Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Basic C++ inheritance test in PTABen does not match expected behavior for DVF or WPA -ander #1590

Open
mlevatich opened this issue Nov 7, 2024 · 1 comment

Comments

@mlevatich
Copy link

I am running the single-inheritance-1.cpp.bc test case found here: https://github.com/SVF-tools/Test-Suite/blob/master/test_cases_bc/basic_cpp_tests/single-inheritance-1.cpp.bc

int global_obj;
int *global_ptr = &global_obj;

class A {
  public:
    virtual void f(int *i) {
    // The following may alias also holds 
    // if we use flow-insensitive Andersen's analysis
    // since the vtable vtableptrA stored in the object 
    // is not strongly updated to be vtableptrB
    //MUSTALIAS(global_ptr, i);  
    }
};

class B: public A {
    virtual void f(int *i) {
      MUSTALIAS(global_ptr, i);
    }
};

int main(int argc, char **argv)
{
  int *ptr = &global_obj;

  A *pb = new B;
  pb->f(ptr);

  return 0;
}

I am running into two problems:

  1. When I run this test case with the flow-sensitive tool dvf -dfs single-inheritance-1.cpp.bc (described here: https://yuleisui.github.io/publications/tse18.pdf), it fails. dvf/SUPA thinks it is a no-alias instead of a must-alias. The expected behavior as described in the SUPA paper is a must-alias.

  2. The comment in the source indicates that the second, commented-out MUSTALIAS holds for andersen's analysis, because it is flow-insensitive. However, when I add in this MUSTALIAS and run 'wpa -ander single-inheritance-1.cpp.bc', the test fails (i.e. ander thinks the parameter in the base class is a NOALIAS, which should be only determined via a flow-sensitive analysis).

@jumormt
Copy link
Contributor

jumormt commented Nov 8, 2024

I will take a look at the first question. For the second one, I didn't get your statement when I add in this MUSTALIAS. class B's MUSTALIAS holds because the typeinference module can tell the type of pb is class B, eliminating the spurious call of pb->f(ptr) to class A's f function (meaning no copy from ptr to the parameter of A's f function). class A's alias check should be NOALIAS.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants