PIPS
|
#include <stdlib.h>
#include <stdio.h>
#include "genC.h"
#include "linear.h"
#include "ri.h"
#include "effects.h"
#include "ri-util.h"
#include "effects-util.h"
#include "misc.h"
#include "text-util.h"
#include "prettyprint.h"
#include "properties.h"
#include "points_to_private.h"
#include "points-to.h"
Go to the source code of this file.
Macros | |
#define | INITIAL_SET_SIZE 10 |
private implementation of points_to set. More... | |
Functions | |
int | compare_entities_without_scope (const entity *pe1, const entity *pe2) |
cproto-generated files More... | |
entity | location_entity (cell c) |
bool | locations_equal_p (cell acc1, cell acc2) |
eturn true if two acces_path are equals More... | |
int | points_to_equal_p (const void *vpt1, const void *vpt2) |
returns true if two points-to arcs "vpt1" and "vpt2" are equal. More... | |
_uint | points_to_rank (const void *vpt, size_t size) |
create a key which is a concatenation of the source's name, the sink's name and the approximation of their relation(may or exact) More... | |
string | points_to_name (const points_to pt) |
create a string which is a concatenation of the source's name, the sink's name and the approximation of their relation(may or exact). More... | |
string | points_to_cell_name (cell source) |
Create a string which is the cell reference in C syntax. More... | |
set | points_to_set_block_projection (set pts, list l, bool main_p, bool body_p) |
Remove from "pts" arcs based on at least one local entity in list "l" and preserve those based on static and global entities. More... | |
set | points_to_source_projection (set pts, entity e) |
Remove all arcs starting from e because e has been assigned a new value. More... | |
points_to_graph | points_to_cell_source_projection (points_to_graph ptg, cell c) |
Remove all arcs in "ptg" starting from "c". More... | |
set | remove_points_to_cell (cell c, set g) |
All arcs in relation "g" must be removed or updated if they use the node "c". More... | |
set | remove_points_to_cells (list cl, set g) |
All nodes, i.e. More... | |
list | potential_to_effective_memory_leaks (list pmll, set res) |
A new list, "emll", is allocated. More... | |
set | points_to_function_projection (set pts) |
"pts" is the points-to relation existing at the return point of a function. More... | |
bool | cell_out_of_scope_p (cell c) |
Return true if a cell is out of scope. More... | |
void | print_or_dump_points_to (const points_to pt, bool print_p) |
print a points-to arc for debug More... | |
void | print_points_to (const points_to pt) |
void | dump_points_to (const points_to pt) |
void | print_or_dump_points_to_set (string what, set s, bool print_p) |
Print a set of points-to for debug. More... | |
void | print_points_to_set (string what, set s) |
void | dump_points_to_set (string what, set s) |
bool | source_in_set_p (cell source, set s) |
test if a cell appear as a source in a set of points-to More... | |
bool | source_subset_in_set_p (cell source, set s) |
test if a cell "source" appears as a source in a set of points-to More... | |
bool | source_in_graph_p (cell source, points_to_graph s) |
bool | sink_in_set_p (cell sink, set s) |
test if a cell appear as a sink in a set of points-to More... | |
points_to | find_arc_in_points_to_set (cell source, cell sink, pt_map ptm) |
The approximation is not taken into account. More... | |
list | anywhere_source_to_sinks (cell source, pt_map pts) |
source is assumed to be either nowhere/undefined or anywhere, it may be typed or not. More... | |
void | print_points_to_path (list p) |
For debugging. More... | |
bool | type_compatible_with_points_to_cell_p (type t, cell c) |
A type "t" is compatible with a cell "c" if any of the enclosing cell "c'" of "c", including "c", is of type "t". More... | |
cell | type_compatible_super_cell (type t, cell c) |
See if a super-cell of "c" exists witf type "t". More... | |
cell | find_kth_points_to_node_in_points_to_path (list p, type t, int k) |
Find the "k"-th node of type "t" in list "p". More... | |
bool | node_in_points_to_path_p (cell n, list p) |
points_to | points_to_path_to_k_limited_points_to_path (list p, int k, type t, bool array_p, pt_map in) |
"p" is a points-to path ending with a cell that points towards a new cell ot type "t". More... | |
points_to | create_k_limited_stub_points_to (cell source, type t, bool array_p, pt_map in) |
Create a new node "sink" of type "t" and a new arc "pt" starting from node "source", if no path starting from any node and ending in "source", built with arcs in the points-to set "in", contains more than k nodes of type "t" (the type of the sink). More... | |
list | sink_to_sources (cell sink, set pts, bool fresh_p) |
Build a list of possible cell sources for cell "sink" in points-to graph "pts". More... | |
list | stub_source_to_sinks (cell source, pt_map pts, bool fresh_p) |
list | scalar_stub_source_to_sinks (cell source, pt_map pts, bool fresh_p) |
list | array_stub_source_to_sinks (cell source, pt_map pts, bool fresh_p) |
list | generic_stub_source_to_sinks (cell source, pt_map pts, bool array_p, bool fresh_p) |
static void | refine_points_to_cell_subscripts (cell sc, cell ec, cell fc) |
If the subscripts of the effective cell source "ec" are more precise than the subscripts of the cell "fc" found in the points-to set, update the subscript of the sink cell "sc" accordingly. More... | |
list | points_to_cell_null_initialization (cell c, pt_map pts) |
If required according to the property, create a new arc from cell "c" to "null". More... | |
list | nowhere_source_to_sinks (cell source, pt_map pts) |
list | null_source_to_sinks (cell source, pt_map pts) |
list | formal_source_to_sinks (cell source, pt_map pts, bool fresh_p) |
Creation of a stub for a formal parameter or for a reference based on a formal parameter. More... | |
list | global_source_to_sinks (cell source, pt_map pts, bool fresh_p) |
list | reference_to_points_to_translations (entity v, list sl, pt_map ptm) |
This function is designed to work properly for the translation of effects at call sites. More... | |
list | points_to_reference_to_translation (reference n_r, list sl, pt_map ptm, bool fresh_p) |
FI: easier it fresh_p is true... More... | |
list | points_to_source_to_translations (cell source, pt_map ptm, bool fresh_p) |
Use "ptm" as a translation map. More... | |
list | generic_points_to_source_to_sinks (cell source, pt_map ptm, bool fresh_p, bool strict_p, bool all_p, bool effective_p) |
Build the sinks of source "source" according to the points-to graphs. More... | |
list | points_to_source_to_sinks (cell source, pt_map ptm, bool fresh_p) |
Build the sinks of source "source" according to the points-to graphs. More... | |
list | points_to_source_to_effective_sinks (cell source, pt_map ptm, bool fresh_p) |
list | points_to_source_to_some_sinks (cell source, pt_map ptm, bool fresh_p) |
May not retrieve all sinks of the source. More... | |
list | points_to_source_to_any_sinks (cell source, pt_map ptm, bool fresh_p) |
Retrieve all possible sinks of the source. More... | |
list | points_to_sink_to_sources (cell sink, pt_map ptm, bool fresh_p) |
Build the sources of sink "sink" according to the points-to graphs. More... | |
points_to | points_to_sink_to_points_to (cell sink, pt_map ptm) |
Return the points-to "fpt" ending in cell "sink" if it exists. More... | |
list | points_to_source_name_to_sinks (string sn, pt_map ptm, bool fresh_p) |
Use "sn" as a source name to derive a list of sink cells according to the points-to graph ptm. More... | |
cell | points_to_source_name_to_source_cell (string sn, pt_map ptm, bool fresh_p) |
list | generic_points_to_sources_to_sinks (list sources, pt_map ptm, bool fresh_p, bool effective_p) |
Build the union of the sinks of cells in "sources" according to the points-to graphs "ptm". More... | |
list | points_to_sources_to_sinks (list sources, pt_map ptm, bool fresh_p) |
list | points_to_sources_to_effective_sinks (list sources, pt_map ptm, bool fresh_p) |
list | points_to_source_to_arcs (cell source, pt_map ptm, bool fresh_p) |
Build the list of arcs whose source is "source" according to the points-to graphs "ptm". More... | |
int | points_to_cell_to_number_of_unbounded_dimensions (cell c) |
int | points_to_reference_to_number_of_unbounded_dimensions (reference r) |
int | points_to_subscripts_to_number_of_unbounded_dimensions (list sl) |
bool | sinks_fully_matches_source_p (cell source, list sinks) |
Is there at least one cell "sink" in list "sinks" whose subscripts fully match the subscripts in cell "source"? More... | |
list | source_to_sinks (cell source, pt_map pts, bool fresh_p) |
Return a list of cells, "sinks", that are sink for some arc whose source is "source" or related to "source" in set "pts". More... | |
list | extended_source_to_sinks (cell sc, pt_map in) |
list | extended_sources_to_sinks (list pointed, pt_map in) |
Same as extended_source_to_sinks, but for a set of cells, "pointed". More... | |
list | any_source_to_sinks (cell source, pt_map pts, bool fresh_p) |
Generalization of source_to_sinks(). More... | |
list | pointer_source_to_sinks (cell sc, pt_map in) |
Returns the sinks for a source cell "sc" of type pointer according to the points-to relation "in". More... | |
list | variable_to_sinks (entity e, pt_map ptm, bool fresh_p) |
Return all cells in points-to set "pts" who source is based on entity "e". More... | |
list | null_to_sinks (cell source, pt_map ptm) |
Create a list of null sinks and add a new null points-to relation to pts. More... | |
list | sources_to_sinks (list sources, pt_map ptm, bool fresh_p) |
Same as source_to_sinks, but for a list of cells. More... | |
list | reference_to_sinks (reference r, pt_map in, bool fresh_p) |
set | merge_points_to_set (set s1, set s2) |
Merge two points-to sets. More... | |
set | exact_to_may_points_to_set (set s) |
Change the all the exact points-to relations to may relations. More... | |
bool | cell_in_list_p (cell c, const list lx) |
bool | cell_in_points_to_set_p (cell c, set pts) |
Check if a cell c appears as source or sink in points-to set pts. More... | |
bool | points_to_in_list_p (points_to pt, const list lx) |
bool | points_to_compare_cell (cell c1, cell c2) |
bool | points_to_compare_ptr_cell (const void *vcel1, const void *vcel2) |
int | points_to_compare_location (void *vpt1, void *vpt2) |
Order the two points-to relations according to the alphabetical order of the underlying variables. More... | |
bool | consistent_points_to_arc_p (points_to a, bool constant_subscript_p) |
bool | store_independent_points_to_arc_p (points_to a) |
bool | dereferencing_free_points_to_arc_p (points_to a) |
bool | consistent_points_to_set (set s) |
make sure that set "s" does not contain redundant or contradictory elements More... | |
bool | points_to_set_sharing_p (set s) |
void | upgrade_approximations_in_points_to_set (pt_map ptm) |
When arcs have been removed from a points-to relation, the approximations of remaining arcs may not correspond to the new points-to relation. More... | |
void | remove_points_to_arcs (cell source, cell sink, pt_map pt) |
void | points_to_cell_list_and (list *a, const list b) |
Compute A = A inter B: complexity in O(n2) More... | |
void | free_points_to_graph_sets (points_to_graph s,...) |
Free several sets in one call. More... | |
pt_map | graph_assign_list (pt_map ptm, list l) |
FI: I add functions dealing with points_to_graph variable, i.e. More... | |
pt_map | merge_points_to_graphs (pt_map s1, pt_map s2) |
pt_map | points_to_graph_assign (pt_map out, pt_map in) |
points_to | fuse_points_to_sink_cells (cell source, list sink_l, pt_map in) |
All vertices in "sink_l" are assumed to be sinks of vertex "source" in points-to graph "in". More... | |
int | maximal_out_degree_of_points_to_graph (string *mod_cell, pt_map in) |
returns the cell vertex "mod_cell" with the maximal out_degree in graph "in", and its out-degree. More... | |
pt_map | normalize_points_to_graph (pt_map ptg) |
For the time being, control the out-degree of the vertices in points-to graph "ptg" and fuse the vertex with the maximal out-degree to reduce it if it is greater than an expected limit. More... | |
string | points_to_cell_to_string (cell c) |
bool | unreachable_points_to_cell_p (cell c, pt_map ptg) |
Can cell c be accessed via another cell? More... | |
pt_map | generic_remove_unreachable_vertices_in_points_to_graph (pt_map ptg, int code, bool verbose_p) |
Remove arcs in points-to graph "ptg" when they start from a stub cell that is not reachable. More... | |
pt_map | remove_unreachable_stub_vertices_in_points_to_graph (pt_map in) |
pt_map | remove_unreachable_heap_vertices_in_points_to_graph (pt_map in, bool verbose_p) |
pt_map | remove_unreachable_vertices_in_points_to_graph (pt_map in) |
This function looks pretty dangerous as variables can be reached by their names. More... | |
bool | consistent_points_to_graph_p (points_to_graph ptg) |
void | remove_impossible_arcs_to_null (list *pL, pt_map in) |
You know that null and undefined cells in "*pL" are impossible because of the operation that is going to be performed on it. More... | |
bool | arc_in_points_to_set_p (points_to spt, set pts) |
Check if points-to arc "spt" belongs to points-to set "pts". More... | |
pt_map | get_points_to_graph_from_statement (statement st) |
void | add_arc_to_pt_map (points_to a, pt_map s) |
Add a store independent points-to arc: source and destination references include no dereferencing nor varying subscript such as a[i]. More... | |
pt_map | add_arc_to_pt_map_ (points_to a, pt_map s) |
set | add_arc_to_simple_pt_map (points_to a, set s) |
set | remove_arc_from_simple_pt_map (points_to a, set s) |
set | add_subscript_dependent_arc_to_simple_pt_map (points_to a, set s) |
The source and destination references imply no dereferencing but the subscripts may be any kind of expression, such as a[i]. More... | |
#define INITIAL_SET_SIZE 10 |
private implementation of points_to set.
points_to_equal_p to determine if two points_to relations are equal (same source, same sink, same relation)
points_to_rank how to compute rank for a points_to element
Definition at line 58 of file points_to_set.c.
Add a store independent points-to arc: source and destination references include no dereferencing nor varying subscript such as a[i].
Definition at line 3555 of file points_to_set.c.
References points_to_graph_set, set_add_element(), and store_independent_points_to_arc_p().
Referenced by fuse_points_to_sink_cells(), normalize_points_to_graph(), source_to_sinks(), and upgrade_approximations_in_points_to_set().
Definition at line 3565 of file points_to_set.c.
References points_to_graph_set, set_add_element(), and store_independent_points_to_arc_p().
Referenced by anywhere_source_to_sinks(), assignment_to_points_to(), formal_source_to_sinks(), generic_stub_source_to_sinks(), global_source_to_sinks(), and null_to_sinks().
Definition at line 3576 of file points_to_set.c.
References set_add_element(), and store_independent_points_to_arc_p().
Referenced by points_to_set_block_projection(), and remove_points_to_cell().
The source and destination references imply no dereferencing but the subscripts may be any kind of expression, such as a[i].
This is not possible in general, but may be useful at a specific statement level. This used to handle precisely the backward translation at call sites, especially for simple and convex effects backward translation.
Definition at line 3599 of file points_to_set.c.
References dereferencing_free_points_to_arc_p(), and set_add_element().
Referenced by compute_points_to_binded_set(), filter_formal_context_according_to_actual_context(), new_filter_formal_context_according_to_actual_context(), and points_to_translation_of_formal_parameters().
Generalization of source_to_sinks().
The source does not have to be a pointer.
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 2404 of file points_to_set.c.
References any_source_to_sinks(), array_of_pointers_type_p(), array_of_struct_type_p(), compute_basic_concrete_type(), copy_cell(), derived_type_to_fields(), ENTITY, entity_basic_concrete_type(), f(), FOREACH, free_cell(), NIL, pointer_type_p(), points_to_cell_add_field_dimension(), points_to_cell_add_unbounded_subscripts(), points_to_cell_to_type(), source_to_sinks(), and struct_type_p().
Referenced by any_source_to_sinks(), and recursive_filter_formal_context_according_to_actual_context().
source is assumed to be either nowhere/undefined or anywhere, it may be typed or not.
Shouldn't we create NULL pointers if the corresponding property is set? Does it matter for anywhere/nowhere?
pts must be updated with the new arc(s).
FI: we should return an anywhere cell with the proper type
FI: should we add the corresponding arcs in pts?
FI: should we take care of typed anywhere as well?
source | ource |
pts | ts |
Definition at line 718 of file points_to_set.c.
References add_arc_to_pt_map_(), anywhere_source_to_sinks(), array_type_p(), basic_derived, basic_pointer_p, CELL, cell_any_reference(), compute_basic_concrete_type(), CONS, copy_cell(), copy_type(), ENTITY, entity_anywhere_locations(), entity_type, f(), FOREACH, free_type(), make_anywhere_points_to_cell(), make_approximation_may(), make_cell_reference(), make_descriptor_none(), make_points_to(), make_reference(), NIL, overloaded_type_p(), pips_assert, pips_internal_error, pointer_type_p(), points_to_cell_add_field_dimension(), points_to_cell_to_type(), reference_add_zero_subscripts(), struct_type_p(), type_area_p, type_struct, type_struct_p, type_to_pointed_type(), type_variable, type_variable_p, ultimate_type(), and variable_basic.
Referenced by anywhere_source_to_sinks(), nowhere_source_to_sinks(), null_source_to_sinks(), and source_to_sinks().
Check if points-to arc "spt" belongs to points-to set "pts".
spt | pt |
pts | ts |
Definition at line 3518 of file points_to_set.c.
References points_to_equal_p(), and SET_FOREACH.
Referenced by filter_formal_context_according_to_actual_context(), and new_filter_formal_context_according_to_actual_context().
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 1171 of file points_to_set.c.
References generic_stub_source_to_sinks().
Referenced by stub_source_to_sinks().
found!
else no found
lx | x |
Definition at line 2613 of file points_to_set.c.
References CAR, CELL, ENDP, points_to_compare_cell(), and POP.
Referenced by null_equal_condition_to_points_to(), null_non_equal_condition_to_points_to(), and order_condition_to_points_to().
Check if a cell c appears as source or sink in points-to set pts.
If set pts is undefined, it is assumed that cell c is in it.
pts | ts |
Definition at line 2626 of file points_to_set.c.
References points_to_compare_cell(), points_to_sink, points_to_source, SET_FOREACH, and set_undefined_p.
Referenced by generic_points_to_cell_to_useful_pointer_cells().
Return true if a cell is out of scope.
FI: I add formal parameters as in scope variables...
FI: I remove formal parameters because this function is used to compute the OUT set. The modified or not values of formal parameter are not relevant. If they have not been modified, the useful information is already available in the IN set (oops, see next comment below). If they have been modified, they are no longer reachable and must be projected.
FI: Unfortunately, some information gathered about the input parametrs during the function analysis is lost. For instance, a pointer must be different from NULL (e.g. see argv03.c). But if you do not know if the pointer has been written or not, you do not know if the information is usable or not. This is also an issue for interprocedural analysis: can the result always be trusted for any actual input context?
| formal_parameter_p(e)
Definition at line 560 of file points_to_set.c.
References cell_to_reference(), entity_heap_location_p(), entity_stub_sink_p(), reference_variable, top_level_entity_p(), and variable_static_p().
Referenced by points_to_function_projection().
cproto-generated files
FI: Which sorting do you want?
pe1 | e1 |
pe2 | e2 |
Definition at line 60 of file points_to_set.c.
References entity_name, and s1.
I: two issue:
constant_subscript_p | onstant_subscript_p |
Definition at line 2822 of file points_to_set.c.
References cell_any_reference(), gen_length(), int, memory_dereferencing_p(), pips_internal_error, points_to_consistent_p(), points_to_reference_to_concrete_type(), points_to_sink, points_to_source, reference_indices, store_independent_points_to_reference_p(), and type_depth().
Referenced by dereferencing_free_points_to_arc_p(), and store_independent_points_to_arc_p().
bool consistent_points_to_graph_p | ( | points_to_graph | ptg | ) |
ptg | tg |
Definition at line 3475 of file points_to_set.c.
References consistent_points_to_set(), pips_internal_error, points_to_graph_bottom, points_to_graph_set, and set_empty_p().
Referenced by any_loop_to_points_to(), binary_intrinsic_call_to_points_to_sinks(), internal_pointer_assignment_to_points_to(), list_assignment_to_points_to(), and whileloop_to_points_to().
make sure that set "s" does not contain redundant or contradictory elements
Check the consistency of each arc
Check the validity of the approximations
Make sure that the element of set "s" belong to "s" (issue with side effects performed on subscript expressions).
Check that no sharing exists between arcs at the cell and reference levels
Definition at line 2900 of file points_to_set.c.
References approximation_exact_p, approximation_tag, fprintf(), locations_equal_p(), points_to_approximation, points_to_set_sharing_p(), points_to_sink, points_to_source, print_points_to(), set_belong_p(), SET_FOREACH, and store_independent_points_to_arc_p().
Referenced by consistent_points_to_graph_p(), list_assignment_to_points_to(), merge_points_to_set(), and user_call_to_points_to_interprocedural().
Create a new node "sink" of type "t" and a new arc "pt" starting from node "source", if no path starting from any node and ending in "source", built with arcs in the points-to set "in", contains more than k nodes of type "t" (the type of the sink).
If k nodes of type "t" are already in the path, create a new arc "pt" between the "source" and the k-th node in the path.
Parameter "array_p" indicates if the source is an array or a scalar. Different models can be chosen. For instance, Beatrice Creusillet wants to have an array as target and obtain something like argv[*]->_argv_1[*] although argv[*]->_argv-1 might also be a correct model if _argv_1 is an abstract location representing lots of different physical locations.
Parameter k is defined by a property.
FI: not to clear about what is going to happen when "source" is the final node of several paths.
Also, beware of circular paths.
Efficiency is not yet a goal...
& od>=odl
No cycle could be created, the paths can safely be made longer.
source | ource |
array_p | rray_p |
in | n |
Definition at line 1077 of file points_to_set.c.
References CELL, CONS, create_stub_points_to(), gen_free_list(), get_bool_property(), get_int_property(), NIL, pips_assert, points_to_path_to_k_limited_points_to_path(), points_to_undefined, and points_to_undefined_p.
Referenced by formal_source_to_sinks(), generic_stub_source_to_sinks(), and global_source_to_sinks().
Definition at line 2893 of file points_to_set.c.
References consistent_points_to_arc_p().
Referenced by add_subscript_dependent_arc_to_simple_pt_map().
void dump_points_to | ( | const points_to | pt | ) |
pt | t |
Definition at line 609 of file points_to_set.c.
References print_or_dump_points_to().
Referenced by points_to_set_sharing_p(), and print_or_dump_points_to_set().
what | hat |
Definition at line 640 of file points_to_set.c.
References print_or_dump_points_to_set().
Change the all the exact points-to relations to may relations.
Definition at line 2603 of file points_to_set.c.
References approximation_exact_p, make_approximation_may(), points_to_approximation, and SET_FOREACH.
Do not create sharing between elements of "in" and elements of "sinks".
sc | c |
in | n |
Definition at line 2359 of file points_to_set.c.
References cell_any_reference(), copy_cell(), ENDP, entity_user_name(), free_cell(), gen_nconc(), get_bool_property(), NIL, nowhere_cell_p(), null_cell_p(), pips_internal_error, reference_to_string(), reference_variable, source_to_sinks(), and words_to_string().
Referenced by extended_sources_to_sinks(), and pointer_source_to_sinks().
Same as extended_source_to_sinks, but for a set of cells, "pointed".
Dereference the pointer(s) to find the sinks, memory(memory(p))
pointed | ointed |
in | n |
Definition at line 2391 of file points_to_set.c.
References CELL, extended_source_to_sinks(), FOREACH, gen_nconc(), and NIL.
The approximation is not taken into account.
It might be faster to look up the different points-to arcs that can be made with source, sink and any approximation.
source | ource |
sink | ink |
ptm | tm |
Definition at line 695 of file points_to_set.c.
References cell_equal_p(), points_to_graph_set, points_to_sink, points_to_source, points_to_undefined, and SET_FOREACH.
Referenced by offset_cells().
Find the "k"-th node of type "t" in list "p".
Beware of cycles? No reason since "p" is bounded... The problem must be addressed when "p" is built.
An issue with "t": the nodes are references and they carry multiple types, one for each number of subscripts or fields they have. So for instance, s1 and s1.next denote the same location.
Definition at line 960 of file points_to_set.c.
References CELL, cell_undefined, count, FOREACH, fprintf(), ifdebug, pips_debug, print_points_to_path(), type_compatible_super_cell(), type_compatible_with_points_to_cell_p(), and type_to_full_string_definition().
Referenced by points_to_path_to_k_limited_points_to_path().
Creation of a stub for a formal parameter or for a reference based on a formal parameter.
The formal parameter may be a pointer, an array of something or a struct of something and so on recursively.
New dimensions may have to be added to the sink type if the source entity type is an array or if the types are assumed not strict for pointer arithmetic. This is a general issue for stub generation and dealt with at a lower level.
Because references must be considered, it is not clear that formal parameters must be handled differently from stubs or global variables. The initial decision was made, I believe, because they were assumed references in a very simple way, for instance as simple direct references.
Test cases: argv03.c
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 1380 of file points_to_set.c.
References add_arc_to_points_to_context(), add_arc_to_pt_map_(), array_type_p(), C_pointer_type_p(), cell_any_reference(), compute_basic_concrete_type(), copy_points_to(), create_k_limited_stub_points_to(), entity_basic_concrete_type(), free_approximation(), gen_nconc(), get_bool_property(), make_approximation_may(), NIL, null_to_sinks(), pips_assert, points_to_approximation, points_to_cell_to_concrete_type(), reference_variable, source_to_sinks(), and type_to_pointed_type().
Referenced by source_to_sinks().
void free_points_to_graph_sets | ( | points_to_graph | s, |
... | |||
) |
Free several sets in one call.
Useful when many sets are used simultaneously.
Analyze in args the variadic arguments that may be after t:
Since a variadic function in C must have at least 1 non variadic argument (here the s), just skew the varargs analysis:
Get the next argument
Release the variadic analysis
Definition at line 3150 of file points_to_set.c.
References free_points_to_graph().
All vertices in "sink_l" are assumed to be sinks of vertex "source" in points-to graph "in".
These vertices must be replaced by a unique vertex, their minimum upper bound in the abstract address lattice. And their own out-going arcs must also be rearranged.
Clearly, some abstract addresses high in the lattice should be allowed large out-degree numbers.
A newly allocated points-to arc is returned. It could be integrated directly in "in", but the integration is performed by a caller.
Find the minimal upper bound of "sink_l"
Compute the sinks of the vertex "mupc" as the union of the sinks of cells in "sink_l" and add the corresponding arcs to "out".
Find the incoming arcs on cells of "sink_l" and replace them by arcs towards copies of mupc.
Finds it sources
Find the set of points-to arcs to destroy and remove them from the points-to graph "in".
Create an arc from "source" to "mupc"
source | ource |
sink_l | ink_l |
in | n |
Definition at line 3214 of file points_to_set.c.
References add_arc_to_pt_map(), CELL, CONS, consistent_pt_map_p, copy_cell(), FOREACH, gen_free_list(), make_approximation_may(), make_descriptor_none(), make_points_to(), NIL, nowhere_cell_p(), null_cell_p(), out, pips_assert, POINTS_TO, points_to_cell_equal_p(), points_to_cells_minimal_upper_bound(), points_to_graph_set, points_to_sink, points_to_source, points_to_source_to_arcs(), points_to_sources_to_sinks(), remove_arc_from_pt_map, and SET_FOREACH.
Referenced by normalize_points_to_graph().
list generic_points_to_source_to_sinks | ( | cell | source, |
pt_map | ptm, | ||
bool | fresh_p, | ||
bool | strict_p, | ||
bool | all_p, | ||
bool | effective_p | ||
) |
Build the sinks of source "source" according to the points-to graphs.
If "source" is not found in the graph, return an empty list "sinks". If "fresh_p", allocate copies. If not, return pointers to the destination vertices in "ptm".
It is not clear how much the abstract address lattice must be used to retrieve sinks... If source = a[34], clearly a[*] is an OK equivalent source if a[34] is not a vertex of "ptm".
If !strict_p, "a[34]" is considered a source for "a[*]". This should always be the case. So strict_p should always be false.
If all_p, look for all possible sinks. For instance, if a[34] and a[*] have different sinks, return their union. If !all_p, stop the search if a[34] has sinks. This should now be obsolete thanks to exact_p. So all_p should always be true.
effective_p: you only want sinks that are not NULL and not UNDEFINED/NOWHERE. For instance, because you know you will dereference it.
Note: we must also take into account the approximations of the arcs...
This is a key point of Amira's dissertation, but it has not been handled properly yet...
source | ource |
ptm | tm |
fresh_p | resh_p |
strict_p | trict_p |
all_p | ll_p |
effective_p | ffective_p |
Definition at line 1823 of file points_to_set.c.
References approximation_exact_p, approximation_must_p, CELL, cell_equal_p(), cell_included_p(), CONS, copy_cell(), ENDP, NIL, nowhere_cell_p(), null_cell_p(), pips_internal_error, points_to_approximation, points_to_cell_in_list_p(), points_to_graph_set, points_to_sink, points_to_source, refine_points_to_cell_subscripts(), and SET_FOREACH.
Referenced by generic_points_to_sources_to_sinks(), points_to_source_to_any_sinks(), points_to_source_to_effective_sinks(), points_to_source_to_sinks(), and points_to_source_to_some_sinks().
list generic_points_to_sources_to_sinks | ( | list | sources, |
pt_map | ptm, | ||
bool | fresh_p, | ||
bool | effective_p | ||
) |
Build the union of the sinks of cells in "sources" according to the points-to graphs "ptm".
Allocate new cells if "fresh_p". No specific order in the returned list.
If effective_p, eliminate NULL and NOWHERE/UNDEFINED as targets
sources | ources |
ptm | tm |
fresh_p | resh_p |
effective_p | ffective_p |
Definition at line 2050 of file points_to_set.c.
References CELL, FOREACH, gen_nconc(), generic_points_to_source_to_sinks(), and NIL.
Referenced by points_to_sources_to_effective_sinks(), and points_to_sources_to_sinks().
pt_map generic_remove_unreachable_vertices_in_points_to_graph | ( | pt_map | ptg, |
int | code, | ||
bool | verbose_p | ||
) |
Remove arcs in points-to graph "ptg" when they start from a stub cell that is not reachable.
Points-to graph "ptg" is modified by side-effects and returned.
This clean-up should be performed each time a projection is performed, and even potentially, each time an arc is removed.
Note: see also freed_pointer_to_points_to() for a recursive implementation of the arc elimination. The current clean-up is not recursive. This function should be called repeatedly till the results converge to a fix point...
Find arcs whose origin vertex is an unreachable stub.
Remove arcs in ual.
ptg | tg |
verbose_p | erbose_p |
Definition at line 3414 of file points_to_set.c.
References cell_any_reference(), CONS, consistent_pt_map_p, ENDP, entity_heap_location_p(), entity_stub_sink_p(), FOREACH, gen_free_list(), NIL, pips_assert, pips_user_warning, POINTS_TO, points_to_cell_to_string(), points_to_graph_set, points_to_sink_to_sources(), points_to_source, reference_variable, remove_arc_from_pt_map, and SET_FOREACH.
Referenced by remove_unreachable_heap_vertices_in_points_to_graph(), remove_unreachable_stub_vertices_in_points_to_graph(), and remove_unreachable_vertices_in_points_to_graph().
The source type cannot contain a pointer field: for instance, int or char
source | ource |
pts | ts |
array_p | rray_p |
fresh_p | resh_p |
Definition at line 1177 of file points_to_set.c.
References add_arc_to_points_to_context(), add_arc_to_pt_map_(), array_of_pointers_type_p(), array_type_p(), basic_derived, cell_any_reference(), cell_to_type(), copy_basic(), copy_cell(), copy_points_to(), create_k_limited_stub_points_to(), ENTITY, entity_local_name(), entity_type, f(), FOREACH, fprintf(), gen_nconc(), get_bool_property(), make_type_variable(), make_variable(), NIL, null_to_sinks(), pips_assert, pips_internal_error, pointer_type_p(), points_to_cell_add_unbounded_subscripts(), points_to_cell_add_zero_subscripts(), points_to_cell_null_initialization(), print_type(), printf(), reference_variable, source_to_sinks(), struct_type_p(), type_struct, type_struct_p, type_to_pointed_type(), type_variable, ultimate_type(), and variable_basic.
Referenced by array_stub_source_to_sinks(), and scalar_stub_source_to_sinks().
st | t |
Definition at line 3530 of file points_to_set.c.
References graph_assign_list(), ifdebug, load_pt_to_list(), new_pt_map, pips_debug, points_to_graph_undefined, points_to_list_bottom, points_to_list_list, print_points_to_graph, print_statement(), and statement_unstructured_p().
Add an implicit dimension for pointer arithmetic
Add these new arcs to the context
Do we have to ignore an initialization?
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 1438 of file points_to_set.c.
References add_arc_to_points_to_context(), add_arc_to_pt_map_(), array_type_p(), CELL, cell_any_reference(), const_variable_p(), copy_cell(), copy_points_to(), copy_type(), create_k_limited_stub_points_to(), entity_basic_concrete_type(), entity_initial, entity_type, entity_user_name(), expression_to_points_to_sinks(), FOREACH, free_approximation(), free_expression(), gen_length(), gen_nconc(), get_bool_property(), init, make_approximation_exact(), make_approximation_may(), make_descriptor_none(), make_points_to(), NIL, null_to_sinks(), pips_user_warning, points_to_approximation, points_to_undefined, reference_variable, scalar_type_p(), source_to_sinks(), type_to_array_type(), type_to_pointed_type(), type_undefined, value_unknown_p, and variable_initial_expression().
Referenced by source_to_sinks().
FI: I add functions dealing with points_to_graph variable, i.e.
pt_map
ptm | tm |
Definition at line 3170 of file points_to_set.c.
References pips_debug, pips_internal_error, points_to_graph_bottom, points_to_graph_set, and set_assign_list().
Referenced by generic_points_to_analysis(), get_points_to_graph_from_statement(), and statement_to_points_to().
Definition at line 78 of file points_to_set.c.
References cell_to_reference(), and reference_variable.
eturn true if two acces_path are equals
acc1 | cc1 |
acc2 | cc2 |
Definition at line 89 of file points_to_set.c.
References cell_equal_p().
Referenced by consistent_points_to_set(), and points_to_equal_p().
returns the cell vertex "mod_cell" with the maximal out_degree in graph "in", and its out-degree.
When several cells have the same maximal out-degree, return any of them.
mod_cell | od_cell |
in | n |
Definition at line 3293 of file points_to_set.c.
References hash_get(), HASH_MAP, hash_put(), hash_string, hash_table_free(), hash_table_make(), HASH_UNDEFINED_VALUE, hash_update(), int, points_to_cell_name(), points_to_graph_set, points_to_source, SET_FOREACH, and strdup().
Referenced by normalize_points_to_graph().
s1 | 1 |
s2 | 2 |
Definition at line 3183 of file points_to_set.c.
References merge_points_to_set(), new_pt_map, points_to_graph_bottom, points_to_graph_set, and s1.
Referenced by any_loop_to_points_to(), boolean_intrinsic_call_condition_to_points_to(), control_to_points_to(), intrinsic_call_to_points_to(), new_any_loop_to_points_to(), new_points_to_unstructured(), statement_to_points_to(), and test_to_points_to().
Merge two points-to sets.
This function is required to compute the points-to set resulting of an if control statements.
A new set is allocated but it reuses the elements of "s1" and "s2".
s1 | 1 |
s2 | 2 |
Definition at line 2544 of file points_to_set.c.
References approximation_exact_p, approximation_must_p, consistent_points_to_set(), make_approximation_may(), make_descriptor_none(), make_points_to(), pips_assert, points_to_approximation, points_to_equal_p(), points_to_rank(), points_to_sink, points_to_source, s1, set_add_element(), set_assign(), set_belong_p(), set_clear(), set_empty_p(), SET_FOREACH, set_free(), set_generic_make(), set_intersection(), set_private, and set_union().
Referenced by merge_points_to_graphs(), and ternary_intrinsic_call_to_points_to_sinks().
Definition at line 985 of file points_to_set.c.
References CELL, cell_equal_p(), and FOREACH.
Referenced by points_to_path_to_k_limited_points_to_path().
For the time being, control the out-degree of the vertices in points-to graph "ptg" and fuse the vertex with the maximal out-degree to reduce it if it is greater than an expected limit.
Points-to graph "ptg" i modified by side-effects and returned.
The out-degree limit must take the subscript limit sl into account as well as possible NULL and NOWHERE values (+2). The unbounded susbcript must also be added because it does not necessarily subsume all integer subscripts (+1). The subscript limit will kick in anyway later. Subscripts are limited to the range [-sl,sl], which contains 2*sl+1 values.
ptg | tg |
Definition at line 3329 of file points_to_set.c.
References add_arc_to_pt_map(), cell_undefined_p, fuse_points_to_sink_cells(), get_int_property(), ifdebug, maximal_out_degree_of_points_to_graph(), pips_assert, pips_debug, pips_internal_error, points_to_graph_set, points_to_source_name_to_sinks(), points_to_source_name_to_source_cell(), print_points_to_set(), and string_undefined.
Referenced by any_loop_to_points_to(), and new_any_loop_to_points_to().
source | ource |
pts | ts |
Definition at line 1329 of file points_to_set.c.
References anywhere_source_to_sinks(), cell_any_reference(), entity_local_name(), get_bool_property(), NIL, pips_user_warning, and reference_variable.
Referenced by source_to_sinks().
source | ource |
pts | ts |
Definition at line 1346 of file points_to_set.c.
References anywhere_source_to_sinks(), cell_any_reference(), entity_local_name(), get_bool_property(), NIL, pips_user_warning, and reference_variable.
Referenced by source_to_sinks().
Create a list of null sinks and add a new null points-to relation to pts.
pts is modified by side effect.
source | ource |
ptm | tm |
Definition at line 2505 of file points_to_set.c.
References add_arc_to_points_to_context(), add_arc_to_pt_map_(), CELL, CONS, copy_cell(), copy_points_to(), make_approximation_may(), make_descriptor_none(), make_null_pointer_value_cell(), make_points_to(), and NIL.
Referenced by formal_source_to_sinks(), generic_stub_source_to_sinks(), global_source_to_sinks(), and points_to_cell_null_initialization().
Returns the sinks for a source cell "sc" of type pointer according to the points-to relation "in".
This is an extension of extended_source_to_sinks() that also take into account partially subscribed arrays. Such references end up with a pointer type, but "in" is not involved in the dereferencing... since no dereferencing is necessary. An extra 0 subscript must be added.
FI: This issue is also dealt elsewhere, but I do not know where nor how often.
sc | c |
in | n |
Definition at line 2455 of file points_to_set.c.
References array_type_p(), CELL, cell_any_reference(), CONS, copy_cell(), ENDP, entity_basic_concrete_type(), EXPRESSION, extended_source_to_sinks(), gen_length(), gen_nconc(), int, make_zero_expression(), NIL, reference_indices, reference_variable, type_variable, and variable_dimensions.
Referenced by dereferencing_to_sinks().
Compute A = A inter B: complexity in O(n2)
This element of a is not in list b: delete it:
Definition at line 3133 of file points_to_set.c.
References aux, CAR, CDR, CELL, ENDP, free(), points_to_cell_in_list_p(), points_to_cell_list_and(), and return().
Referenced by points_to_cell_list_and().
Create a string which is the cell reference in C syntax.
A new string is allocated.
source | ource |
Definition at line 186 of file points_to_set.c.
References cell_to_reference(), reference_to_string(), and strdup().
Referenced by compute_points_to_gen_set(), maximal_out_degree_of_points_to_graph(), points_to_source_name_to_sinks(), and points_to_source_name_to_source_cell().
If required according to the property, create a new arc from cell "c" to "null".
Cell "c" is absorbed not by the points_to created and added to set "pts".
pts | ts |
Definition at line 1318 of file points_to_set.c.
References get_bool_property(), NIL, and null_to_sinks().
Referenced by generic_stub_source_to_sinks().
points_to_graph points_to_cell_source_projection | ( | points_to_graph | ptg, |
cell | c | ||
) |
Remove all arcs in "ptg" starting from "c".
ptg | tg |
Definition at line 330 of file points_to_set.c.
References cell_equal_p(), points_to_graph_set, points_to_source, set_del_element(), and SET_FOREACH.
Referenced by equal_condition_to_points_to(), and null_equal_condition_to_points_to().
Definition at line 2097 of file points_to_set.c.
References cell_any_reference(), and points_to_reference_to_number_of_unbounded_dimensions().
Definition at line 3367 of file points_to_set.c.
References cell_any_reference(), and effect_reference_to_string().
Referenced by generic_remove_unreachable_vertices_in_points_to_graph(), list_assignment_to_points_to(), memory_leak_to_more_memory_leaks(), new_recursive_filter_formal_context_according_to_actual_context_for_pointer_pair(), offset_cells(), and recursive_filter_formal_context_according_to_actual_context().
c1 | 1 |
c2 | 2 |
Definition at line 2657 of file points_to_set.c.
References CAR, cell_to_reference(), ENDP, entity_minimal_user_name(), EXPRESSION, expression_constant_p(), expression_to_int(), expression_to_string(), gen_length(), NIL, POP, reference_indices, reference_variable, and s1.
Referenced by cell_in_list_p(), cell_in_points_to_set_p(), compute_points_to_kill_set(), gen_must_set(), points_to_anywhere(), points_to_anywhere_typed(), and points_to_cell_translation().
int points_to_compare_location | ( | void * | vpt1, |
void * | vpt2 | ||
) |
Order the two points-to relations according to the alphabetical order of the underlying variables.
Return -1, 0, or 1.
vpt1 | pt1 |
vpt2 | pt2 |
Definition at line 2744 of file points_to_set.c.
References CAR, cell_to_reference(), ENDP, entity_minimal_user_name(), EXPRESSION, expression_constant_p(), expression_to_int(), expression_to_string(), gen_length(), NIL, points_to_sink, points_to_source, POP, reference_indices, reference_variable, and s1.
bool points_to_compare_ptr_cell | ( | const void * | vcel1, |
const void * | vcel2 | ||
) |
vcel1 | cel1 |
vcel2 | cel2 |
Definition at line 2698 of file points_to_set.c.
References CAR, cell_to_reference(), ENDP, entity_abstract_location_p(), entity_local_name(), entity_minimal_user_name(), EXPRESSION, expression_constant_p(), expression_to_int(), expression_to_string(), gen_length(), NIL, POP, reference_indices, reference_variable, and s1.
Referenced by generic_points_to_set_to_stub_cell_list().
int points_to_equal_p | ( | const void * | vpt1, |
const void * | vpt2 | ||
) |
returns true if two points-to arcs "vpt1" and "vpt2" are equal.
Used to build sets of points-to using the set library of Newgen
vpt1 | pt1 |
vpt2 | pt2 |
Definition at line 98 of file points_to_set.c.
References approximation_tag, bool_to_string(), ifdebug, locations_equal_p(), points_to_approximation, points_to_sink, points_to_source, print_points_to(), and printf().
Referenced by arc_in_points_to_set_p(), array_formal_parameter_to_stub_points_to(), compute_points_to_binded_set(), derived_formal_parameter_to_stub_points_to(), formal_points_to_parameter(), gen_may_constant_paths(), gen_may_set(), gen_must_constant_paths(), gen_must_set(), init_points_to_analysis(), k_limit_points_to(), kill_may_set(), merge_points_to_set(), new_points_to_unstructured(), opgen_null_location(), pointer_formal_parameter_to_stub_points_to(), points_to_anywhere(), points_to_anywhere_typed(), points_to_function_projection(), points_to_in_list_p(), points_to_independent_store(), points_to_may_filter(), points_to_must_filter(), points_to_nowhere(), typedef_formal_parameter_to_stub_points_to(), and user_call_to_points_to_fast_interprocedural().
"pts" is the points-to relation existing at the return point of a function.
Meaningless arcs in an interprocedural context must be eliminated.
The concept of "meaningless" arc has changed. Formal parameters are no longer "projected" although some of them are copies because, when they are not written, they are aliases of the actual parameters and carry useful information.
Unfortunately, we do not compute the information about may/must be written pointers.
As a consequence, some memory leaks cannot be detected here. The problem could be spotted when handling a call site, but then the memory leak will be indicated at each call site. This is not implemented, but we have a test case, Pointers/Mensi.sub/conditional_free01.c.
FI: side-effects to be used explicitly in this function For the time being a new set is allocated
Do we have a useful return value?
Preserve the return value. And indexed formal parameters such as s.tab? No, because struct are passed by copy. But not arrays... Except that copies are perfect alias of the actual argument when they are not modified. Since we do not have information about modified formal parameter, the Written set, we should provisionally preserve all formal parameters, no matter what they points to. See EffectsWithPointsTo/modif_pointer0a4.c
Also preserve nowhere generated by free although the pointer itself is not written. Beware that a formal pointer may be written... FI: we should be able to check is the source has been written or not in the current function... See Pointers/array10.c. However, it is still transiently true and not a bug.
Detect memory leaks
Look recursively for more memory leaks: cells in "emll" are no longer reachable
pts | ts |
Definition at line 477 of file points_to_set.c.
References all_heap_locations_cell_p(), array_type_p(), atomic_points_to_cell_p(), CELL, cell_any_reference(), cell_out_of_scope_p(), compute_basic_concrete_type(), CONS, entity_basic_concrete_type(), entity_undefined, formal_parameter_p(), function_to_return_value(), functional_result, gen_free_list(), get_current_module_entity(), heap_cell_p(), NIL, nowhere_cell_p(), pointer_type_p(), points_to_equal_p(), points_to_rank(), points_to_sink, points_to_source, potential_to_effective_memory_leaks(), reference_variable, remove_points_to_cells(), set_assign(), set_del_element(), SET_FOREACH, set_generic_make(), set_private, struct_type_p(), and type_functional.
Referenced by generic_points_to_analysis().
out | ut |
in | n |
Definition at line 3194 of file points_to_set.c.
References out, points_to_graph_set, and set_assign().
Referenced by control_to_points_to(), and cyclic_graph_to_points_to().
found!
else no found
pt | t |
lx | x |
Definition at line 2647 of file points_to_set.c.
References CAR, ENDP, POINTS_TO, points_to_equal_p(), and POP.
create a string which is a concatenation of the source's name, the sink's name and the approximation of their relation(may or exact).
The same string is used by the function points_to_rank()
pt | t |
Definition at line 163 of file points_to_set.c.
References approximation_tag, cell_to_reference(), concatenate(), int2a(), points_to_approximation, points_to_sink, points_to_source, reference_to_string(), s1, and strdup().
points_to points_to_path_to_k_limited_points_to_path | ( | list | p, |
int | k, | ||
type | t, | ||
bool | array_p, | ||
pt_map | in | ||
) |
"p" is a points-to path ending with a cell that points towards a new cell ot type "t".
To avoid creating infinite/unbounded path, no more than k nodes of type "t" can be present in path "p". If k are found, a cycle is created to represent longer paths. The corresponding arc is returned. If the creation condition is not met, do not create a new arc.
The current path cannot be made any longer
Find the k-th node of type "t" if it exists
Skip sources that are already in the path "p" so as to avoid infinite path due to cycles in points-to graph "in".
array_p | rray_p |
in | n |
Definition at line 1004 of file points_to_set.c.
References CAR, CDR, CELL, cell_undefined_p, CONS, copy_cell(), ENDP, find_kth_points_to_node_in_points_to_path(), FOREACH, gen_free_list(), gen_last(), make_approximation_may(), make_descriptor_none(), make_points_to(), NIL, node_in_points_to_path_p(), pips_assert, points_to_graph_set, points_to_path_to_k_limited_points_to_path(), points_to_undefined, points_to_undefined_p, and sink_to_sources().
Referenced by create_k_limited_stub_points_to(), and points_to_path_to_k_limited_points_to_path().
create a key which is a concatenation of the source's name, the sink's name and the approximation of their relation(may or exact)
vpt | pt |
size | ize |
Definition at line 135 of file points_to_set.c.
References approximation_tag, cell_to_reference(), concatenate(), free(), hash_string_rank(), int2a(), points_to_approximation, points_to_sink, points_to_source, rank, reference_to_string(), s1, and strdup().
Referenced by array_formal_parameter_to_stub_points_to(), compute_points_to_binded_set(), derived_formal_parameter_to_stub_points_to(), formal_points_to_parameter(), gen_may_constant_paths(), gen_may_set(), gen_must_constant_paths(), gen_must_set(), init_points_to_analysis(), kill_may_set(), merge_points_to_set(), new_points_to_unstructured(), opgen_null_location(), pointer_formal_parameter_to_stub_points_to(), points_to_anywhere(), points_to_anywhere_typed(), points_to_function_projection(), points_to_independent_store(), points_to_may_filter(), points_to_must_filter(), points_to_nowhere(), typedef_formal_parameter_to_stub_points_to(), and user_call_to_points_to_fast_interprocedural().
Definition at line 2104 of file points_to_set.c.
References points_to_subscripts_to_number_of_unbounded_dimensions(), and reference_indices.
Referenced by points_to_cell_to_number_of_unbounded_dimensions().
FI: easier it fresh_p is true...
Try to use an extra subscript
We've got one translation at least. Now, we must update the subscripts.
We assume that c has at least as many subscripts as n_r
Update the last subscripts. E.g. _x_3[*] and _x_3[0] ->y[i][0] leads to y[i]*
Update the last subscripts. E.g. _q_2[0][one] and _q_2[0] ->s leads to sone
n_r | _r |
sl | l |
ptm | tm |
fresh_p | resh_p |
Definition at line 1682 of file points_to_set.c.
References CAR, CDR, CELL, cell_any_reference(), CONS, copy_expression(), ENDP, EXPRESSION, FOREACH, gen_full_copy_list(), gen_length(), gen_nconc(), gen_nthcdr(), int, NIL, nowhere_cell_p(), null_cell_p(), pips_assert, pips_internal_error, points_to_reference_to_translation(), reference_indices, reference_to_points_to_translations(), and reference_variable.
Referenced by points_to_reference_to_translation(), and points_to_source_to_translations().
Remove from "pts" arcs based on at least one local entity in list "l" and preserve those based on static and global entities.
This function is called when exiting a statement block.
Detection of dangling pointers.
Detection of memory leaks. Could be skipped when dealing with the "main" module, but the information would have to be passed down thru an extra parameter.
Side-effects on argument "pts" which is returned.
Check for memory leaks
Both the sink and the source disappear: the arc is removed
Any memory leak?
pts | ts |
main_p | ain_p |
body_p | ody_p |
Definition at line 206 of file points_to_set.c.
References add_arc_to_simple_pt_map(), any_function_to_return_value(), approximation_exact_p, array_of_pointers_type_p(), array_of_struct_type_p(), CELL, cell_any_reference(), cell_to_reference(), CONS, copy_approximation(), copy_cell(), copy_type(), ENTITY, entity_basic_concrete_type(), entity_name, entity_user_name(), FOREACH, formal_parameter_p(), free_points_to_graph(), free_type(), gen_free_list(), gen_in_list_p(), get_current_module_entity(), heap_cell_p(), make_descriptor_none(), make_points_to(), make_points_to_graph(), make_typed_nowhere_cell(), memory_leak_to_more_memory_leaks(), NIL, pips_user_warning, pointer_type_p(), POINTS_TO, points_to_approximation, points_to_cell_to_type(), points_to_graph_set, points_to_sink, points_to_source, reference_variable, remove_arc_from_simple_pt_map(), set_del_element(), SET_FOREACH, set_undefined, sink_in_set_p(), struct_type_p(), top_level_entity_p(), and variable_static_p().
Referenced by statement_to_points_to().
Sharing of cells
Sharing of references
Definition at line 2978 of file points_to_set.c.
References cell_any_reference(), dump_points_to(), fprintf(), points_to_sink, points_to_source, and SET_FOREACH.
Referenced by consistent_points_to_set().
Return the points-to "fpt" ending in cell "sink" if it exists.
Return points-to_undefined otherwise.
sink | ink |
ptm | tm |
Definition at line 1988 of file points_to_set.c.
References cell_equal_p(), points_to_graph_set, points_to_sink, points_to_undefined, and SET_FOREACH.
Referenced by remove_impossible_arcs_to_null().
Build the sources of sink "sink" according to the points-to graphs.
If "sink" is not found in the graph, return an empty list "sources". If "fresh_p", allocate copies. If not, return pointers to the destination vertices in "ptm".
It is not clear how much the abstract address lattice must be used to retrieve sources... If source = a[34], clearly a[*] is an OK equivalent source if a[34] is not a vertex of "ptm".
FI: I am not sure that using pointer arithmetics to declare equivalence is a good idea.
sink | ink |
ptm | tm |
fresh_p | resh_p |
Definition at line 1947 of file points_to_set.c.
References CELL, cell_equal_p(), cell_equivalent_p(), cell_included_p(), CONS, copy_cell(), ENDP, NIL, points_to_graph_set, points_to_sink, points_to_source, and SET_FOREACH.
Referenced by freed_list_to_points_to(), and generic_remove_unreachable_vertices_in_points_to_graph().
Use "sn" as a source name to derive a list of sink cells according to the points-to graph ptm.
Allocate copies of the sink cells if "fresh_p".
sn | n |
ptm | tm |
fresh_p | resh_p |
Definition at line 2008 of file points_to_set.c.
References CELL, CONS, copy_cell(), free(), NIL, points_to_cell_name(), points_to_graph_set, points_to_sink, points_to_source, and SET_FOREACH.
Referenced by normalize_points_to_graph().
sn | n |
ptm | tm |
fresh_p | resh_p |
Definition at line 2026 of file points_to_set.c.
References cell_undefined, copy_cell(), free(), points_to_cell_name(), points_to_graph_set, points_to_source, and SET_FOREACH.
Referenced by normalize_points_to_graph().
Remove all arcs starting from e because e has been assigned a new value.
Check for memory leaks
Any memory leak?
pts | ts |
Definition at line 298 of file points_to_set.c.
References CELL, cell_any_reference(), cell_to_reference(), CONS, entity_name, FOREACH, heap_cell_p(), NIL, pips_user_warning, points_to_sink, points_to_source, reference_variable, set_del_element(), SET_FOREACH, and sink_in_set_p().
Referenced by reference_condition_to_points_to().
Retrieve all possible sinks of the source.
source | ource |
ptm | tm |
fresh_p | resh_p |
Definition at line 1933 of file points_to_set.c.
References generic_points_to_source_to_sinks().
Referenced by filter_formal_context_according_to_actual_context(), new_filter_formal_context_according_to_actual_context(), and upgrade_approximations_in_points_to_set().
Build the list of arcs whose source is "source" according to the points-to graphs "ptm".
If "source" is not found in the graph, return an empty list "sinks". If "fresh_p", allocate copies. If not, return pointers to the arcs in "ptm".
It is not clear how much the abstract address lattice must be used to retrieve sinks... If source = a[34], clearly a[*] is an OK equivalent source if a[34] is not a vertex of "ptm". Currently, we assume that the origin vertex must be exactly "source".
See when the cell "source" is the starting vertex of a points-to arc.
source | ource |
ptm | tm |
fresh_p | resh_p |
Definition at line 2081 of file points_to_set.c.
References cell_equal_p(), CONS, copy_points_to(), NIL, POINTS_TO, points_to_graph_set, points_to_source, and SET_FOREACH.
Referenced by fuse_points_to_sink_cells(), and struct_assignment_to_points_to().
source | ource |
ptm | tm |
fresh_p | resh_p |
Definition at line 1915 of file points_to_set.c.
References generic_points_to_source_to_sinks().
Build the sinks of source "source" according to the points-to graphs.
If "source" is not found in the graph, return an empty list "sinks". If "fresh_p", allocate copies. If not, return pointers to the destination vertices in "ptm".
It is not clear how much the abstract address lattice must be used to retrieve sinks... If source = a[34], clearly a[*] is an OK equivalent source if a[34] is not a vertex of "ptm".
source | ource |
ptm | tm |
fresh_p | resh_p |
Definition at line 1909 of file points_to_set.c.
References generic_points_to_source_to_sinks().
Referenced by malloc_to_points_to_sinks(), recursive_filter_formal_context_according_to_actual_context(), and source_to_sinks().
May not retrieve all sinks of the source.
This happens with arrays of pointers. See EffectsWithPointers/call22.c
source | ource |
ptm | tm |
fresh_p | resh_p |
Definition at line 1924 of file points_to_set.c.
References generic_points_to_source_to_sinks().
Referenced by new_recursive_filter_formal_context_according_to_actual_context_for_pointer_pair(), points_to_binding_arguments(), and recursive_filter_formal_context_according_to_actual_context().
Use "ptm" as a translation map.
Must be similar to a function written by Beatrice to evaluate a complex reference according to points-to information. In her case, it is not a translation, but an evaluation of the possibly many dereferencements contained in the reference.
Try to translate a prefix of the source reference and substitue it when a translation is found. No need to translate further down, unlike Beatrice's function.
fresh_p might be useless because new cells always must be generated.
Outdated comment: The cell source is not a source in ptm, but a related cell may be the source
Beware of constant strings...
source | ource |
ptm | tm |
fresh_p | resh_p |
Definition at line 1760 of file points_to_set.c.
References anywhere_cell_p(), CELL, cell_any_reference(), compute_basic_concrete_type(), ENDP, FOREACH, free_type(), ifdebug, make_reference(), NIL, nowhere_cell_p(), null_cell_p(), overloaded_type_p(), pips_internal_error, points_to_cell_to_type(), points_to_reference_to_translation(), reference_indices, reference_variable, type_equal_p(), and type_functional_p.
sources | ources |
ptm | tm |
fresh_p | resh_p |
Definition at line 2066 of file points_to_set.c.
References generic_points_to_sources_to_sinks().
Referenced by translation_transitive_closure().
sources | ources |
ptm | tm |
fresh_p | resh_p |
Definition at line 2061 of file points_to_set.c.
References generic_points_to_sources_to_sinks().
Referenced by fuse_points_to_sink_cells().
sl | l |
Definition at line 2111 of file points_to_set.c.
References count, EXPRESSION, FOREACH, and unbounded_expression_p().
Referenced by points_to_reference_to_number_of_unbounded_dimensions(), and sinks_fully_matches_source_p().
A new list, "emll", is allocated.
It contains the cells in the potential memory leak list that are unreachable in set/relation "res". Relation "res" is unchanged. List "pmll" is unchanged.
FI: This is not a sufficient implementation. It fails with strongly connected components (SCC) in "res". The fixed point algorithms are likely to generate SCCs.
pmll | mll |
res | es |
Definition at line 431 of file points_to_set.c.
References CELL, cell_any_reference(), CONS, FOREACH, NIL, pips_user_warning, points_to_cell_equal_p(), points_to_sink, reference_to_string(), and SET_FOREACH.
Referenced by points_to_function_projection(), and remove_points_to_cell().
print a points-to arc for debug
pt | t |
print_p | rint_p |
Definition at line 568 of file points_to_set.c.
References anywhere_cell_p(), approximation_to_string(), cell_to_reference(), cell_typed_anywhere_locations_p(), entity_local_name(), entity_module_name(), fprintf(), get_current_module_entity(), module_name_to_entity(), MODULE_SEP_STRING, nowhere_cell_p(), null_cell_p(), points_to_approximation, points_to_domain, points_to_domain_number, points_to_sink, points_to_source, points_to_undefined_p, print_reference(), and reference_variable.
Referenced by dump_points_to(), and print_points_to().
Print a set of points-to for debug.
what | hat |
print_p | rint_p |
Definition at line 615 of file points_to_set.c.
References dump_points_to(), fprintf(), print_points_to(), SET_MAP, set_size(), and set_undefined_p.
Referenced by dump_points_to_set(), and print_points_to_set().
void print_points_to | ( | const points_to | pt | ) |
pt | t |
Definition at line 604 of file points_to_set.c.
References print_or_dump_points_to().
Referenced by consistent_points_to_set(), points_to_equal_p(), and print_or_dump_points_to_set().
void print_points_to_path | ( | list | p | ) |
For debugging.
Definition at line 837 of file points_to_set.c.
References CAR, CELL, ENDP, FOREACH, fprintf(), and print_points_to_cell.
Referenced by find_kth_points_to_node_in_points_to_path().
what | hat |
Definition at line 635 of file points_to_set.c.
References print_or_dump_points_to_set().
Referenced by any_loop_to_points_to(), compute_points_to_gen_set(), filter_formal_context_according_to_actual_context(), new_any_loop_to_points_to(), new_filter_formal_context_according_to_actual_context(), normalize_points_to_graph(), print_points_to_graph(), user_call_to_points_to_fast_interprocedural(), user_call_to_points_to_interprocedural(), and user_call_to_points_to_interprocedural_binding_set().
This function is designed to work properly for the translation of effects at call sites.
ptm is assumed to be a translation mapping.
Knowing that v(o_sl) is translated into w(d_sl), what is the translation of v(sl), w[tsl], assuming that o_sl, d_sl and sl are all subscript lists?
We assume that |o_sl|<|sl| because otherwise v[o_sl] would not be a constant memory location (?). We assume that |o_sl|<|d_sl| because we do not modelize sharing.
tsl is the result of the concatenation of three subscripts lists: a prefix made of the first subscripts of d_sl that are not covered by sl, the other subscripts of d_sl, updated according to the subscript values in sl, and a suffix, the subscripts in sl that have not equivalent in o_sl.
Update the last subscripts. E.g. _x_3[*] and _x_3[0] -> y[i][0] leads to y[i]*.
Update the last subscripts. E.g. _q_2[0][one] and _q_2[0] -> s leads to sone.
Update the last subscripts. E.g. x_3[4] and _x_3[0] -> y[*][1] leads to y[*][5]... A proof is needed to justify the subscript addition... if only to show that _x_3[0] is acceptable to claim something about _x[4]... (see EffectsWithPointsTo.sub/call08,c).
Same thing with _x_3[i] and _x_3[0] -> y[*][j]?
This functions is similar to what must be done to compute the sink or the source of an expression, but here both the subscript list sl and the sinks of the points-to arcs in ptm do not have to be constant paths.
null and undefined targets are not possible
Are the subscript lists compatible?
Offset to be applied...
We have an equality between the effect and the origin
The subscripts left in csl must be appended to the new sink
Build the prefix
Build the body: depending on the subscripts in sl and o_sl, update or not the susbcripts in cd_sl
Skip subscripts not reproduced in the destination
Build the suffix
Check the resulting length
Do no index constant character strings
sl | l |
ptm | tm |
Definition at line 1540 of file points_to_set.c.
References binary_intrinsic_expression, CAR, CELL, cell_any_reference(), CONS, constant_int, constant_int_p, copy_cell(), copy_expression(), ENDP, entity_basic_concrete_type(), EvalExpression(), EXPRESSION, expression_equal_p(), expression_lists_equal_p(), expression_undefined, expression_undefined_p, extended_integer_constant_expression_p(), free_cell(), gen_free_list(), gen_length(), gen_nreverse(), int, int_to_expression(), make_cell_reference(), make_reference(), NIL, nowhere_cell_p(), null_cell_p(), pips_assert, PLUS_OPERATOR_NAME, points_to_cell_in_list_p(), points_to_graph_set, points_to_sink, points_to_source, POP, reference_indices, reference_undefined, reference_variable, SET_FOREACH, tc, type_functional_p, unbounded_expression_p(), value_constant, value_constant_p, and zero_expression_p().
Referenced by points_to_reference_to_translation(), and substitute_stubs_in_transformer_with_translation_binding().
in | n |
fresh_p | resh_p |
Definition at line 2529 of file points_to_set.c.
References copy_reference(), free_cell(), make_cell_reference(), and source_to_sinks().
Referenced by reference_may_points_to_null_p(), and reference_must_points_to_null_p().
If the subscripts of the effective cell source "ec" are more precise than the subscripts of the cell "fc" found in the points-to set, update the subscript of the sink cell "sc" accordingly.
For instance, if "ec==q[0]" and "fc=q[*]" and "sc=_q_1[*]", transform "sc" into "_q_1[0]".
Also, if "ec==_nl_1[next]" and "fc=_nl_1" and "sc=_nl_1", transform "sc" into "_nl_1[next]"
This function has not been designed properly. It is extended as needed...
Take care of subscripts
Take care of fields
We are in trouble for the time being. Here is an example:
Arc is: "p[*]->*HEAP*_l_72". Where does p[0] point tp?
Definition at line 1270 of file points_to_set.c.
References CAR, cell_any_reference(), copy_expression(), ENDP, EXPRESSION, EXPRESSION_, free_expression(), gen_full_copy_list(), gen_nconc(), POP, reference_indices, and unbounded_expression_p().
Referenced by generic_points_to_source_to_sinks().
Definition at line 3585 of file points_to_set.c.
References set_del_element().
Referenced by points_to_set_block_projection(), and remove_points_to_cell().
You know that null and undefined cells in "*pL" are impossible because of the operation that is going to be performed on it.
Remove the corresponding arcs in points-to graph "in". Remove the corresponding cells from "*pL".
The search uses pointers. So "*pL" must contain sink cells of arcs of "in".
pL | L |
in | n |
Definition at line 3498 of file points_to_set.c.
References CELL, CONS, FOREACH, gen_free_list(), gen_list_and_not(), get_bool_property(), NIL, nowhere_cell_p(), null_cell_p(), pips_internal_error, points_to_sink_to_points_to(), points_to_undefined_p, and remove_arc_from_pt_map.
Referenced by binary_intrinsic_call_to_points_to_sinks(), dereferencing_to_sinks(), and subscripted_reference_to_points_to().
source | ource |
sink | ink |
pt | t |
Definition at line 3114 of file points_to_set.c.
References copy_cell(), free_points_to(), make_approximation_exact(), make_approximation_may(), make_descriptor_none(), make_points_to(), and remove_arc_from_pt_map.
Referenced by pointer_arithmetic_to_points_to(), and reference_dereferencing_to_points_to().
All arcs in relation "g" must be removed or updated if they use the node "c".
If "c" is the source of an arc, the arc must be removed and the sink is a new potential leak.
If "c" is the sink of an arc, NOWHERE, i.e. UNDEFINED is the new sink. The approximation is unchanged.
Since the heap model does not support a precise analysis, this is not sure. For the time being, all buckets allocated by the same statement have a unique name. So arcs pointing to one cannot be removed when another one is freed. However, since we check that no arc points to an abstract bucket before we declare a sure memory leak, this should be OK in the context of memory leaks...
&& atomic_points_to_cell_p(c)
Apply the arc removals
Apply the arc additions
Look for effective memory leaks induced by the removal
Go down recursively...
Definition at line 361 of file points_to_set.c.
References add_arc_to_simple_pt_map(), CELL, CONS, copy_approximation(), copy_cell(), ENDP, FOREACH, get_bool_property(), heap_cell_p(), make_descriptor_none(), make_nowhere_cell(), make_points_to(), make_typed_nowhere_cell(), NIL, POINTS_TO, points_to_approximation, points_to_cell_equal_p(), points_to_cell_to_concrete_type(), points_to_sink, points_to_source, potential_to_effective_memory_leaks(), remove_arc_from_simple_pt_map(), remove_points_to_cells(), and SET_FOREACH.
Referenced by remove_points_to_cells().
All nodes, i.e.
cells, in "cl" must be removed from graph "g".
graph "g" is updated by side-effects and returned.
cl | l |
Definition at line 416 of file points_to_set.c.
References CELL, FOREACH, and remove_points_to_cell().
Referenced by points_to_function_projection(), and remove_points_to_cell().
in | n |
verbose_p | erbose_p |
Definition at line 3461 of file points_to_set.c.
References generic_remove_unreachable_vertices_in_points_to_graph(), and out.
in | n |
Definition at line 3455 of file points_to_set.c.
References generic_remove_unreachable_vertices_in_points_to_graph(), and out.
Referenced by any_loop_to_points_to().
This function looks pretty dangerous as variables can be reached by their names.
in | n |
Definition at line 3469 of file points_to_set.c.
References generic_remove_unreachable_vertices_in_points_to_graph(), and out.
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 1165 of file points_to_set.c.
References generic_stub_source_to_sinks().
Referenced by stub_source_to_sinks().
test if a cell appear as a sink in a set of points-to
sink | ink |
Definition at line 680 of file points_to_set.c.
References cell_equal_p(), points_to_sink, and SET_FOREACH.
Referenced by points_to_set_block_projection(), and points_to_source_projection().
Build a list of possible cell sources for cell "sink" in points-to graph "pts".
If fresh_p is set, allocate new cells, if not just build the spine of the list.
Get rid of the constant subscripts since they are not direclty part of the points-to scheme on the sink side
sink | ink |
pts | ts |
fresh_p | resh_p |
Definition at line 1123 of file points_to_set.c.
References CELL, CONS, copy_cell(), NIL, points_to_sink, points_to_source, related_points_to_cells_p(), and SET_FOREACH.
Referenced by points_to_path_to_k_limited_points_to_path().
Is there at least one cell "sink" in list "sinks" whose subscripts fully match the subscripts in cell "source"?
It is easy in a one-D setting. If "p" is an array or a presumed array and if the source is "p[*]" then sinks "{a[1], a[2]}" are not sufficient. Something else is needed such as "a[*]" or "b[*]" or "undefined".
FI: As a first cut, the numbers of unbounded subscripts in references are counted and compared.
source | ource |
sinks | inks |
Definition at line 2132 of file points_to_set.c.
References CELL, cell_any_reference(), ENDP, FOREACH, points_to_subscripts_to_number_of_unbounded_dimensions(), and reference_indices.
Referenced by source_to_sinks().
bool source_in_graph_p | ( | cell | source, |
points_to_graph | s | ||
) |
source | ource |
Definition at line 674 of file points_to_set.c.
References points_to_graph_set, and source_in_set_p().
Referenced by user_call_to_points_to_intraprocedural().
test if a cell appear as a source in a set of points-to
if( opkill_may_vreference(source, points_to_source(pt) ))
source | ource |
Definition at line 646 of file points_to_set.c.
References cell_equal_p(), points_to_source, and SET_FOREACH.
Referenced by compute_points_to_kill_set(), points_to_binding_arguments(), points_to_cell_translation(), and source_in_graph_p().
test if a cell "source" appears as a source in a set of points-to
if( opkill_may_vreference(source, points_to_source(pt) ))
source | ource |
Definition at line 657 of file points_to_set.c.
References cell_equal_p(), cell_included_p(), points_to_source, and SET_FOREACH.
Referenced by points_to_binding_arguments().
Return a list of cells, "sinks", that are sink for some arc whose source is "source" or related to "source" in set "pts".
If no such arc is found, add new points-to stubs and new arcs in "pts" when global, formal or virtual variables are used in "source". Manage fix point detection to avoid creating an infinite number of such points-to stubs when recursive data structures are accessed in loops.
If "fresh_p" is set to true, no sharing is created between list "sinks" and reference "source" or points-to set "pts". Else, the cells in list "sinks" are the cells in arcs of the points-to set.
FI: I am not sure the above paragraph is properly implemented.
This function is based on several other simpler functions:
This function should never return an empty list. The caller should handle it as a bug in the analyzed code.
Function added by FI. It is recursive via...
Can we expect a sink?
0. Is the source a pointer? You would expect a yes, but C pointer arithmetics requires some strange typing. We assume it is an array of pointers.
We may need a stub even if sinks is not empty when the source contains "*" subscript(s) and when none of the sinks contains such a subscript, or, more precisely when star subscripts do not match, matching being not yet clearly defined.
Must be checked before globals because stubs for global variables are themselves global.
FI: it seems easier to maintain the consistency between the sinks and the arcs for the global consistency of the points-to processing. Otherwise, we may have to check for special cases like undefined or anywhere.
A bug somewhere up...
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 2214 of file points_to_set.c.
References add_arc_to_pt_map(), anywhere_cell_p(), anywhere_source_to_sinks(), array_type_p(), basic_pointer_p, C_pointer_type_p(), CELL, cell_any_reference(), cell_typed_anywhere_locations_p(), clear_pt_map, CONS, copy_cell(), ENDP, entity_anywhere_locations(), entity_basic_concrete_type(), entity_stub_sink_p(), entity_typed_anywhere_locations_p(), entity_user_name(), FOREACH, formal_parameter_p(), formal_source_to_sinks(), free_cell(), gen_nconc(), get_bool_property(), global_source_to_sinks(), make_anywhere_cell(), make_anywhere_points_to_cell(), make_approximation_may(), make_cell_reference(), make_descriptor_none(), make_points_to(), make_reference(), NIL, nowhere_cell_p(), nowhere_source_to_sinks(), null_cell_p(), null_pointer_value_cell_p(), null_source_to_sinks(), overloaded_type_p(), pips_internal_error, pips_user_warning, points_to_cell_to_concrete_type(), points_to_context_statement_line_number(), points_to_graph_bottom, points_to_source_to_sinks(), print_reference(), pt_map_undefined_p, reference_variable, sinks_fully_matches_source_p(), static_global_variable_p(), stub_source_to_sinks(), top_level_entity_p(), type_to_pointed_type(), type_variable, and variable_basic.
Referenced by any_source_to_sinks(), binary_intrinsic_call_to_points_to_sinks(), dereferencing_to_sinks(), extended_source_to_sinks(), formal_source_to_sinks(), generic_stub_source_to_sinks(), global_source_to_sinks(), internal_pointer_assignment_to_points_to(), pointer_arithmetic_to_points_to(), reference_dereferencing_to_points_to(), reference_to_points_to_sinks(), reference_to_sinks(), sources_to_sinks(), and subscript_to_points_to_sinks().
Same as source_to_sinks, but for a list of cells.
sources | ources |
ptm | tm |
fresh_p | resh_p |
Definition at line 2519 of file points_to_set.c.
References CELL, FOREACH, gen_nconc(), NIL, and source_to_sinks().
Definition at line 2888 of file points_to_set.c.
References consistent_points_to_arc_p().
Referenced by add_arc_to_pt_map(), add_arc_to_pt_map_(), add_arc_to_simple_pt_map(), and consistent_points_to_set().
source | ource |
pts | ts |
fresh_p | resh_p |
Definition at line 1153 of file points_to_set.c.
References array_stub_source_to_sinks(), cell_any_reference(), ENDP, NIL, reference_indices, and scalar_stub_source_to_sinks().
Referenced by source_to_sinks().
See if a super-cell of "c" exists witf type "t".
A supercell is a cell "nc" equals to cell "c" but with a shorter subscript list.
This function is almost identical to the previous one.
A new cell is allocated and returned.
Remove the last subscript
Definition at line 906 of file points_to_set.c.
References CAR, cell_any_reference(), cell_to_type(), copy_cell(), ENDP, EXPRESSION, fprintf(), free_type(), gen_last(), gen_remove(), ifdebug, pips_debug, print_points_to_cell, reference_indices, type_equal_p(), and type_to_full_string_definition().
Referenced by find_kth_points_to_node_in_points_to_path().
A type "t" is compatible with a cell "c" if any of the enclosing cell "c'" of "c", including "c", is of type "t".
For instance, "a.next" is included in "a". It is compatible with both the type of "a" and the type of "a.next".
Remove the last subscript
Definition at line 857 of file points_to_set.c.
References CAR, cell_any_reference(), cell_to_type(), concrete_array_pointer_type_equal_p(), copy_cell(), ENDP, EXPRESSION, free_cell(), free_type(), gen_last(), gen_remove(), ifdebug, pips_debug, reference_indices, and type_to_full_string_definition().
Referenced by find_kth_points_to_node_in_points_to_path().
Can cell c be accessed via another cell?
FI: the CP lattice should be used instead
If "c" is somehow included into "sink", "c" is reachable. For instance, if c[*] is reachable than c[1] is reachable too.
But the opposite may be true: if c[1] is reachable, then c[*] is reachable.
However, if "struct s" is reachable, then so "s[next]" . But if "s[next]" is reachable does not imply that "s" is reachable.
ptg | tg |
Definition at line 3373 of file points_to_set.c.
References points_to_graph_set, points_to_sink, related_points_to_cells_p(), and SET_FOREACH.
Referenced by freed_list_to_points_to(), list_assignment_to_points_to(), and memory_leak_to_more_memory_leaks().
void upgrade_approximations_in_points_to_set | ( | pt_map | ptm | ) |
When arcs have been removed from a points-to relation, the approximations of remaining arcs may not correspond to the new points-to relation.
A may approximation may have become an exact approximation.
The semantics of the approximation and its many constraints must be taken into account. But they are not (yet) well formaly defined... The conditions here are:
Another question: is it OK to fix a lack of precision later or wouldn't it ne better to maintain the proper approximation on the fly, when more information is available?
Note about the implementation: Because of points-to set implementation, you cannot change approximations by side effects.
&& !stub_points_to_cell_p(source)
ptm | tm |
Definition at line 3085 of file points_to_set.c.
References add_arc_to_pt_map(), approximation_exact_p, cell_abstract_location_p(), copy_cell(), gen_free_list(), gen_length(), generic_atomic_points_to_cell_p(), make_approximation_exact(), make_descriptor_none(), make_points_to(), points_to_approximation, points_to_graph_set, points_to_sink, points_to_source, points_to_source_to_any_sinks(), remove_arc_from_pt_map, and SET_FOREACH.
Referenced by any_loop_to_points_to(), filter_formal_context_according_to_actual_context(), new_filter_formal_context_according_to_actual_context(), and statement_to_points_to().
Return all cells in points-to set "pts" who source is based on entity "e".
Similar to points_to_source_to_sinks, but much easier and shorter.
ptm | tm |
fresh_p | resh_p |
Definition at line 2485 of file points_to_set.c.
References CELL, cell_any_reference(), CONS, copy_cell(), NIL, points_to_graph_set, points_to_sink, points_to_source, reference_variable, and SET_FOREACH.
Referenced by freed_list_to_points_to().