SVF-tools / SVF

Static Value-Flow Analysis Framework for Source Code
http://svf-tools.github.io/SVF/
Other
1.43k stars 435 forks source link

Basic C++ inheritance test in PTABen does not match expected behavior for DVF or WPA -ander #1590

Open mlevatich opened 2 weeks ago

mlevatich commented 2 weeks ago

I am running the single-inheritance-1.cpp.bc test case found here: https://github.com/SVF-tools/Test-Suite/blob/master/test_cases_bc/basic_cpp_tests/single-inheritance-1.cpp.bc

int global_obj;
int *global_ptr = &global_obj;

class A {
  public:
    virtual void f(int *i) {
    // The following may alias also holds 
    // if we use flow-insensitive Andersen's analysis
    // since the vtable vtableptrA stored in the object 
    // is not strongly updated to be vtableptrB
    //MUSTALIAS(global_ptr, i);  
    }
};

class B: public A {
    virtual void f(int *i) {
      MUSTALIAS(global_ptr, i);
    }
};

int main(int argc, char **argv)
{
  int *ptr = &global_obj;

  A *pb = new B;
  pb->f(ptr);

  return 0;
}

I am running into two problems:

  1. When I run this test case with the flow-sensitive tool dvf -dfs single-inheritance-1.cpp.bc (described here: https://yuleisui.github.io/publications/tse18.pdf), it fails. dvf/SUPA thinks it is a no-alias instead of a must-alias. The expected behavior as described in the SUPA paper is a must-alias.

  2. The comment in the source indicates that the second, commented-out MUSTALIAS holds for andersen's analysis, because it is flow-insensitive. However, when I add in this MUSTALIAS and run 'wpa -ander single-inheritance-1.cpp.bc', the test fails (i.e. ander thinks the parameter in the base class is a NOALIAS, which should be only determined via a flow-sensitive analysis).

jumormt commented 2 weeks ago

I will take a look at the first question. For the second one, I didn't get your statement when I add in this MUSTALIAS. class B's MUSTALIAS holds because the typeinference module can tell the type of pb is class B, eliminating the spurious call of pb->f(ptr) to class A's f function (meaning no copy from ptr to the parameter of A's f function). class A's alias check should be NOALIAS.