1#ifndef CPROVER_POINTER_ANALYSIS_ANDERSEN_H
2#define CPROVER_POINTER_ANALYSIS_ANDERSEN_H
5#include <unordered_map>
6#include <unordered_set>
114 return is_symbol2t(
object) &&
209 std::vector<std::unordered_set<node_id>>
pts;
285 std::optional<node_id>
289 std::optional<node_id>
302 unsigned location_number);
321 unsigned location_number);
347 const std::vector<expr2tc> &arguments,
348 unsigned location_number);
354 const std::vector<expr2tc> &arguments,
355 unsigned location_number);
Address of operation.
Definition irep2_expr.h:1448
node_id get_node(const expr2tc &e)
Interns e as a node, returning a stable id (creates one on first use).
Definition andersen.cpp:428
bool has_location(locationt) const override
Flow-insensitive: any location is "known" once the analysis has run.
Definition andersen.h:200
unsigned node_id
A node is an abstract memory location: one program variable or one allocation site.
Definition andersen.h:98
std::unordered_map< irep_idt, bool, irep_id_hash > reads_varargs
Whether each function bound so far reads its variadic arguments.
Definition andersen.h:264
void assign_top(const expr2tc &lhs, unsigned loc)
Records that the object lhs designates may hold any address, storing through the pointer when lhs is ...
Definition andersen.cpp:795
const std::unordered_set< node_id > & points_to(node_id n) const
The points-to set of n after solve (empty if never grown).
Definition andersen.cpp:551
std::vector< std::unordered_set< node_id > > pts
node -> its points-to set. The analysis result.
Definition andersen.h:209
std::vector< expr2tc > node_to_expr
Definition andersen.h:224
node_id allocation(const type2tc &type, unsigned loc)
A node pointing to the heap object allocated at loc.
Definition andersen.cpp:577
bool solved
Set once solve has produced a valid fixpoint.
Definition andersen.h:230
std::unordered_map< irep_idt, node_id, irep_id_hash > symbol_to_node
Node tracking.
Definition andersen.h:222
std::optional< node_id > eval_sideeffect(const sideeffect2t &rhs, unsigned location_number)
Definition andersen.cpp:600
void add_constraint(constraint_kindt kind, node_id lhs, node_id rhs)
Registers one constraint. Cheap; the real work happens in solve.
Definition andersen.cpp:446
unsigned tmp_count
Counter behind fresh_node.
Definition andersen.h:227
static bool is_nondet_object(const expr2tc &object)
True iff object is that sentinel.
Definition andersen.h:112
std::vector< std::unordered_set< node_id > > copy_edges
Copy edges from -> to built during solve (dynamic edges from load/store are appended here as they are...
Definition andersen.h:218
bool resolve_indirect_calls(const goto_functionst &goto_functions)
Lowers every indirect call whose target set is now known.
Definition andersen.cpp:945
node_id eval_constant_aggregate(const expr2tc &rhs, unsigned location_number)
Definition andersen.cpp:688
void get_values(locationt l, const expr2tc &expr, valuest &dest) override
value_setst interface: values expr may hold, as a list of object_descriptor2t wrapping each pointee's...
Definition andersen.cpp:1097
bool may_point_to(node_id a, node_id b) const
True iff a may point to b (i.e. b ∈ pts[a]).
Definition andersen.cpp:559
static constexpr const char * nondet_object_name
The object an unconstrained pointer points at: symbolic execution resolves a dereference of one to an...
Definition andersen.h:109
void operator()(const goto_functionst &goto_functions)
Runs the whole analysis: collect_constraints, then solve and resolve_indirect_calls alternately until...
Definition andersen.cpp:1063
void to_object_descriptors(node_id n, valuest &dest) const
Translates a solved points-to set into the object_descriptor2t list shape that value_setst consumers ...
Definition andersen.cpp:1077
node_id eval_realloc(node_id fresh, const expr2tc &old, unsigned location_number)
Definition andersen.cpp:637
void get_reference_set(locationt l, const expr2tc &expr, valuest &dest) override
The set of objects a dereference-style l-value can refer to.
Definition andersen.cpp:1134
node_id eval_integer(const expr2tc &rhs, unsigned location_number)
Definition andersen.cpp:667
void points_to_top(node_id n)
Marks n as possibly pointing anywhere by adding TOP to its set.
Definition andersen.cpp:410
constraint_kindt
The four inclusion-constraint shapes of The four constraint kinds.
Definition andersen.h:120
@ STORE
pts[*lhs] ⊇ pts[rhs] (*lhs = rhs)
Definition andersen.h:124
@ ADDRESS_OF
pts[lhs] ⊇ {rhs} (lhs = &rhs)
Definition andersen.h:121
@ LOAD
pts[lhs] ⊇ pts[*rhs] (lhs = *rhs)
Definition andersen.h:123
@ COPY
pts[lhs] ⊇ pts[rhs] (lhs = rhs)
Definition andersen.h:122
void ensure_node(node_id n)
Grows all node-indexed vectors so n is a valid index.
Definition andersen.cpp:379
bool everything_escapes
Set when the program contains a statement whose effect on memory is not visible in the IR at all (inl...
Definition andersen.h:236
node_id eval_address_of(const address_of2t &rhs, unsigned location_number)
The parts of eval_rhs, each for one kind of expression.
Definition andersen.cpp:588
std::optional< node_id > eval_pointer_arithmetic(const expr2tc &rhs, unsigned location_number)
Definition andersen.cpp:652
node_id eval_rhs(const expr2tc &rhs, unsigned location_number)
A node whose points-to set is the value of rhs, introducing a fresh_node when the expression is not a...
Definition andersen.cpp:739
void solve()
Computes the least fixpoint of all registered constraints, populating pts.
Definition andersen.cpp:454
node_id fresh_node()
A node with no program expression, used to hold the intermediate value of a compound right-hand side.
Definition andersen.cpp:388
node_id eval_value(const expr2tc &rhs, unsigned location_number)
A constant, an l-value read as a value, or an integer or aggregate that may carry addresses; TOP for ...
Definition andersen.cpp:706
void assign_node(const expr2tc &lhs, node_id src, unsigned loc)
Adds what src points to into every object lhs may designate: both arms of a conditional,...
Definition andersen.cpp:775
node_id unconstrained()
A node pointing to the nondet sentinel: an unconstrained value.
Definition andersen.cpp:767
std::vector< constraintt > constraints
All registered constraints (see add_constraint).
Definition andersen.h:212
andersent()
Definition andersen.cpp:370
static constexpr node_id TOP
Reserved "may point anywhere".
Definition andersen.h:101
void handle_assign(const expr2tc &lhs, const expr2tc &rhs, unsigned location_number)
Lowers lhs := rhs to whichever of the four constraints fits.
Definition andersen.cpp:800
void collect_constraints(const goto_functionst &goto_functions)
Walks every function body and lowers pointer-relevant assignments, returns and calls to constraints v...
Definition andersen.cpp:1022
std::unordered_set< irep_idt, irep_id_hash > allocators
Functions each call of which allocates an object of its own, so a call to one is an allocation site r...
Definition andersen.h:261
node_id return_node(const irep_idt &fn)
The node standing for fn's return value, shared by every call site (context insensitivity).
Definition andersen.cpp:572
void bind_call(const irep_idt &callee_name, const goto_functiont &callee, const expr2tc &ret, const std::vector< expr2tc > &arguments, unsigned location_number)
Binds arguments to callee's formals and its return value to ret.
Definition andersen.cpp:845
bool join(node_id dst, node_id src)
Unions pts[src] into pts[dst]; true iff pts[dst] grew.
Definition andersen.cpp:394
bool add_copy_edge(node_id from, node_id to)
Adds the copy edge from -> to and propagates along it immediately.
Definition andersen.cpp:404
void handle_function_call(const code_function_call2t &call, const goto_functionst &goto_functions, unsigned location_number)
Binds arguments to formals and the return value to the LHS.
Definition andersen.cpp:907
void handle_other(const expr2tc &code, unsigned location_number)
Lowers an OTHER instruction: the ones that only read are dropped, the rest may write through any poin...
Definition andersen.cpp:996
std::unordered_map< expr2tc, node_id, irep2_hash > expr_to_node
Definition andersen.h:223
node_id eval_branch(const if2t &rhs, unsigned location_number)
Definition andersen.cpp:698
const node_id * find_node(const expr2tc &e) const
The node interned for e, or nullptr if it was never seen.
Definition andersen.cpp:416
std::vector< indirect_callt > indirect_calls
Definition andersen.h:336
void widen_call(const expr2tc &ret, const std::vector< expr2tc > &arguments, unsigned location_number)
The conservative treatment of a callee this analysis cannot name: it may return anything and write an...
Definition andersen.cpp:832
node_id top_source()
A node whose points-to set is {TOP}.
Definition andersen.cpp:565
Definition irep2_expr.h:2175
Definition goto_functions.h:56
Definition goto_functions.h:23
If-then-else expression.
Definition irep2_expr.h:842
Irep for various side effects.
Definition irep2_expr.h:1906
goto_programt::const_targett locationt
Definition value_sets.h:16
std::list< expr2tc > valuest
Definition value_sets.h:15
Classes and definitions for non-stringy internal representation.
irep_container< type2t > type2tc
Definition irep2.h:430
irep_container< expr2t > expr2tc
Definition irep2.h:431
Definition andersen.h:128
constraint_kindt kind
Definition andersen.h:129
node_id lhs
Definition andersen.h:130
node_id rhs
Definition andersen.h:131
A call through a function pointer.
Definition andersen.h:327
std::vector< expr2tc > arguments
Definition andersen.h:330
node_id function
node of the callee pointer
Definition andersen.h:328
std::set< irep_idt > bound
callees already lowered
Definition andersen.h:332
expr2tc ret
Definition andersen.h:329
unsigned location_number
Definition andersen.h:331
bool widened
conservative fallback already emitted
Definition andersen.h:333