This PR adds field sensitivity to the analysis.
To enable, set
options:
field-sensitive: true
in your config file.
This is experimental and needs improvement before running on large codebases, but it is built with adaptability in mind. We should be able to only have field sensitivity for some struct types only while most values are tracked without, or enable only on some functions.
Also changes significantly how summaries are constructed, relying less on the pointer analysis to get better object access paths (this still requires the pointer analysis to query for aliasing, but only during mark propagation vs. mark propagation and querying marks before).
This PR adds field sensitivity to the analysis. To enable, set
in your config file.
This is experimental and needs improvement before running on large codebases, but it is built with adaptability in mind. We should be able to only have field sensitivity for some struct types only while most values are tracked without, or enable only on some functions.
Also changes significantly how summaries are constructed, relying less on the pointer analysis to get better object access paths (this still requires the pointer analysis to query for aliasing, but only during mark propagation vs. mark propagation and querying marks before).