Why does the --vcall-cha option not work when generating icfg?

[Lqs66]

Hi. I am using the following command to generate ICFG: "wpa -ander --vcall-cha --dump-icfg test.ll" In the generated icfg, the virtual function callsite ("call void %14(%"class.test::base " %10), !dbg !38" and "call void %23(%"class. test::base " %19), !dbg !44") are not connected to all their possible callees according to CHA.

Attached is the icfg I generated with the corresponding IR. ir+icfg.zip

[yuleisui]

Would you help us narrow down and pinpoint the CHG problem if you can?

[Lqs66]

Would you help us narrow down and pinpoint the CHG problem if you can?

Thanks for your reply, I am using SVF-2.1 version. I see a similar problem "https://github.com/SVF-tools/SVF/issues/280". I compared SVF-2.1's PointerAnalysis::finalize() function implementation "https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41" and"https:// github.com/SVF-tools/SVF/issues/280#issuecomment-666774031". The problem seems to be here. But I haven't bothered to verify it yet.

[Lqs66]

Would you help us narrow down and pinpoint the CHG problem if you can?

Thanks for your reply, I am using SVF-2.1 version. I see a similar problem "#280". I compared SVF-2.1's PointerAnalysis::finalize() function implementation "https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41" and"https:// github.com/SVF-tools/SVF/issues/280#issuecomment-666774031". The problem seems to be here. But I haven't bothered to verify it yet.

I've confirmed that following the "https://github.com/SVF-tools/SVF/issues/280" method solves the problem.

[yuleisui]

Would you help us narrow down and pinpoint the CHG problem if you can?

Thanks for your reply, I am using SVF-2.1 version. I see a similar problem "#280". I compared SVF-2.1's PointerAnalysis::finalize() function implementation "https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41" and"https:// github.com/SVF-tools/SVF/issues/280#issuecomment-666774031". The problem seems to be here. But I haven't bothered to verify it yet.

I've confirmed that following the "#280" method solves the problem.

What method you used?

[Lqs66]

Would you help us narrow down and pinpoint the CHG problem if you can?

Thanks for your reply, I am using SVF-2.1 version. I see a similar problem "#280". I compared SVF-2.1's PointerAnalysis::finalize() function implementation "https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41" and"https:// github.com/SVF-tools/SVF/issues/280#issuecomment-666774031". The problem seems to be here. But I haven't bothered to verify it yet.

I've confirmed that following the "#280" method solves the problem.

What method you used?

I added pag->getICFG()->updateCallGraph(ptaCallGraph); in 'https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41'. Like this:

// dump ICFG
    if (DumpICFG){
        pag->getICFG()->updateCallGraph(ptaCallGraph);
        pag->getICFG()->dump("icfg_final");
    }

[yuleisui]

Would you help us narrow down and pinpoint the CHG problem if you can?

Thanks for your reply, I am using SVF-2.1 version. I see a similar problem "#280". I compared SVF-2.1's PointerAnalysis::finalize() function implementation "https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41" and"https:// github.com/SVF-tools/SVF/issues/280#issuecomment-666774031". The problem seems to be here. But I haven't bothered to verify it yet.

I've confirmed that following the "#280" method solves the problem.

What method you used?

I added pag->getICFG()->updateCallGraph(ptaCallGraph); in 'https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41'. Like this:

// dump ICFG
    if (DumpICFG){
        pag->getICFG()->updateCallGraph(ptaCallGraph);
      pag->getICFG()->dump("icfg_final");
    }

I see. You could also create an andersen’s analysis and update the cfg outside a pointer analysis.

[Lqs66]

Would you help us narrow down and pinpoint the CHG problem if you can?

Thanks for your reply, I am using SVF-2.1 version. I see a similar problem "#280". I compared SVF-2.1's PointerAnalysis::finalize() function implementation "https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41" and"https:// github.com/SVF-tools/SVF/issues/280#issuecomment-666774031". The problem seems to be here. But I haven't bothered to verify it yet.

I've confirmed that following the "#280" method solves the problem.

What method you used?

I added pag->getICFG()->updateCallGraph(ptaCallGraph); in 'https://github.com/SVF-tools/SVF/blob/e7c859ae0633c27c9f0d2cd4043298df4d3a3c4a/lib/MemoryModel/PointerAnalysis.cpp#L272C3-L273C41'. Like this:

// dump ICFG
    if (DumpICFG){
        pag->getICFG()->updateCallGraph(ptaCallGraph);
        pag->getICFG()->dump("icfg_final");
    }

I see. You could also create an andersen’s analysis and update the cfg outside a pointer analysis.

Thank you for your reply. Do you mean that you call the functions of andersen's analysis before creating the icfg and then create the icfg based on the results of the analysis?

[yuleisui]

Yes, run Andersen analysis first and then update ICFG.

[Lqs66]

Yes, run Andersen analysis first and then update ICFG.

Thanks for the suggestion, I will try it later and it will be very helpful for me to learn SVF.