Context-Sensitive Andersen Pointer Analysis

LICENSE.txt

@@ -208,3 +208,38 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
+
+
+CRoaring
+-------------------------------------------------------------------------------
+The CRoaring project is under a dual license (Apache/MIT).
+Users of the library may choose one or the other license.
+---
+
+MIT License
+
+Copyright 2016-2022 The CRoaring authors
+
+Permission is hereby granted, free of charge, to any
+person obtaining a copy of this software and associated
+documentation files (the "Software"), to deal in the
+Software without restriction, including without
+limitation the rights to use, copy, modify, merge,
+publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software
+is furnished to do so, subject to the following
+conditions:
+
+The above copyright notice and this permission notice
+shall be included in all copies or substantial portions
+of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF
+ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED
+TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
+PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT
+SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
+CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
+OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR
+IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.

include/phasar/ControlFlow/CallGraphBase.h

@@ -15,6 +15,7 @@
 #include "phasar/Utils/Compressor.h"
 #include "phasar/Utils/GraphTraits.h"
 #include "phasar/Utils/IotaIterator.h"
+#include "phasar/Utils/Macros.h"
 #include "phasar/Utils/NonNullPtr.h"
 #include "phasar/Utils/TypeTraits.h"
 
@@ -147,13 +148,15 @@ template <typename CallGraphTy, typename DB> class ReverseCGGraph {
                                         typename CallGraphTy::f_t>;
 
   constexpr ReverseCGGraph(
-      NonNullPtr<const CallGraphTy> CGView, NonNullPtr<const DB> IRDB,
+      NonNullPtr<const CallGraphTy> CGView PSR_LIFETIMEBOUND,
+      NonNullPtr<const DB> IRDB PSR_LIFETIMEBOUND,
       Compressor<typename CallGraphTy::f_t, FunctionId> FC) noexcept
     requires(NeedsMapping)
       : CGView(CGView), IRDB(IRDB), FC(std::move(FC)) {}
 
-  constexpr ReverseCGGraph(NonNullPtr<const CallGraphTy> CGView,
-                           NonNullPtr<const DB> IRDB) noexcept
+  constexpr ReverseCGGraph(NonNullPtr<const CallGraphTy> CGView
+                               PSR_LIFETIMEBOUND,
+                           NonNullPtr<const DB> IRDB PSR_LIFETIMEBOUND) noexcept
       : CGView(CGView), IRDB(IRDB) {
     FC.reserve(CGView->getNumVertexFunctions());
     for (const auto &Fun : CGView->getAllVertexFunctions()) {

include/phasar/PhasarLLVM/Pointer.h

@@ -17,6 +17,7 @@
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasInfo.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMAliasSet.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMGlobalInitCache.h"
+#include "phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMPointsToInfo.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMPointsToUtils.h"
 #include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h"

include/phasar/PhasarLLVM/Pointer/AndersenOTFAA.h

@@ -14,6 +14,7 @@
 #include "phasar/PhasarLLVM/Pointer/LLVMUnionFindAA.h"
 #include "phasar/Pointer/RawAliasSet.h"
 #include "phasar/Pointer/UnionFindAA.h"
+#include "phasar/Utils/Macros.h"
 #include "phasar/Utils/MaybeUniquePtr.h"
 #include "phasar/Utils/NonNullPtr.h"
 #include "phasar/Utils/Soundness.h"
@@ -22,6 +23,10 @@
 
 #include "llvm/ADT/ArrayRef.h"
 
+#include <cstdint>
+#include <string>
+#include <vector>
+
 namespace llvm {
 class Function;
 } // namespace llvm
@@ -30,10 +35,54 @@ namespace psr {
 
 class LLVMProjectIRDB;
 
+/// Opt-in call-string context-sensitivity for \c AndersenOTFSolver.
+///
+/// The call-string k-limit is fixed at 1: a selected function gets one set of
+/// PAG nodes per call-site that reaches it.  Non-selected functions keep a
+/// single set of nodes shared by all callers, exactly as before.
+struct ContextSensitivityOptions {
+  enum class Mode : uint8_t {
+    Off,     ///< Root context only; identical to the insensitive solver.
+    Manual,  ///< Only functions matching \c AllowList.
+    Dynamic, ///< \c AllowList plus functions observed as precision-critical.
+    All,     ///< Every function, until \c MaxContextualNodes is reached.
+  };
+
+  Mode SelectionMode = Mode::Off;
+  /// Function-name globs (\c llvm::GlobPattern).  \c DenyList wins over
+  /// \c AllowList.
+  std::vector<std::string> AllowList{};
+  std::vector<std::string> DenyList{};
+  /// Hard cap on context-qualified PAG nodes.  Once reached, no function is
+  /// newly selected and no already-selected function gets a further context:
+  /// sound, just less precise.  This is the knob that bounds run time; solve
+  /// time grows super-linearly in the node count, so raising it is not a
+  /// proportional trade.
+  size_t MaxContextualNodes = 20'000;
+  /// Cap on distinct calling contexts per function; further call sites fall
+  /// back to the shared root context.  A selected function costs one clone of
+  /// its whole body per context, so without this a single hot function can
+  /// consume \c MaxContextualNodes on its own.
+  unsigned MaxContextsPerFunction = 32;
+  /// \c Mode::Dynamic only: functions with more LLVM instructions than this
+  /// are never selected.  Cloning a large body per context is expensive, and
+  /// large functions are rarely the point where callers merge.
+  unsigned MaxContextualFunctionSize = 256;
+  /// \c Mode::Dynamic only: tighter size limit for the weaker signal where
+  /// the merged parameters never leave the function body.  Off by default:
+  /// that signal's only payoff is formal-vs-formal aliasing inside the body,
+  /// which \c buildResult unions back together across contexts anyway.
+  unsigned MaxLocalMergeFunctionSize = 0;
+
+  [[nodiscard]] constexpr bool isOff() const noexcept {
+    return SelectionMode == Mode::Off;
+  }
+};
+
 /// Alias-analysis result for the Andersen-style OTF points-to analysis.
 ///
 /// Two values may-alias iff their points-to sets share at least one abstract
-/// object.  Satisfies \c UnionFindAAResult so it can be wrapped by
+/// object.  Satisfies \c RawAAResult so it can be wrapped by
 /// \c LLVMUnionFindAliasIterator.
 struct AndersenOTFResult {
   TypedVector<ValueId, RawAliasSet<ValueId>> AliasSets;
@@ -63,7 +112,7 @@ struct AndersenOTFResult {
   }
 };
 
-static_assert(UnionFindAAResult<AndersenOTFResult>);
+static_assert(RawAAResult<AndersenOTFResult>);
 
 /// Andersen-style inclusion-based points-to analysis that co-refines the call
 /// graph and points-to sets in a single fixpoint.
@@ -72,13 +121,16 @@ static_assert(UnionFindAAResult<AndersenOTFResult>);
 /// function-worklist loop: direct calls add callees immediately; indirect
 /// calls are resolved as \c pts(fp) grows.
 ///
-/// Phase 1: context- and field-insensitive.
+/// Context-sensitivity is opt-in via \c ContextSensitivityOptions and off by
+/// default.
 class AndersenOTFSolver {
 public:
-  explicit AndersenOTFSolver(const LLVMProjectIRDB &IRDB,
-                             llvm::ArrayRef<const llvm::Function *> Entries,
-                             ValueCompressor<PAGVariable> &VC,
-                             Soundness S = Soundness::Soundy) noexcept;
+  explicit AndersenOTFSolver(const LLVMProjectIRDB &IRDB PSR_LIFETIMEBOUND,
+                             llvm::ArrayRef<const llvm::Function *> Entries
+                                 PSR_LIFETIMEBOUND,
+                             ValueCompressor<PAGVariable> &VC PSR_LIFETIMEBOUND,
+                             Soundness S = Soundness::Soundy,
+                             ContextSensitivityOptions CSOpts = {}) noexcept;
 
   /// Run the full OTF fixpoint and return the alias-analysis result.
   [[nodiscard]] AndersenOTFResult solve();
@@ -90,6 +142,7 @@ class AndersenOTFSolver {
   llvm::ArrayRef<const llvm::Function *> Entries;
   NonNullPtr<ValueCompressor<PAGVariable>> VC;
   Soundness S;
+  ContextSensitivityOptions CSOpts;
 };
 
 // ---- Factory functions ------------------------------------------------
@@ -100,14 +153,16 @@ class AndersenOTFSolver {
 computeAndersenOTFRaw(const LLVMProjectIRDB &IRDB,
                       llvm::ArrayRef<const llvm::Function *> EntryPoints,
                       MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
-                      Soundness S = Soundness::Soundy);
+                      Soundness S = Soundness::Soundy,
+                      ContextSensitivityOptions CSOpts = {});
 
 /// Runs the Andersen OTF fixpoint and returns an \c LLVMUnionFindAliasIterator
 /// that implements \c IsLLVMAliasIterator.
-[[nodiscard]] LLVMUnionFindAliasIterator<AndersenOTFResult>
+[[nodiscard]] LLVMRawAliasIterator<AndersenOTFResult>
 computeAndersenOTF(const LLVMProjectIRDB &IRDB,
                    llvm::ArrayRef<const llvm::Function *> EntryPoints,
                    MaybeUniquePtr<ValueCompressor<PAGVariable>> VC = nullptr,
-                   Soundness S = Soundness::Soundy);
+                   Soundness S = Soundness::Soundy,
+                   ContextSensitivityOptions CSOpts = {});
 
 } // namespace psr

include/phasar/PhasarLLVM/Pointer/LLVMPointerSemantics.h

@@ -0,0 +1,170 @@
+#pragma once
+
+/******************************************************************************
+ * Copyright (c) 2026 Fabian Schiebel.
+ * All rights reserved. This program and the accompanying materials are made
+ * available under the terms of LICENSE.txt.
+ *
+ * Contributors:
+ *     Fabian Schiebel and others
+ *****************************************************************************/
+
+#include "phasar/PhasarLLVM/Utils/LLVMShorthands.h"
+#include "phasar/Utils/Utilities.h"
+
+#include "llvm/ADT/DenseMap.h"
+#include "llvm/ADT/STLExtras.h"
+#include "llvm/IR/DataLayout.h"
+#include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/GlobalVariable.h"
+#include "llvm/IR/InstIterator.h"
+#include "llvm/IR/Instruction.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/Type.h"
+#include "llvm/IR/Value.h"
+#include "llvm/Support/Casting.h"
+
+#include <optional>
+
+/// LLVM-level questions that LLVMPAGBuilder and AndersenOTFSolver must answer
+/// identically. They emit different node and edge kinds, but must not disagree
+/// on which IR constructs carry pointers.
+
+namespace psr {
+
+/// Whether a value of the pointer-free type \p Ty is laid out such that it
+/// could hold pointer bit patterns.
+[[nodiscard]] inline bool mayHidePointer(const llvm::DataLayout &DL,
+                                         const llvm::Type *Ty) {
+  if (Ty->isIntegerTy(DL.getPointerSizeInBits())) {
+    return true;
+  }
+  if (const auto *Arr = llvm::dyn_cast<llvm::ArrayType>(Ty)) {
+    return mayHidePointer(DL, Arr->getElementType());
+  }
+  const auto *Struct = llvm::dyn_cast<llvm::StructType>(Ty);
+  return Struct && !Struct->isOpaque() && !Struct->elements().empty() &&
+         llvm::all_of(Struct->elements(), [&DL](const llvm::Type *ElemTy) {
+           return mayHidePointer(DL, ElemTy);
+         });
+}
+
+/// Whether Ptr is a memory-location (alloca or global), accessed as an
+/// integer.
+///
+/// Useful for handling atomicrmw of pointers, which clang punns to i64, and
+/// for ABI-coerced aggregates (see PunnedABICache).
+[[nodiscard]] inline bool isPunnedPointerAccess(const llvm::DataLayout &DL,
+                                                const llvm::Value *Ptr,
+                                                const llvm::Type *AccessedTy) {
+  if (!mayHidePointer(DL, AccessedTy)) {
+    return false;
+  }
+  const llvm::Value *Base = Ptr->stripPointerCastsAndAliases();
+  if (const auto *A = llvm::dyn_cast<llvm::AllocaInst>(Base)) {
+    return !definitelyContainsNoPointer(A->getAllocatedType());
+  }
+  if (const auto *G = llvm::dyn_cast<llvm::GlobalVariable>(Base)) {
+    return !definitelyContainsNoPointer(G->getValueType());
+  }
+  return false;
+}
+
+/// The memory access to model for a load, store, atomicrmw or cmpxchg.
+struct LLVMMemoryAccess {
+  const llvm::Instruction *Instr{};
+  const llvm::Value *Pointer{};
+  /// Null if the access only reads.
+  const llvm::Value *StoredValue{};
+  /// Null if the access only writes; \c Instr itself for an atomic.
+  const llvm::Instruction *LoadedInto{};
+  bool Punned{};
+
+  /// The value whose type decides whether a pointer is transferred. For a
+  /// cmpxchg that is the new value, not the { ty, i1 } result.
+  [[nodiscard]] const llvm::Value *transferredValue() const noexcept {
+    return StoredValue ? StoredValue : LoadedInto;
+  }
+
+  /// Whether the access has to be modeled at all. Gating on
+  /// definitelyContainsNoPointer alone would drop punned accesses.
+  [[nodiscard]] bool mayTransferPointer() const {
+    return Punned || !definitelyContainsNoPointer(transferredValue());
+  }
+};
+
+/// Decomposes \p I, or returns nullopt if it is not a memory access. Field-
+/// insensitively an atomicrmw is a store of the new value plus a load of the
+/// old one; cmpxchg likewise, into its { ty, i1 } result.
+///
+/// The result still has to pass mayTransferPointer().
+[[nodiscard]] inline std::optional<LLVMMemoryAccess>
+asMemoryAccess(const llvm::Instruction &I, const llvm::DataLayout &DL) {
+  const auto Make = [&DL, &I](const llvm::Value *Ptr,
+                              const llvm::Value *StoredValue,
+                              const llvm::Instruction *LoadedInto) {
+    const auto *Transferred = StoredValue ? StoredValue : LoadedInto;
+    return LLVMMemoryAccess{
+        .Instr = &I,
+        .Pointer = Ptr,
+        .StoredValue = StoredValue,
+        .LoadedInto = LoadedInto,
+        .Punned = isPunnedPointerAccess(DL, Ptr, Transferred->getType()),
+    };
+  };
+
+  if (const auto *S = llvm::dyn_cast<llvm::StoreInst>(&I)) {
+    return Make(S->getPointerOperand(), S->getValueOperand(), nullptr);
+  }
+  if (const auto *L = llvm::dyn_cast<llvm::LoadInst>(&I)) {
+    return Make(L->getPointerOperand(), nullptr, L);
+  }
+  if (const auto *RMW = llvm::dyn_cast<llvm::AtomicRMWInst>(&I)) {
+    return Make(RMW->getPointerOperand(), RMW->getValOperand(), RMW);
+  }
+  if (const auto *CX = llvm::dyn_cast<llvm::AtomicCmpXchgInst>(&I)) {
+    return Make(CX->getPointerOperand(), CX->getNewValOperand(), CX);
+  }
+  return std::nullopt;
+}
+
+/// Recognizes ABI-coerced boundary values: values that carry a pointer
+/// although their type has none.
+///
+/// A small pointer-carrying struct is passed and returned in registers:
+///
+/// For whatever reason, on AArch64 clang punns such nested pointers as i64
+/// instead of ptr. This here is a best-effort approcach to keep pointer
+/// data-flows in such situations.
+class PunnedABICache {
+public:
+  explicit PunnedABICache(const llvm::DataLayout *DL) noexcept
+      : DL(&assertNotNull(DL)) {}
+
+  /// Whether \p V -- an argument, returned value or call result of \p F --
+  /// carries a pointer that its type does not reveal.
+  [[nodiscard]] bool isCoercedPointer(const llvm::Value *V,
+                                      const llvm::Function *F) {
+    return !llvm::isa<llvm::ConstantData>(V) &&
+           definitelyContainsNoPointer(V->getType()) &&
+           mayHidePointer(*DL, V->getType()) && punsPointers(F);
+  }
+
+private:
+  bool punsPointers(const llvm::Function *F) {
+    auto [It, Inserted] = Cache.try_emplace(F, false);
+    if (Inserted) {
+      It->second = llvm::any_of(llvm::instructions(*F), [this](const auto &I) {
+        const auto Access = asMemoryAccess(I, *DL);
+        return Access && Access->Punned;
+      });
+    }
+    return It->second;
+  }
+
+  const llvm::DataLayout *DL;
+  llvm::DenseMap<const llvm::Function *, bool> Cache;
+};
+
+} // namespace psr