Static Value-Flow Analysis
|
#include <VersionedFlowSensitive.h>
Classes | |
class | SCC |
Static Public Member Functions | |
static VersionedVar | atKey (NodeID, Version) |
Return key into vPtD for address-taken var of a specific version. | |
static bool | classof (const VersionedFlowSensitive *) |
Methods to support type inquiry through isa, cast, and dyn_cast. | |
static bool | classof (const PointerAnalysis *pta) |
static VersionedFlowSensitive * | createVFSWPA (SVFIR *_pag) |
Create single instance of versioned flow-sensitive points-to analysis. | |
static void | releaseVFSWPA () |
Release flow-sensitive pointer analysis. | |
Static Public Member Functions inherited from SVF::FlowSensitive | |
static FlowSensitive * | createFSWPA (SVFIR *_pag) |
Create single instance of flow-sensitive pointer analysis. | |
static void | releaseFSWPA () |
Release flow-sensitive pointer analysis. | |
static bool | classof (const FlowSensitive *) |
Methods for support type inquiry through isa, cast, and dyn_cast. | |
static bool | classof (const PointerAnalysis *pta) |
Static Public Member Functions inherited from SVF::BVDataPTAImpl | |
static bool | classof (const PointerAnalysis *pta) |
Static Public Attributes | |
static const Version | invalidVersion = 0 |
If this version appears, there has been an error. | |
Static Public Attributes inherited from SVF::PointerAnalysis | |
static const std::string | aliasTestMayAlias = "MAYALIAS" |
static const std::string | aliasTestMayAliasMangled = "_Z8MAYALIASPvS_" |
static const std::string | aliasTestNoAlias = "NOALIAS" |
static const std::string | aliasTestNoAliasMangled = "_Z7NOALIASPvS_" |
static const std::string | aliasTestPartialAlias = "PARTIALALIAS" |
static const std::string | aliasTestPartialAliasMangled = "_Z12PARTIALALIASPvS_" |
static const std::string | aliasTestMustAlias = "MUSTALIAS" |
static const std::string | aliasTestMustAliasMangled = "_Z9MUSTALIASPvS_" |
static const std::string | aliasTestFailMayAlias = "EXPECTEDFAIL_MAYALIAS" |
static const std::string | aliasTestFailMayAliasMangled = "_Z21EXPECTEDFAIL_MAYALIASPvS_" |
static const std::string | aliasTestFailNoAlias = "EXPECTEDFAIL_NOALIAS" |
static const std::string | aliasTestFailNoAliasMangled = "_Z20EXPECTEDFAIL_NOALIASPvS_" |
Private Types | |
typedef CoreBitVector | MeldVersion |
Private Member Functions | |
void | prelabel (void) |
Prelabel the SVFG: set y(o) for stores and c(o) for delta nodes to a new version. | |
void | meldLabel (void) |
Meld label the prelabeled SVFG. | |
void | removeAllIndirectSVFGEdges (void) |
Removes all indirect edges in the SVFG. | |
void | propagateVersion (NodeID o, Version v) |
void | propagateVersion (const NodeID o, const Version v, const Version vp, bool time=true) |
virtual void | buildIsStoreLoadMaps (void) |
Fills in isStoreMap and isLoadMap. | |
virtual bool | isStore (const NodeID l) const |
Returns true if l is a store node. | |
virtual bool | isLoad (const NodeID l) const |
Returns true if l is a load node. | |
virtual void | buildDeltaMaps (void) |
Fills in deltaMap and deltaSourceMap for the SVFG. | |
virtual bool | delta (const NodeID l) const |
virtual bool | deltaSource (const NodeID l) const |
Version | getVersion (const NodeID l, const NodeID o, const LocVersionMap &lvm) const |
Shared code for getConsume and getYield. They wrap this function. | |
Version | getConsume (const NodeID l, const NodeID o) const |
Returns the consumed version of o at l. If no such version exists, returns invalidVersion. | |
Version | getYield (const NodeID l, const NodeID o) const |
Returns the yielded version of o at l. If no such version exists, returns invalidVersion. | |
void | setVersion (const NodeID l, const NodeID o, const Version v, LocVersionMap &lvm) |
Shared code for setConsume and setYield. They wrap this function. | |
void | setConsume (const NodeID l, const NodeID o, const Version v) |
Sets the consumed version of o at l to v. | |
void | setYield (const NodeID l, const NodeID o, const Version v) |
Sets the yielded version of o at l to v. | |
std::vector< Version > & | getReliantVersions (const NodeID o, const Version v) |
Returns the versions of o which rely on o:v. | |
NodeBS & | getStmtReliance (const NodeID o, const Version v) |
Returns the statements which rely on o:v. | |
void | dumpReliances (void) const |
Dumps versionReliance and stmtReliance. | |
void | dumpLocVersionMaps (void) const |
Dumps maps consume and yield. | |
void | solveAndwritePtsToFile (const std::string &filename) override |
void | writeVersionedAnalysisResultToFile (const std::string &filename) |
void | readVersionedAnalysisResultFromFile (std::ifstream &F) |
void | readPtsFromFile (const std::string &filename) override |
Static Private Member Functions | |
static bool | meld (MeldVersion &mv1, const MeldVersion &mv2) |
Melds v2 into v1 (in place), returns whether a change occurred. | |
static void | dumpMeldVersion (MeldVersion &v) |
Dumps a MeldVersion to stdout. | |
Private Attributes | |
LocVersionMap | consume |
LocVersionMap | yield |
Actual yield map. Yield analogue to consume. | |
VersionRelianceMap | versionReliance |
o -> (version -> versions which rely on it). | |
Map< NodeID, Map< Version, NodeBS > > | stmtReliance |
o x version -> statement nodes which rely on that o/version. | |
VarToPropNodeMap | versionedVarToPropNode |
Map< NodeID, NodeID > | equivalentObject |
FIFOWorkList< NodeID > | vWorklist |
Set< NodeID > | prelabeledObjects |
BVDataPTAImpl::VersionedPTDataTy * | vPtD |
Points-to DS for working with versions. | |
std::vector< bool > | deltaMap |
std::vector< bool > | deltaSourceMap |
std::vector< bool > | isStoreMap |
isStoreMap[l] means SVFG node l is a store node. | |
std::vector< bool > | isLoadMap |
isLoadMap[l] means SVFG node l is a load node. | |
u32_t | numPrelabeledNodes |
Additional statistics. | |
u32_t | numPrelabelVersions |
Number of versions created during prelabeling. | |
double | prelabelingTime |
Time to prelabel SVFG. | |
double | meldLabelingTime |
Time to meld label SVFG. | |
double | versionPropTime |
Time to propagate versions to versions which rely on them. | |
Static Private Attributes | |
static VersionedFlowSensitive * | vfspta = nullptr |
Friends | |
class | VersionedFlowSensitiveStat |
Additional Inherited Members | |
Public Attributes inherited from SVF::WPASolver< GraphType > | |
u32_t | numOfIteration |
num of iterations during constraint solving | |
Protected Types inherited from SVF::FlowSensitive | |
typedef SVFG::SVFGEdgeSetTy | SVFGEdgeSetTy |
Protected Attributes inherited from SVF::FlowSensitive | |
SVFG * | svfg |
SVFGBuilder | memSSA |
AndersenWaveDiff * | ander |
std::vector< std::pair< hclust_fast_methods, std::vector< NodeID > > > | candidateMappings |
Save candidate mappings for evaluation's sake. | |
u32_t | numOfProcessedAddr |
Statistics. | |
u32_t | numOfProcessedCopy |
Number of processed Addr node. | |
u32_t | numOfProcessedGep |
Number of processed Copy node. | |
u32_t | numOfProcessedPhi |
Number of processed Gep node. | |
u32_t | numOfProcessedLoad |
Number of processed Phi node. | |
u32_t | numOfProcessedStore |
Number of processed Load node. | |
u32_t | numOfProcessedActualParam |
Number of processed Store node. | |
u32_t | numOfProcessedFormalRet |
Number of processed actual param node. | |
u32_t | numOfProcessedMSSANode |
Number of processed formal ret node. | |
u32_t | maxSCCSize |
Number of processed mssa node. | |
u32_t | numOfSCC |
u32_t | numOfNodesInSCC |
double | solveTime |
time of solve. | |
double | sccTime |
time of SCC detection. | |
double | processTime |
time of processNode. | |
double | propagationTime |
time of points-to propagation. | |
double | directPropaTime |
time of points-to propagation of address-taken objects | |
double | indirectPropaTime |
time of points-to propagation of top-level pointers | |
double | updateTime |
time of strong/weak updates. | |
double | addrTime |
time of handling address edges | |
double | copyTime |
time of handling copy edges | |
double | gepTime |
time of handling gep edges | |
double | loadTime |
time of load edges | |
double | storeTime |
time of store edges | |
double | phiTime |
time of phi nodes. | |
double | updateCallGraphTime |
time of updating call graph | |
NodeBS | svfgHasSU |
Protected Attributes inherited from SVF::WPAFSSolver< GraphType > | |
NodeStack | nodeStack |
stack used for processing nodes. | |
Protected Attributes inherited from SVF::WPASolver< GraphType > | |
bool | reanalyze |
Reanalyze if any constraint value changed. | |
u32_t | iterationForPrintStat |
print out statistics for i-th iteration | |
GraphType | _graph |
Graph. | |
std::unique_ptr< SCC > | scc |
SCC. | |
WorkList | worklist |
Worklist for resolution. | |
Protected Attributes inherited from SVF::PointerAnalysis | |
bool | print_stat |
User input flags. | |
bool | alias_validation |
Flag for validating points-to/alias results. | |
u32_t | OnTheFlyIterBudgetForStat |
Flag for iteration budget for on-the-fly statistics. | |
SVFModule * | svfMod |
Module. | |
PTATY | ptaTy |
Pointer analysis Type. | |
PTAImplTy | ptaImplTy |
PTA implementation type. | |
PTAStat * | stat |
Statistics. | |
PTACallGraph * | callgraph |
Call graph used for pointer analysis. | |
CallGraphSCC * | callGraphSCC |
SCC for PTACallGraph. | |
ICFG * | icfg |
Interprocedural control-flow graph. | |
CommonCHGraph * | chgraph |
CHGraph. | |
Static Protected Attributes inherited from SVF::FlowSensitive | |
static std::unique_ptr< FlowSensitive > | fspta |
Static Protected Attributes inherited from SVF::PointerAnalysis | |
static SVFIR * | pag = nullptr |
SVFIR. | |
Versioned flow sensitive whole program pointer analysis
Definition at line 32 of file VersionedFlowSensitive.h.
Definition at line 43 of file VersionedFlowSensitive.h.
Definition at line 37 of file VersionedFlowSensitive.h.
Definition at line 40 of file VersionedFlowSensitive.h.
typedef Map<VersionedVar, const DummyVersionPropSVFGNode *> SVF::VersionedFlowSensitive::VarToPropNodeMap |
Definition at line 41 of file VersionedFlowSensitive.h.
typedef Map<NodeID, Map<Version, std::vector<Version> > > SVF::VersionedFlowSensitive::VersionRelianceMap |
(o -> (v -> versions with rely on o:v).
Definition at line 45 of file VersionedFlowSensitive.h.
Constructor.
Definition at line 30 of file VersionedFlowSensitive.cpp.
|
static |
Return key into vPtD for address-taken var of a specific version.
Definition at line 24 of file VersionedFlowSensitive.cpp.
|
privatevirtual |
Fills in deltaMap and deltaSourceMap for the SVFG.
use pre-analysis call graph to approximate all potential callsites
Definition at line 467 of file VersionedFlowSensitive.cpp.
|
privatevirtual |
Fills in isStoreMap and isLoadMap.
Definition at line 444 of file VersionedFlowSensitive.cpp.
|
inlinestatic |
Definition at line 74 of file VersionedFlowSensitive.h.
|
inlinestatic |
Methods to support type inquiry through isa, cast, and dyn_cast.
Definition at line 70 of file VersionedFlowSensitive.h.
|
overrideprotectedvirtual |
Override since we want to assign different weights based on versioning.
Reimplemented from SVF::FlowSensitive.
Definition at line 780 of file VersionedFlowSensitive.cpp.
|
inlinestatic |
Create single instance of versioned flow-sensitive points-to analysis.
Definition at line 81 of file VersionedFlowSensitive.h.
Returns true if l is a delta-source node, i.e., may get a new outgoing indirect edge to a delta node due to on-the-fly callgraph construction.
Definition at line 438 of file VersionedFlowSensitive.cpp.
|
private |
Dumps maps consume and yield.
Definition at line 907 of file VersionedFlowSensitive.cpp.
|
staticprivate |
Dumps a MeldVersion to stdout.
Definition at line 943 of file VersionedFlowSensitive.cpp.
|
private |
Dumps versionReliance and stmtReliance.
Definition at line 850 of file VersionedFlowSensitive.cpp.
|
overridevirtual |
Finalize analysis.
Reimplemented from SVF::FlowSensitive.
Definition at line 65 of file VersionedFlowSensitive.cpp.
Returns the consumed version of o at l. If no such version exists, returns invalidVersion.
Definition at line 810 of file VersionedFlowSensitive.cpp.
|
private |
Returns the versions of o which rely on o:v.
Definition at line 840 of file VersionedFlowSensitive.cpp.
Returns the statements which rely on o:v.
Definition at line 845 of file VersionedFlowSensitive.cpp.
|
private |
Shared code for getConsume and getYield. They wrap this function.
Definition at line 800 of file VersionedFlowSensitive.cpp.
Returns the yielded version of o at l. If no such version exists, returns invalidVersion.
Definition at line 815 of file VersionedFlowSensitive.cpp.
|
overridevirtual |
Initialize analysis.
Reimplemented from SVF::FlowSensitive.
Definition at line 45 of file VersionedFlowSensitive.cpp.
Returns true if l is a store node.
Definition at line 455 of file VersionedFlowSensitive.cpp.
|
staticprivate |
Melds v2 into v1 (in place), returns whether a change occurred.
Definition at line 426 of file VersionedFlowSensitive.cpp.
|
private |
Meld label the prelabeled SVFG.
Definition at line 120 of file VersionedFlowSensitive.cpp.
|
private |
Prelabel the SVFG: set y(o) for stores and c(o) for delta nodes to a new version.
Definition at line 73 of file VersionedFlowSensitive.cpp.
|
overrideprotectedvirtual |
Process load node
Foreach node \in src pts(dst) = union pts(node)
If o is a field-insensitive object, we should also get all field nodes' points-to sets and pass them to p.
If the ptd is a field-insensitive node, we should also get all field nodes' points-to sets and pass them to pagDst.
Reimplemented from SVF::FlowSensitive.
Definition at line 647 of file VersionedFlowSensitive.cpp.
|
overrideprotectedvirtual |
Handle various constraints.
Process each SVFG node
Reimplemented from SVF::FlowSensitive.
Definition at line 590 of file VersionedFlowSensitive.cpp.
|
overrideprotectedvirtual |
Process store node
foreach node \in dst pts(node) = union pts(src)
STORE statement can only be processed if the pointer on the LHS points to something. If we handle STORE with an empty points-to set, the OUT set will be updated from IN set. Then if LHS pointer points-to one target and it has been identified as a strong update, we can't remove those points-to information computed before this strong update from the OUT set.
check if this is a strong updates store
Reimplemented from SVF::FlowSensitive.
Definition at line 693 of file VersionedFlowSensitive.cpp.
|
private |
Propagates version v of o to version vp of o. time indicates whether it should record time taken itself.
Definition at line 560 of file VersionedFlowSensitive.cpp.
Propagates version v of o to any version of o which relies on v when o/v is changed. Recursively applies to reliant versions till no new changes are made. Adds any statements which rely on any changes made to the worklist.
Definition at line 546 of file VersionedFlowSensitive.cpp.
|
inlineoverrideprotectedvirtual |
Override to do nothing. Instead, we will use propagateVersion when necessary.
Reimplemented from SVF::FlowSensitive.
Definition at line 106 of file VersionedFlowSensitive.h.
Get PTA name.
Reimplemented from SVF::FlowSensitive.
Definition at line 63 of file VersionedFlowSensitive.h.
|
overrideprivatevirtual |
Initialization for the Solver
Load the pts from file
finalize the analysis
Reimplemented from SVF::FlowSensitive.
Definition at line 961 of file VersionedFlowSensitive.cpp.
|
private |
Definition at line 1065 of file VersionedFlowSensitive.cpp.
|
inlinestatic |
Release flow-sensitive pointer analysis.
Definition at line 93 of file VersionedFlowSensitive.h.
|
private |
Removes all indirect edges in the SVFG.
Definition at line 524 of file VersionedFlowSensitive.cpp.
Sets the consumed version of o at l to v.
Definition at line 828 of file VersionedFlowSensitive.cpp.
|
private |
Shared code for setConsume and setYield. They wrap this function.
Definition at line 822 of file VersionedFlowSensitive.cpp.
Sets the yielded version of o at l to v.
Definition at line 833 of file VersionedFlowSensitive.cpp.
|
overrideprivatevirtual |
Start analysis
Initialization for the Solver
finalize the analysis
Initialization for the Solver
finalize the analysis
Reimplemented from SVF::FlowSensitive.
Definition at line 997 of file VersionedFlowSensitive.cpp.
|
overrideprotectedvirtual |
Update nodes connected during updating call graph.
Push nodes connected during update call graph into worklist so they will be solved during next iteration.
If this is a formal-param or actual-ret node, we need to solve this phi node in next iteration
If this is a formal-in or actual-out node, we need to propagate points-to information from its predecessor node.
If this is a field-insensitive obj, propagate all field node's pts
Reimplemented from SVF::FlowSensitive.
Definition at line 605 of file VersionedFlowSensitive.cpp.
|
private |
Definition at line 1013 of file VersionedFlowSensitive.cpp.
Definition at line 34 of file VersionedFlowSensitive.h.
|
private |
Maps locations to objects to a version. The object version is what is consumed at that location.
Definition at line 197 of file VersionedFlowSensitive.h.
|
private |
deltaMap[l] means SVFG node l is a delta node, i.e., may get new incoming edges due to OTF callgraph construction.
Definition at line 226 of file VersionedFlowSensitive.h.
|
private |
deltaSourceMap[l] means SVFG node l may be a source to a delta node through an dge added as a result of on-the-fly callgraph construction.
Definition at line 231 of file VersionedFlowSensitive.h.
Definition at line 213 of file VersionedFlowSensitive.h.
If this version appears, there has been an error.
Definition at line 48 of file VersionedFlowSensitive.h.
|
private |
isLoadMap[l] means SVFG node l is a load node.
Definition at line 237 of file VersionedFlowSensitive.h.
|
private |
isStoreMap[l] means SVFG node l is a store node.
Definition at line 234 of file VersionedFlowSensitive.h.
|
private |
Time to meld label SVFG.
Definition at line 245 of file VersionedFlowSensitive.h.
|
private |
Additional statistics.
Number of prelabeled nodes.
Definition at line 241 of file VersionedFlowSensitive.h.
|
private |
Number of versions created during prelabeling.
Definition at line 242 of file VersionedFlowSensitive.h.
Definition at line 219 of file VersionedFlowSensitive.h.
|
private |
Time to prelabel SVFG.
Definition at line 244 of file VersionedFlowSensitive.h.
o x version -> statement nodes which rely on that o/version.
Definition at line 204 of file VersionedFlowSensitive.h.
|
private |
Maps an <object, version> pair to the SVFG node indicating that pair needs to be propagated.
Definition at line 208 of file VersionedFlowSensitive.h.
|
private |
Time to propagate versions to versions which rely on them.
Definition at line 246 of file VersionedFlowSensitive.h.
|
private |
o -> (version -> versions which rely on it).
Definition at line 202 of file VersionedFlowSensitive.h.
|
staticprivate |
Definition at line 249 of file VersionedFlowSensitive.h.
|
private |
Points-to DS for working with versions.
Definition at line 222 of file VersionedFlowSensitive.h.
|
private |
Worklist for performing meld labeling, takes SVFG node l. Nodes are added when the version they yield is changed.
Definition at line 217 of file VersionedFlowSensitive.h.
|
private |
Actual yield map. Yield analogue to consume.
Definition at line 199 of file VersionedFlowSensitive.h.