SVF::SlicedMTA Class Reference

#include <MTA.h>

Public Types
using	ResolveIndirectCalls = std::function< void(CallGraph *)>
using	RacePair = MTA::RacePair
	The shared race detector lives in MTA; reuse its race-pair type.

Public Member Functions
	SlicedMTA ()
	~SlicedMTA ()
	SlicedMTA (const SlicedMTA &)=delete
SlicedMTA &	operator= (const SlicedMTA &)=delete
void	runOnModule (SVFIR *pag, const ResolveIndirectCalls &resolveIndirectCalls)
	Run the slicing pipeline on a pre-built SVFIR.

Private Member Functions
bool	runPreAnalysis (const ResolveIndirectCalls &resolveIndirectCalls)
bool	runMTASlicingAndAnalysis ()
bool	runPTASlicingAndAnalysis ()
bool	runFinalRaceDetection ()
void	buildVFGPre ()
void	runWholeProgramDetection ()
BVDataPTAImpl *	getMainPTA () const
std::set< const SVFStmt * >	getVulnerableStmts () const
	Union of both statements of every candidate race pair (the slice targets).
std::set< RacePair >	detectRacePairsOnSlicedGraph (BVDataPTAImpl *slicedPTA, MHP *slicedMHP, LockAnalysis *slicedLockAnalysis)
	Re-check the candidate race pairs on the sliced graph using FSAM points-to.
LockAnalysis *	buildFullLockAnalysis ()

Private Attributes
SVFIR *	svfIr = nullptr
u32_t	mainCxtDepth = 2
std::unique_ptr< TCT >	tct
std::unique_ptr< MHP >	mhp
std::unique_ptr< LockAnalysis >	lockAnalysis
AndersenWaveDiff *	preAnder = nullptr
std::unique_ptr< MTASVFGBuilder >	vfgPreBuilder
SVFG *	vfgPre = nullptr
std::unique_ptr< MultiStageSlicer >	multiStageSlicer
std::unique_ptr< SingleSlicer >	singleSlicer
std::set< const ICFGNode * >	singleSlicedNodes
std::unique_ptr< SlicedSVFIRView >	mtaSlicedView
std::unique_ptr< SlicedSVFIRView >	ptaSlicedView
std::unique_ptr< SlicedSVFGView >	slicedSVFGView
std::unique_ptr< FlowSensitive >	mtaFSMPTA
std::unique_ptr< SlicedTCT >	slicedTCT
std::unique_ptr< MHP >	slicedMhp
std::unique_ptr< LockAnalysis >	slicedLockAnalysis
std::unique_ptr< SlicedSVFIRView >	fullLockView
std::unique_ptr< SlicedTCT >	fullLockTCT
std::unique_ptr< LockAnalysis >	fullLockAnalysis
bool	hasThreadFunctions = false
std::set< RacePair >	racePairs

Detailed Description

Multi-stage on-demand slicing race detection pipeline (MSli).

runOnModule drives five stages on a pre-built SVFIR:

1. (caller) build SVFIR + resolve indirect calls into the PAG
2. pre-analysis: Andersen, TCT, MHP, lock, candidate race pairs, VFG_pre
3. MTA slicing: slice the thread-aware graph, build the sliced MHP/lock
4. PTA slicing + main flow-sensitive FSAM (FSMPTA) on the slice
5. final race detection on the sliced graph using FSAM points-to

It operates entirely on the SVFIR (LLVM-free). The single LLVM-dependent step – materialising resolved indirect calls into the PAG – is injected by the caller as a callback (see runOnModule).

Behaviour is controlled by Options (MTFlowSensitive, EnableSlicing, SlicingSingle, SlicedDumpDot).

Definition at line 188 of file MTA.h.

Member Typedef Documentation

RacePair

using SVF::SlicedMTA::RacePair = MTA::RacePair

The shared race detector lives in MTA; reuse its race-pair type.

Definition at line 197 of file MTA.h.

ResolveIndirectCalls

using SVF::SlicedMTA::ResolveIndirectCalls = std::function<void(CallGraph*)>

The one LLVM-dependent step of the pipeline: resolve the indirect-call edges discovered by Andersen into PAG copy/call edges. The caller (the LLVM-aware tool) supplies it via SVFIRBuilder::updateCallGraph.

Definition at line 194 of file MTA.h.

Constructor & Destructor Documentation

SlicedMTA() [1/2]

SlicedMTA::SlicedMTA ( )

default

~SlicedMTA()

SlicedMTA::~SlicedMTA

(

)

Definition at line 469 of file MTA.cpp.

{
    // Cleanup in reverse order of creation. Release the VFG_pre (and its MemSSA),
    // the FSAM, the sliced/base TCTs -- all of which reference the SVFIR -- before
    // releasing the SVFIR itself. The remaining unique_ptr members (mhp /
    // lockAnalysis / sliced* / slicers / views) auto-destroy after this body.
    vfgPreBuilder.reset();
    mtaFSMPTA.reset();
    slicedTCT.reset();
    tct.reset();
    SVFIR::releaseSVFIR();
    // The Andersen pre-analysis is a shared singleton (reused by VFG_pre and the
    // main FSMPTA, neither of which frees it); release it once here.
    AndersenWaveDiff::releaseAndersenWaveDiff();
}

SlicedMTA() [2/2]

SVF::SlicedMTA::SlicedMTA ( const SlicedMTA &  )

delete

Member Function Documentation

buildFullLockAnalysis()

LockAnalysis * SlicedMTA::buildFullLockAnalysis ( )

private

Definition at line 855 of file MTA.cpp.

{
    if (fullLockAnalysis != nullptr)
        return fullLockAnalysis.get();
    std::set<const ICFGNode*> allNodes;
    for (ICFG::iterator it = svfIr->getICFG()->begin(), eit = svfIr->getICFG()->end(); it != eit; ++it)
        allNodes.insert(it->second);
    fullLockView = std::make_unique<SlicedSVFIRView>(
                       svfIr, preAnder->getCallGraph(), svfIr->getICFG(), allNodes);
    fullLockTCT = std::make_unique<SlicedTCT>(preAnder, fullLockView.get(), slicedMaxContextLen());
    fullLockAnalysis = std::make_unique<LockAnalysis>(fullLockTCT.get());
    const SlicedSVFIRView* flv = fullLockView.get();
    fullLockAnalysis->analyze(flv->getICFG(), flv->getThreadCallGraph());
    return fullLockAnalysis.get();
}

buildVFGPre()

void SlicedMTA::buildVFGPre ( )

private

Definition at line 508 of file MTA.cpp.

{
    timePhase("Build thread-aware VFG_pre", [&]()
    {
        // preAnder is the pre-analysis Andersen built in runPreAnalysis.
        // Treat fork/join as calls so the SVFG carries the thread-oblivious
        // (fork/join-ordered) value flow.
        if (ThreadCallGraph* tcg = SVFUtil::dyn_cast<ThreadCallGraph>(preAnder->getCallGraph()))
        {
            tcg->updateCallGraph(preAnder);
            tcg->updateJoinEdge(preAnder);
        }
        vfgPreBuilder = std::make_unique<MTASVFGBuilder>(mhp.get(), lockAnalysis.get());
        vfgPre = vfgPreBuilder->buildPTROnlySVFG(preAnder);
        SVFUtil::outs() << "[VFG_pre] thread-aware SVFG: " << vfgPre->getSVFGNodeNum()
                        << " nodes, " << MTASVFGBuilder::numOfNewSVFGEdges << " interference edges\n";
    });
}

detectRacePairsOnSlicedGraph()

std::set< SlicedMTA::RacePair > SlicedMTA::detectRacePairsOnSlicedGraph ( BVDataPTAImpl *  slicedPTA, MHP *  slicedMHP, LockAnalysis *  slicedLockAnalysis  )

private

Re-check the candidate race pairs on the sliced graph using FSAM points-to.

Definition at line 1057 of file MTA.cpp.

{
 
    std::set<RacePair> filteredRacePairs;
 
    // Re-derive candidates at the main context on this graph: slicedMHP carries
    // only kept nodes, so the sliced and whole runs invoke the identical detector.
    std::set<RacePair> candidatePairs;
    MTA::detectRace(svfIr, preAnder, slicedMHP, slicedLockAnalysis,
                    preAnder->getCallGraph(), candidatePairs);
 
    // The only remaining screen is the flow-sensitive points-to refinement (the
    // ILA conditions C1-C4 were already applied by detectRace above).
    for (const RacePair& pair : candidatePairs)
    {
        // Re-check points-to intersection using sliced PTA
        PointsTo pts1, pts2;
        if (const LoadStmt* ldStmt1 = SVFUtil::dyn_cast<LoadStmt>(pair.stmt1))
        {
            pts1 = slicedPTA->getPts(ldStmt1->getRHSVarID());
        }
        else if (const StoreStmt* stStmt1 = SVFUtil::dyn_cast<StoreStmt>(pair.stmt1))
        {
            pts1 = slicedPTA->getPts(stStmt1->getLHSVarID());
        }
        else
        {
            continue;
        }
 
        if (const LoadStmt* ldStmt2 = SVFUtil::dyn_cast<LoadStmt>(pair.stmt2))
        {
            pts2 = slicedPTA->getPts(ldStmt2->getRHSVarID());
        }
        else if (const StoreStmt* stStmt2 = SVFUtil::dyn_cast<StoreStmt>(pair.stmt2))
        {
            pts2 = slicedPTA->getPts(stStmt2->getLHSVarID());
        }
        else
        {
            continue;
        }
 
        // Check if points-to sets still intersect
        if (pts1.intersects(pts2))
            filteredRacePairs.insert(pair);
    }
 
    return filteredRacePairs;
}

getMainPTA()

BVDataPTAImpl * SlicedMTA::getMainPTA ( ) const

private

Main pointer-analysis instance feeding final race detection (the flow-sensitive FSAM, a BVDataPTAImpl queried polymorphically).

Definition at line 485 of file MTA.cpp.

{
    // The main FSMPTA phase is the flow-sensitive FSAM (FSMPTA), a
    // BVDataPTAImpl, so the downstream race detector queries it polymorphically.
    return mtaFSMPTA.get();
}

getVulnerableStmts()

std::set< const SVFStmt * > SlicedMTA::getVulnerableStmts ( ) const

private

Union of both statements of every candidate race pair (the slice targets).

Definition at line 492 of file MTA.cpp.

{
    std::set<const SVFStmt*> v;
    for (const RacePair& pair : racePairs)
    {
        v.insert(pair.stmt1);
        v.insert(pair.stmt2);
    }
    return v;
}

operator=()

SlicedMTA & SVF::SlicedMTA::operator= ( const SlicedMTA &  )

delete

runFinalRaceDetection()

bool SlicedMTA::runFinalRaceDetection ( )

private

Definition at line 872 of file MTA.cpp.

{
    SVFUtil::outs() << "\n=== Final Race Detection ===\n";
 
    if (!hasThreadFunctions)
    {
        SVFUtil::outs() << "[SKIP] No thread functions found\n";
        return true;
    }
    if (mtaSlicedView == nullptr)
    {
        SVFUtil::outs() << "[SKIP] MTA sliced view not available\n";
        return true;
    }
    if (slicedMhp == nullptr || slicedLockAnalysis == nullptr)
    {
        SVFUtil::outs() << "[SKIP] Sliced MHP or LockAnalysis not available\n";
        return true;
    }
    if (getMainPTA() == nullptr)
    {
        SVFUtil::outs() << "[SKIP] Main flow-sensitive pointer analysis not available\n";
        return true;
    }
 
    std::set<RacePair> detectedPairs;
    LockAnalysis* fullLock = buildFullLockAnalysis();  // whole-ICFG lock (no bridging)
    timePhase("Final Race Detection", [&]()
    {
        detectedPairs = detectRacePairsOnSlicedGraph(
                            getMainPTA(),     // Use flow-sensitive FSAM points-to
                            slicedMhp.get(), fullLock);
    });
 
    // Distinct racy statements (the endpoints of the race pairs) -- a stabler,
    // smaller-to-report metric than the pair count.
    std::set<const SVFStmt*> racyStmts;
    for (const RacePair& rp : detectedPairs)
    {
        racyStmts.insert(rp.stmt1);
        racyStmts.insert(rp.stmt2);
    }
 
    SVFUtil::outs() << "\n=== Race Detection Summary ===\n";
    SVFUtil::outs() << "Race pairs (pre-analysis): " << racePairs.size() << "\n";
    SVFUtil::outs() << "Race pairs (sliced graph): " << detectedPairs.size() << "\n";
    SVFUtil::outs() << "Race statements (sliced graph): " << racyStmts.size() << "\n";
    // Machine-readable line for the artifact's `msli` table generator: the race
    // statements reported after slicing (the preservation metric).
    SVFUtil::outs() << "[MSLI-RQ] mode=MSli alarms=" << racyStmts.size() << "\n";
 
    if (!detectedPairs.empty())
    {
        SVFUtil::outs() << "\n=== Bug Report ===\n";
        SVFUtil::outs() << "Found " << detectedPairs.size() << " race pair(s) in sliced graph\n";
    }
    else
    {
        SVFUtil::outs() << "\nNo race pairs detected in sliced graph.\n";
    }
 
    return true;
}

runMTASlicingAndAnalysis()

bool SlicedMTA::runMTASlicingAndAnalysis ( )

private

Definition at line 634 of file MTA.cpp.

{
    SVFUtil::outs() << "\n=== MTA Slicing and Analysis ===\n";
 
    if (racePairs.empty())
    {
        SVFUtil::outs() << "[SKIP] No race pairs found in pre-analysis\n";
        return true;
    }
 
    const bool dumpDot = Options::SlicedDumpDot();
 
    // Step 1: Get vulnerable statements from race pairs
    std::set<const SVFStmt*> vulnerableStatements = getVulnerableStmts();
 
    std::set<const ICFGNode*> mtaSlicedNodes;
 
    if (Options::SlicingSingle())
    {
        // Single-pass baseline (MSli §3/§5.4): one unified slice (V_Single)
        // combining synchronization + data + call dependence, shared by both the
        // ILA and the FSPTA stages. Computed once here; reused in PTA slicing.
        SVFUtil::outs() << "[Slicing Mode] Single unified slice (V_Single) for ILA + FSPTA\n";
        singleSlicer = std::make_unique<SingleSlicer>(
                           svfIr, preAnder, mhp.get(), lockAnalysis.get(),
                           vfgPre /* data dependence over the thread-aware VFG_pre */);
        timePhase("Unified Slicing", [&]()
        {
            singleSlicedNodes = singleSlicer->runSlicing(vulnerableStatements);
        });
        mtaSlicedNodes = singleSlicedNodes;
        SVFUtil::outs() << "Unified sliced to " << mtaSlicedNodes.size() << " nodes\n";
    }
    else
    {
        SVFUtil::outs() << "[Slicing Mode] Differential slices (separate ILA + FSPTA)\n";
        multiStageSlicer = std::make_unique<MultiStageSlicer>(
                               svfIr, preAnder, mhp.get(), lockAnalysis.get(), vfgPre);
 
        // ILA slicing sources = [INIT] race statements + [THREAD-VF] sources. Keep
        // a candidate edge's query (see MTASVFGBuilder::getThreadVFQueryMap) only if
        // both endpoints survive the FSPTA slice -- i.e. the edge is in
        // ThreadVF(VFG'_pre). Closure computed here (pre<->pre) and reused by PTA slicing.
        std::set<const ICFGNode*> threadVFSources;
        if (vfgPreBuilder)
        {
            const std::set<const SVFGNode*>& retained =
                multiStageSlicer->getRetainedSVFGNodes(vulnerableStatements);
            // Millions of query entries are scanned; use a constant-time lookup
            // view of the retained nodes instead of two ordered-set lookups each.
            const Set<const SVFGNode*> retainedView(retained.begin(), retained.end());
            for (const auto& entry : vfgPreBuilder->getThreadVFQueryMap())
            {
                const MTASVFGBuilder::ThreadVFEdge& edge = entry.first;
                if (retainedView.count(edge.first) && retainedView.count(edge.second))
                {
                    // The query value holds only the lock-span witnesses; the
                    // endpoints are implicit in the edge key.
                    threadVFSources.insert(edge.first->getICFGNode());
                    threadVFSources.insert(edge.second->getICFGNode());
                    threadVFSources.insert(entry.second.begin(), entry.second.end());
                }
            }
        }
        SVFUtil::outs() << "[THREAD-VF] " << threadVFSources.size()
                        << " ILA slicing sources from VFG_pre value-flow construction\n";
        timePhase("MTA Slicing", [&]()
        {
            mtaSlicedNodes = multiStageSlicer->runILASlicing(vulnerableStatements, threadVFSources);
        });
        SVFUtil::outs() << "MTA sliced to " << mtaSlicedNodes.size() << " nodes\n";
    } // end differential MTA slice
 
    // Step 4: Build MTA SlicedSVFIRView (using pre-analysis pointer analysis)
    timePhase("Build MTA Sliced View", [&]()
    {
        mtaSlicedView = std::make_unique<SlicedSVFIRView>(
                            svfIr, preAnder->getCallGraph(), svfIr->getICFG(), mtaSlicedNodes);
    });
    mtaSlicedView->dumpStats("MTA Sliced");
 
    const SlicedSVFIRView* slicedView = mtaSlicedView.get();
 
    if (dumpDot)
    {
        SVFUtil::outs() << "\n[Dump] MTA Sliced views:\n";
        slicedView->getICFG()->dump("sliced_icfg");
        if (slicedView->getThreadCallGraph() != nullptr)
            slicedView->getThreadCallGraph()->dump("sliced_tcg");
        slicedView->getPAG()->dump("sliced_pag");
    }
 
    // Step 5: Build Sliced TCT (using pre-analysis pointer analysis)
    timePhase("Sliced Thread Create Tree", [&]()
    {
        u32_t maxContextLen = slicedMaxContextLen();
        SVFUtil::outs() << "[SlicedTCT] Using max context length: " << maxContextLen
                        << " (from -max-cxt)\n";
        // Reuse the shared pre-analysis (Andersen) for the sliced TCT.
        slicedTCT = std::make_unique<SlicedTCT>(preAnder, slicedView, maxContextLen);
        if (dumpDot)
            slicedTCT->dump("sliced_tct");
    });
 
    // Step 6: Sliced MHP and Lock Analysis
    timePhase("Sliced Interleaving and Lock Analysis", [&]()
    {
        slicedMhp = std::make_unique<MHP>(slicedTCT.get());
        slicedMhp->analyze(slicedView->getICFG(), slicedView->getThreadCallGraph());
        slicedLockAnalysis = std::make_unique<LockAnalysis>(slicedTCT.get());
        slicedLockAnalysis->analyze(slicedView->getICFG(), slicedView->getThreadCallGraph());
    });
 
    return true;
}

runOnModule()

void SlicedMTA::runOnModule	(	SVFIR *	pag,
		const ResolveIndirectCalls &	resolveIndirectCalls
	)

Run the slicing pipeline on a pre-built SVFIR.

Definition at line 998 of file MTA.cpp.

{
    svfIr = pag;
 
    SVFUtil::outs() << "[Config] Slicing: " << (Options::EnableSlicing() ? "enabled" : "disabled") << "\n";
 
    reportOriginalStats(svfIr);
 
    // The pre-analysis is context-insensitive in BOTH modes (the sliced run and
    // the FSAM baseline must share an identical pre-analysis substrate); the
    // main phase then runs at the configured context depth.
    const u32_t mainCxt = slicedMaxContextLen();
    mainCxtDepth = mainCxt;
    Options::MaxContextLen.setValue(0);
    const bool preOk = runPreAnalysis(resolveIndirectCalls);
    Options::MaxContextLen.setValue(mainCxt);
    if (!preOk)
        return;
 
    if (Options::EnableSlicing())
    {
        if (!runMTASlicingAndAnalysis()) return;
        if (!runPTASlicingAndAnalysis()) return;
        if (!runFinalRaceDetection()) return;
    }
    else
    {
        runWholeProgramDetection();
    }
 
    SVFUtil::outs() << "\n=== Analysis Complete ===\n";
}

runPreAnalysis()

bool SlicedMTA::runPreAnalysis ( const ResolveIndirectCalls &  resolveIndirectCalls )

private

Definition at line 527 of file MTA.cpp.

{
    SVFUtil::outs() << "\n=== Pre-Analysis ===\n";
 
    const bool dumpDot = Options::SlicedDumpDot();
 
    // Step 1: Pointer Analysis. Inclusion-based Andersen's (more precise than
    // Steensgaard's unification, so fewer spurious MHP/races and a smaller slice).
    // The same Andersen instance (a singleton) is reused for the thread-aware
    // VFG_pre and the main FSMPTA, so the whole pipeline shares one pre-analysis.
    timePhase("Andersen's pointer analysis", [&]()
    {
        preAnder = AndersenWaveDiff::createAndersenWaveDiff(svfIr);
        if (dumpDot)
        {
            preAnder->getConstraintGraph()->dump("original_consg");
            preAnder->getCallGraph()->dump("original_tcg");
        }
        // Materialise resolved indirect calls into the PAG (LLVM-dependent step,
        // injected by the caller), then update the ICFG with the resolved calls.
        resolveIndirectCalls(preAnder->getCallGraph());
        svfIr->getICFG()->updateCallGraph(preAnder->getCallGraph());
        if (dumpDot)
            svfIr->getICFG()->dump("original_icfg");
    });
    if (!checkAndReport("Pointer Analysis", preAnder != nullptr))
        return false;
 
    // Step 2: Build Thread Create Tree (the caller forces -max-cxt to 0 around the
    // whole pre-analysis when slicing; see runOnModule).
    timePhase("Create Thread Create Tree", [&]()
    {
        tct = std::make_unique<TCT>(preAnder);
    });
    if (dumpDot)
        tct->dump("original_tct");
 
    // A thread with several instances at the main depth must be multiforked in
    // this depth-0 TCT, or the pre-analysis under-approximates the main phase.
    timePhase("Mark truncation-merged multiforked threads", [&]()
    {
        const u32_t preCxtDepth = Options::MaxContextLen();
        Options::MaxContextLen.setValue(mainCxtDepth);
        TCT deepTct(preAnder);
        Options::MaxContextLen.setValue(preCxtDepth);
 
        // >1 instance at the main depth, or a single instance that is itself
        // multiforked (merged just beyond the main depth), marks the fork site.
        Map<const ICFGNode*, u32_t> forkSiteInstances;
        for (const auto& deepPair : deepTct)
            if (const ICFGNode* forkSite = deepPair.second->getCxtThread().getThread())
            {
                ++forkSiteInstances[forkSite];
                if (deepPair.second->isMultiforked())
                    forkSiteInstances[forkSite] = 2;
            }
 
        for (const auto& prePair : *tct)
        {
            const ICFGNode* forkSite = prePair.second->getCxtThread().getThread();
            if (forkSite == nullptr)
                continue;
            Map<const ICFGNode*, u32_t>::const_iterator fIt = forkSiteInstances.find(forkSite);
            if (fIt != forkSiteInstances.end() && fIt->second > 1)
                prePair.second->setMultiforked(true);
        }
    });
 
    // Step 3: Interleaving and Lock Analysis
    timePhase("Run Interleaving and Lock Analysis", [&]()
    {
        mhp = std::make_unique<MHP>(tct.get());
        mhp->analyze(svfIr->getICFG(), const_cast<CallGraph*>(svfIr->getCallGraph()));
        lockAnalysis = std::make_unique<LockAnalysis>(tct.get());
        lockAnalysis->analyze(svfIr->getICFG(), const_cast<CallGraph*>(svfIr->getCallGraph()));
    });
 
    // Step 4: Detect thread functions
    timePhase("Detect Thread Functions", [&]()
    {
        hasThreadFunctions = MTA::hasThreadFunctions(preAnder->getCallGraph());
    });
    if (!hasThreadFunctions)
    {
        SVFUtil::outs() << "[WARNING] No thread functions found\n";
        return true; // Not an error, just no threads to analyze
    }
 
    // Step 5: Detect race statements
    std::set<const SVFStmt*> vulnerableStatements;
    timePhase("Detect Race Statements", [&]()
    {
        // Shared equivalence-class detector (the same one MTA::reportRaces uses).
        vulnerableStatements = MTA::detectRace(
                                   svfIr, preAnder, mhp.get(), lockAnalysis.get(),
                                   preAnder->getCallGraph(), racePairs);
    });
    SVFUtil::outs() << "Found " << vulnerableStatements.size() << " vulnerable statements\n";
    SVFUtil::outs() << "Found " << racePairs.size() << " race pairs\n";
 
    // Step 6: build the thread-aware VFG once (substrate for slicing + main FS).
    buildVFGPre();
 
    return true;
}

runPTASlicingAndAnalysis()

bool SlicedMTA::runPTASlicingAndAnalysis ( )

private

Definition at line 751 of file MTA.cpp.

{
    SVFUtil::outs() << "\n=== PTA Slicing and Sliced Pointer Analysis ===\n";
 
    if (!hasThreadFunctions)
    {
        SVFUtil::outs() << "[SKIP] No thread functions found in pre-analysis, skipping PTA slicing\n";
        return true;
    }
    if (racePairs.empty())
    {
        SVFUtil::outs() << "[SKIP] No race pairs found in pre-analysis, skipping PTA slicing\n";
        return true;
    }
 
    const bool dumpDot = Options::SlicedDumpDot();
 
    std::set<const SVFStmt*> vulnerableStatements = getVulnerableStmts();
 
    std::set<const ICFGNode*> ptaSlicedNodes;
 
    if (Options::SlicingSingle())
    {
        // Single-pass baseline: reuse the unified V_Single computed in MTA slicing
        // (no separate data-dependence slice); FSPTA runs on the same slice as ILA.
        SVFUtil::outs() << "[Slicing Mode] Reusing unified slice (V_Single) for FSPTA\n";
        ptaSlicedNodes = singleSlicedNodes;
        SVFUtil::outs() << "PTA reuses unified slice: " << ptaSlicedNodes.size() << " nodes\n";
    }
    else
    {
        SVFUtil::outs() << "Using " << vulnerableStatements.size() << " vulnerable statements from pre-analysis\n";
        SVFUtil::outs() << "Using " << racePairs.size() << " race pairs from pre-analysis\n";
 
        // Stage 2 of the multi-stage slicer built during MTA slicing (it memoised
        // the shared data-dependence closure over VFG_pre); construct only if
        // absent (defensive: the ILA stage normally created it).
        if (!multiStageSlicer)
            multiStageSlicer = std::make_unique<MultiStageSlicer>(
                                   svfIr, preAnder, mhp.get(), lockAnalysis.get(),
                                   vfgPre /* paper-faithful data dependence over the thread-aware VFG */);
 
        timePhase("PTA Slicing", [&]()
        {
            ptaSlicedNodes = multiStageSlicer->runPTASlicing(vulnerableStatements);
        });
        SVFUtil::outs() << "PTA sliced to " << ptaSlicedNodes.size() << " nodes\n";
    }
 
    // Step 4: Build PTA SlicedSVFIRView for pointer analysis. Its control flow is
    // never walked (FSMPTA uses only isKeptNode), so skip bridged-edge construction.
    timePhase("Build PTA Sliced View", [&]()
    {
        ptaSlicedView = std::make_unique<SlicedSVFIRView>(
                            svfIr, preAnder->getCallGraph(), svfIr->getICFG(), ptaSlicedNodes,
                            /*buildBridged=*/false);
    });
    ptaSlicedView->dumpStats("PTA Sliced");
 
    // Both slices are fixed and the main FSMPTA builds a fresh SVFG, so release
    // VFG_pre and the slicers: the pre- and main graphs never coexist in memory.
    multiStageSlicer.reset();
    singleSlicer.reset();
    vfgPreBuilder.reset();
    vfgPre = nullptr;
 
    // Step 5: Main FSMPTA phase (flow-sensitive FSAM over a thread-aware SVFG).
    // Always rebuild the thread-aware value flow from the SLICED ILA: the sliced
    // MHP/lock analysis is context-sensitive, whereas the pre-analysis VFG_pre was
    // built context-insensitively (max-cxt forced to 0 for slicing). Reusing
    // VFG_pre would decide the interference (thread-aware value-flow) edges from a
    // context-insensitive ILA and over-approximate the FSAM points-to, so a fresh
    // context-sensitive SVFG is required to preserve the result. [THREAD-VF]
    // seeding keeps the queried interference witnesses in the slice.
    if (slicedMhp == nullptr || slicedLockAnalysis == nullptr)
    {
        SVFUtil::outs() << "[Main FSMPTA] Sliced MHP/LockAnalysis unavailable\n";
        return false;
    }
    SVFUtil::outs() << "[Main FSMPTA] Thread-aware value flow rebuilt from the SLICED ILA "
                    "(fresh context-sensitive SVFG; [THREAD-VF] load-bearing)\n";
    timePhase("Flow-Sensitive FSAM Analysis", [&]()
    {
        // The sliced SVFG view: membership from the FSPTA ICFG slice; the SVFG
        // itself is built inside the solver and bound afterwards (for dumping).
        slicedSVFGView = std::make_unique<SlicedSVFGView>(ptaSlicedView->getICFG());
        auto solver = std::make_unique<FSMPTA<const SlicedSVFGView*>>(
                          slicedMhp.get(), slicedLockAnalysis.get(), slicedSVFGView.get());
        solver->analyze();
        slicedSVFGView->setSVFG(solver->getSVFG());
        if (dumpDot)
        {
            solver->getSVFG()->dump("mta_svfg");
            slicedSVFGView->dump("sliced_svfg");
        }
        mtaFSMPTA = std::move(solver);
    });
 
    return true;
}

runWholeProgramDetection()

void SlicedMTA::runWholeProgramDetection ( )

private

No-slice A/B baseline: run the FSAM detection on the whole program (no slicing), so its time and race set can be compared against the sliced run.

Definition at line 941 of file MTA.cpp.

{
    SVFUtil::outs() << "\n=== Whole-program FSAM Race Detection (no slicing) ===\n";
    if (!hasThreadFunctions || racePairs.empty())
    {
        SVFUtil::outs() << "[SKIP] No thread functions / race pairs in pre-analysis\n";
        return;
    }
 
    // Full "slice" = every ICFG node.
    std::set<const ICFGNode*> allNodes;
    for (ICFG::iterator it = svfIr->getICFG()->begin(), eit = svfIr->getICFG()->end(); it != eit; ++it)
        allNodes.insert(it->second);
    ptaSlicedView = std::make_unique<SlicedSVFIRView>(
                        svfIr, preAnder->getCallGraph(), svfIr->getICFG(), allNodes);
 
    timePhase("Whole-program Sliced TCT/MHP/Lock", [&]()
    {
        slicedTCT = std::make_unique<SlicedTCT>(preAnder, ptaSlicedView.get(), slicedMaxContextLen());
        slicedMhp = std::make_unique<MHP>(slicedTCT.get());
        const SlicedSVFIRView* pv = ptaSlicedView.get();
        slicedMhp->analyze(pv->getICFG(), pv->getThreadCallGraph());
        slicedLockAnalysis = std::make_unique<LockAnalysis>(slicedTCT.get());
        slicedLockAnalysis->analyze(pv->getICFG(), pv->getThreadCallGraph());
    });
 
    timePhase("Whole-program Flow-Sensitive FSAM Analysis", [&]()
    {
        slicedSVFGView = std::make_unique<SlicedSVFGView>(ptaSlicedView->getICFG());
        auto solver = std::make_unique<FSMPTA<const SlicedSVFGView*>>(
                          mhp.get(), lockAnalysis.get(), slicedSVFGView.get());
        solver->analyze();
        slicedSVFGView->setSVFG(solver->getSVFG());
        mtaFSMPTA = std::move(solver);
    });
 
    std::set<RacePair> detectedPairs;
    timePhase("Final Race Detection (whole program)", [&]()
    {
        detectedPairs = detectRacePairsOnSlicedGraph(
                            getMainPTA(), slicedMhp.get(), slicedLockAnalysis.get());
    });
 
    std::set<const SVFStmt*> racyStmts;
    for (const RacePair& rp : detectedPairs)
    {
        racyStmts.insert(rp.stmt1);
        racyStmts.insert(rp.stmt2);
    }
 
    SVFUtil::outs() << "\n=== Race Detection Summary ===\n";
    SVFUtil::outs() << "Race pairs (pre-analysis): " << racePairs.size() << "\n";
    SVFUtil::outs() << "Race pairs (whole program): " << detectedPairs.size() << "\n";
    SVFUtil::outs() << "Race statements (whole program): " << racyStmts.size() << "\n";
    SVFUtil::outs() << "[MSLI-RQ] mode=FSAM alarms=" << racyStmts.size() << "\n";
}

Member Data Documentation

fullLockAnalysis

std::unique_ptr<LockAnalysis> SVF::SlicedMTA::fullLockAnalysis

private

Definition at line 270 of file MTA.h.

fullLockTCT

std::unique_ptr<SlicedTCT> SVF::SlicedMTA::fullLockTCT

private

Definition at line 269 of file MTA.h.

fullLockView

std::unique_ptr<SlicedSVFIRView> SVF::SlicedMTA::fullLockView

private

Definition at line 268 of file MTA.h.

hasThreadFunctions

bool SVF::SlicedMTA::hasThreadFunctions = false

private

Definition at line 271 of file MTA.h.

lockAnalysis

std::unique_ptr<LockAnalysis> SVF::SlicedMTA::lockAnalysis

private

Definition at line 248 of file MTA.h.

mainCxtDepth

u32_t SVF::SlicedMTA::mainCxtDepth = 2

private

Definition at line 245 of file MTA.h.

mhp

std::unique_ptr<MHP> SVF::SlicedMTA::mhp

private

Definition at line 247 of file MTA.h.

mtaFSMPTA

std::unique_ptr<FlowSensitive> SVF::SlicedMTA::mtaFSMPTA

private

Definition at line 263 of file MTA.h.

mtaSlicedView

std::unique_ptr<SlicedSVFIRView> SVF::SlicedMTA::mtaSlicedView

private

Definition at line 260 of file MTA.h.

multiStageSlicer

std::unique_ptr<MultiStageSlicer> SVF::SlicedMTA::multiStageSlicer

private

Definition at line 255 of file MTA.h.

preAnder

AndersenWaveDiff* SVF::SlicedMTA::preAnder = nullptr

private

Definition at line 252 of file MTA.h.

ptaSlicedView

std::unique_ptr<SlicedSVFIRView> SVF::SlicedMTA::ptaSlicedView

private

Definition at line 261 of file MTA.h.

racePairs

std::set<RacePair> SVF::SlicedMTA::racePairs

private

Definition at line 272 of file MTA.h.

singleSlicedNodes

std::set<const ICFGNode*> SVF::SlicedMTA::singleSlicedNodes

private

Definition at line 259 of file MTA.h.

singleSlicer

std::unique_ptr<SingleSlicer> SVF::SlicedMTA::singleSlicer

private

Definition at line 256 of file MTA.h.

slicedLockAnalysis

std::unique_ptr<LockAnalysis> SVF::SlicedMTA::slicedLockAnalysis

private

Definition at line 266 of file MTA.h.

slicedMhp

std::unique_ptr<MHP> SVF::SlicedMTA::slicedMhp

private

Definition at line 265 of file MTA.h.

slicedSVFGView

std::unique_ptr<SlicedSVFGView> SVF::SlicedMTA::slicedSVFGView

private

Definition at line 262 of file MTA.h.

slicedTCT

std::unique_ptr<SlicedTCT> SVF::SlicedMTA::slicedTCT

private

Definition at line 264 of file MTA.h.

svfIr

SVFIR* SVF::SlicedMTA::svfIr = nullptr

private

Definition at line 242 of file MTA.h.

tct

std::unique_ptr<TCT> SVF::SlicedMTA::tct

private

Definition at line 246 of file MTA.h.

vfgPre

SVFG* SVF::SlicedMTA::vfgPre = nullptr

private

Definition at line 254 of file MTA.h.

vfgPreBuilder

std::unique_ptr<MTASVFGBuilder> SVF::SlicedMTA::vfgPreBuilder

private

Definition at line 253 of file MTA.h.

---

The documentation for this class was generated from the following files:

• /home/runner/work/SVF/SVF/svf/include/MTA/MTA.h
• /home/runner/work/SVF/SVF/svf/lib/MTA/MTA.cpp