How to know the heap object is a struct or array or element of struct or array about svf HOT 8 OPEN

The type of an object is statically determined at its allocation site. The following might be something you want for an object:

from svf.

thank you !

from svf.

Hello,
May I ask a further question? By "statically determined", do you mean by LLVM or SVF?
%2 = call noalias i8* @malloc(i64 4)
This code does not tell us any type information of %2. How can SVF determine the type of %2? Do you get the type from bitcast and getelementptr?

from svf.

The initial type is i8* and the actual type of the malloc object has been determined by later casting operations. The current SVF implementation will find the immediate dominated cast (if there is one) to determine the type. Note that SVF's Andersen's analysis is type-independent, which is purely constraint-based without caring about the malloc type. Interested users can also develop more precise type bags or filters to determine the type.

from svf.

Thanks.
If the analysis is type-independent, do you mean the analysis is also field-insensitive?

from svf.

Type-independent is not a proper term. I would say independent for the heap allocations as they are allocated without types. SVF is field-sensitive as it derives field objects given the pointer types at the use sites such as getelementptr instructions. However, as I mentioned, if we treat multiple casts precisely, it is similar to heap clonings, one allocation can be assigned multiple types, so with type bags or cloning multiple objects, it will yield more precise results than treating one allocation as one object.

from svf.

This is a very good question:) In LLVM IR, field accesses are through getelementptr, the base pointer has to be cast before accessing the field object. Hence, the initial malloc type (i8*) does not matter for the later Andersen's analysis. The o's type is always determined at a particular getelementptr instruction for field-sensitivity like the example below:

%2 = call noalias i8* @malloc(i64 4) // o

%3 = bit cast i8* to struct_A* %2

%4 = getelementptr %3, 2	// o's type becomes struct_A at the getelementptr use site

For type-based heap cloning on top of Andersen's analysis, one allocation is cloned to multiple objects under different castings to distinguish them for field accesses, reducing spurious aliases with improved precision. Please refer to our ECOOP paper: https://yuleisui.github.io/publications/ecoop20.pdf

from svf.

Thanks a lot.

from svf.