SVF-tools / SVF

Static Value-Flow Analysis Framework for Source Code
http://svf-tools.github.io/SVF/
Other
1.43k stars 435 forks source link

GEP instructions included as StorePE #511

Open adriaanjacobs opened 3 years ago

adriaanjacobs commented 3 years ago

When iterating the pag->getEdgeSet(PAGEdge::PEDGEK::Store) set, only edges are found of kind PAGEdge::PEDGEK::Store, as expected. However, some of them seem to have no value of type Instruction, as getInst() returns NULL.

Dumping the PAGEdge outputs the following:

StorePE: [83295<--11769]
 i8* getelementptr inbounds ([51 x i8], [51 x i8]* @.str.154.6367, i32 0, i32 0) { Can only get source location for instruction, argument, global var, function or constant data. }

Reading through the code, I cannot figure out why this GEP instruction is considered a StorePE. The only other PAGEdge that also has a NULL getInst() seems to be something like the following, although it occurs less frequently for the IR I am testing with:

StorePE: [83293<--500]
 i32 1601 { constant data }

I did not expect a GEP to be reported as a StorePE, is there something I am missing here? They all seem to be constant GEPs, no variant. Also, it seems like all of them index into global data, could it have something to do with that? Reading through other issues I saw you mention that LoadPE/StorePE's get generated also for global initializations, could it be that going on here (https://github.com/SVF-tools/SVF/issues/232#issuecomment-637926603)?

I can attach a reproducible example if you'd like, but I feel like it's rather my understanding that's lacking here, not SVF.

yuleisui commented 3 years ago

This store seems to be a constant expression. I guess the store edge is added here: https://github.com/SVF-tools/SVF/blob/master/lib/SVF-FE/PAGBuilder.cpp#L391-L414

Could you double-check and trace where the edge is added? If you can provide a bit more information, I could help see whether this is a problem.