVar(inst.getPointerOperand(), storedTy))
        dst = fieldZero;
 
    NodeID src = getValueNode(inst.getValueOperand());
 
    addStoreEdge(src, dst);
 
}

visitSwitchInst()

void SVFIRBuilder::visitSwitchInst

(

SwitchInst &

inst

)

Preserve LLVM switch destinations and case values in BranchStmt.

See more: https://github.com/SVF-tools/SVF/pull/1191

Given the code:

switch (a) { case 0: printf("0\n"); break; case 1: case 2: case 3: printf("a >=1 && a <= 3\n"); break; case 4: case 6: case 7: printf("a >= 4 && a <=7\n"); break; default: printf("a < 0 || a > 7"); break; }

Generate the IR:

switch i32 %0, label sw.default [ i32 0, label sw.bb i32 1, label sw.bb1 i32 2, label sw.bb1 i32 3, label sw.bb1 i32 4, label sw.bb3 i32 6, label sw.bb3 i32 7, label sw.bb3 ]

We can get every case basic block and related case value: [ {sw.default, -1}, {sw.bb, 0}, {sw.bb1, 1}, {sw.bb1, 2}, {sw.bb1, 3}, {sw.bb3, 4}, {sw.bb3, 6}, {sw.bb3, 7}, ] Note: default case value is nullptr

set conditional svf var

Definition at line 1926 of file SVFIRBuilder.cpp.

{
    NodeID brinst = getValueNode(&inst);
    NodeID cond = getValueNode(inst.getCondition());
 
    BranchStmt::SuccAndCondPairVec successors;
    std::vector<const Instruction*> nextInsts;
    // Resolve each LLVM successor to its first non-intrinsic instruction.
    LLVMUtil::getNextInsts(&inst, nextInsts);
 
    // Record default first and -1 is the getSuccessorCondValue(default iter, usually 0)
    successors.emplace_back(llvmModuleSet()->getICFGNode(nextInsts.front()), -1);
 
    // switch (x) {
    // case 1:
    // case 2: work(); break;
    // default: other(); break;
    // }
    // Both cases jump to the same call instruction, work(). Keep two records
    // for that call's ICFG node: one with case value 1, one with case value 2.
    // findCaseDest() returns nullptr for a block shared by multiple cases.
    // Read the value from each case, not from its destination block.
    for (const auto& switchCase : inst.cases())
    {
        const ConstantInt* condVal = switchCase.getCaseValue();
        s64_t val = -1;
        if (condVal->getBitWidth() <= 64)
            val = LLVMUtil::getIntegerValue(condVal).first;
        // In the example, both cases resolve to the same call to work().
        const Instruction* succInst = nextInsts[switchCase.getSuccessorIndex()];
        const ICFGNode* icfgNode = llvmModuleSet()->getICFGNode(succInst);
        successors.push_back(std::make_pair(icfgNode, val));
    }
    addBranchStmt(brinst, cond, successors);
    for (auto& edge : llvmModuleSet()->getICFGNode(&inst)->getOutEdges())
    {
        if (IntraCFGEdge* intraEdge = SVFUtil::dyn_cast<IntraCFGEdge>(edge))
        {
            intraEdge->setConditionVar(pag->getGNode(cond));
        }
    }
}

visitUnaryOperator()

void SVFIRBuilder::visitUnaryOperator

(

UnaryOperator &

inst

)

Visit Unary Operator

Definition at line 1196 of file SVFIRBuilder.cpp.

{
    NodeID dst = getValueNode(&inst);
    assert(inst.getNumOperands() == 1 && "not one operand for Unary instruction?");
    Value* opnd = inst.getOperand(0);
    NodeID src = getValueNode(opnd);
    u32_t opcode = inst.getOpcode();
    addUnaryOPEdge(src, dst, opcode);
}

visitUnreachableInst()

void SVF::SVFIRBuilder::visitUnreachableInst ( UnreachableInst &  )

inline

Definition at line 289 of file SVFIRBuilder.h.

    {
    }

visitVAArgInst()

void SVFIRBuilder::visitVAArgInst

(

VAArgInst &

inst

)

TODO: var arguments need to be handled. https://llvm.org/docs/LangRef.html#id1911

ap = alloca struct.va_list ap2 = bitcast struct.va_list* ap to i8* ; Read a single integer argument from ap2 tmp = va_arg i8* ap2, i32 (VAArgInst) TODO: for now, create a copy edge from ap2 to tmp, we assume here tmp should point to the n-th argument of the var_args

Definition at line 1976 of file SVFIRBuilder.cpp.

{
    NodeID dst = getValueNode(&inst);
    Value* opnd = inst.getPointerOperand();
    NodeID src = getValueNode(opnd);
    addCopyEdge(src, dst, CopyStmt::COPYVAL);
}

visitVACopyInst()

void SVF::SVFIRBuilder::visitVACopyInst ( VACopyInst &  )

inline

Definition at line 258 of file SVFIRBuilder.h.

{}

visitVAEndInst()

void SVF::SVFIRBuilder::visitVAEndInst ( VAEndInst &  )

inline

Definition at line 259 of file SVFIRBuilder.h.

{}

visitVAStartInst()

void SVF::SVFIRBuilder::visitVAStartInst ( VAStartInst &  )

inline

Definition at line 260 of file SVFIRBuilder.h.

{}

Friends And Related Symbol Documentation

GraphDBSVFIRBuilder

friend class GraphDBSVFIRBuilder

friend

Definition at line 51 of file SVFIRBuilder.h.

Member Data Documentation

aggregateCallArgs

Map<const CallInst*, std::map<AggregateField, NodeID> > SVF::SVFIRBuilder::aggregateCallArgs

private

Slot addresses that each call to a modeled callee passes as output arguments, in field-path order, including calls with unused results. visitCallSite appends them after the call's ordinary arguments.

Definition at line 135 of file SVFIRBuilder.h.

aggregateFieldNodes

Map<AggregateFieldKey, NodeID> SVF::SVFIRBuilder::aggregateFieldNodes

private

Reuse the same scalar SVFIR node for repeated requests for a field.

Definition at line 66 of file SVFIRBuilder.h.

aggregateReturnParams

Map<const Function*, std::map<AggregateField, NodeID> > SVF::SVFIRBuilder::aggregateReturnParams

private

Output parameters of each modeled callee, in field-path order.

Carry a pointer field from a returned aggregate to its extraction. C example (Clang 21, x86-64 Linux, -O1; noinline preserves the call): struct Pair { int *first, *second; }; attribute((noinline)) struct Pair make(int *p, int *q) { return (struct Pair){p, q}; } int *first(int *p, int *q) { struct Pair a = make(p, q); return a.first; } Corresponding LLVM IR (names simplified, attributes omitted): define {ptr, ptr} @make(ptr p, ptr q) { r0 = insertvalue {ptr, ptr} poison, ptr p, 0 r1 = insertvalue {ptr, ptr} r0, ptr q, 1 ret {ptr, ptr} r1 } define ptr @first(ptr p, ptr q) { a = tail call {ptr, ptr} @make(ptr p, ptr q) x = extractvalue {ptr, ptr} a, 0 ret ptr x } Only field {0} is extracted. For this call, the field uses three distinct SVFIR nodes: obj: a pointer-sized DummyObjVar, called the return slot. This is synthetic storage, not the Pair object or an LLVM alloca. A: a DummyValVar pointing to obj, passed to make. V: a DummyValVar holding the pointer loaded from obj after the call; later uses read V without reloading obj. Each static callsite has its own obj/A/V for each demanded field. make also gets a synthetic output ArgValVar, named out_obj below. Using symbolic node names, the field transport is shown below; ordinary argument/return edges and whole-aggregate fallback edges are omitted: first's call: A = Addr(obj) make's entry: CallPE(A, out_obj) make's r0: F0 = Copy(p) make's r1: F1 = Copy(F0) make's return: Store(F1, out_obj) first's x: V = Load(A); x = Copy(V) insertvalue creates a new aggregate: r0 = {p, poison}, r1 = {p, q}. The second insertion preserves field {0}. F0 models (r0, {0}) and F1 models (r1, {0}); field {1} is not extracted here, so it needs no separate field node. The snapshot load precedes the extraction copy at the same continuation. aggregateReturnParams[make][{0}] holds out_obj. aggregateCallArgs[a][{0}] holds A, and aggregateFieldNodes[(a, {0})] holds V. obj, Addr(obj) and Load(A) are created before instructions are visited; V is loaded at x, the instruction after the call. All calls to make append their own A to match out_obj, even with unused results. More demanded fields follow field-path order. These additions affect only SVFIR; the LLVM signatures above do not change.

Definition at line 131 of file SVFIRBuilder.h.

curBB

const SVFBasicBlock* SVF::SVFIRBuilder::curBB

private

Current basic block during SVFIR construction when visiting the module.

Definition at line 55 of file SVFIRBuilder.h.

curVal

const Value* SVF::SVFIRBuilder::curVal

private

Current Value during SVFIR construction when visiting the module.

Definition at line 56 of file SVFIRBuilder.h.

pag

SVFIR* SVF::SVFIRBuilder::pag

private

Definition at line 54 of file SVFIRBuilder.h.

---

The documentation for this class was generated from the following files:

• /home/runner/work/SVF/SVF/svf-llvm/include/SVF-LLVM/SVFIRBuilder.h
• /home/runner/work/SVF/SVF/svf-llvm/lib/SVFIRBuilder.cpp
• /home/runner/work/SVF/SVF/svf-llvm/lib/SVFIRExtAPI.cpp