pointer analysis about svf HOT 9 OPEN

Hello,

1) Using an existing pointer analysis.
The following gives you the most intuitive way to get the results of a flow-insensitive and field-sensitive pointer analysis (Andersen's analysis)

AndersenWaveDiff* ander = AndersenWaveDiff::createAndersenWaveDiff(svfModule);
ander->getPts(NodeID)

NodeID here represents a node (pointer variable) on PAG (refer to our wiki at https://github.com/SVF-tools/SVF/wiki/Technical-documentation#12-program-assignment-graph-pag).
Every pointer operand of an instruction (e.g., store or load) maps to a PAG Node. "ander->getPts(NodeID)" return a set of objects corresponding to LLVM allocation sites (Alloca, Global or heap allocations).

You may also wish to refer this thread in creating and using pointer analysis for indirect calls
#37

2) Writing a pointer analysis
You can create a new cpp file under the folder of "lib/WPA" and follow the following wiki to create a pointer analysis of your own.

https://github.com/SVF-tools/SVF/wiki/Write-a-flow--and-field---insensitive-pointer-analysis

from svf.

Thank you@yuleisui

from svf.

I am wondering if AndersenWaveDiffWithType is more precise than AndersenWave and FlowSensitive. I used these to check if an operand in LLVM IR can point to a heap memory object (at least one heap object in its points-to set). With AndersenWaveDiffWithType I got much less such operands. This is unexpected to me. I don't know where I am wrong.

from svf.

Yes, AndersenWaveDiffWithType is more precise given the type information is correctly reflected on LLVM IR.

from svf.

Do you mean it may not be conservative?

from svf.

Type information in C is OK so far. However, for C++, LLVM may not reflect the correct type information for classes since all types will be flattened base on bits after lowing IR.

Take a look at this: http://lists.llvm.org/pipermail/llvm-dev/2016-May/100139.html

Have you found any issue using AndersenWaveDiffWithType?

from svf.

I used it to check if an operand may point to a heap object for bzip2 (if its points-to set contains at least one heap object). If I use FlowSensitive PTA, I get 3848 such operands. But if I use AndersenWaveDiffWithType PTA, I only get 269 such operands. Such a reduction is not very reasonable to me. So I am wondering it is really conservative?

from svf.

You may wish to use the default AndersonWaveDiff solver. The diffWaveAnderseWithType is a new solver particularly for C++. It may not be converative as explained.

from svf.

OK. Thanks for explanation!

from svf.