├── doc ├── .gitignore ├── requirements.txt ├── templates │ └── layout.html ├── install.rst └── Makefile ├── datalog ├── debuginfo │ └── debuginfo.project ├── callgraph │ └── callgraph.project ├── import │ ├── import.project │ └── import.dl ├── symbol-lookup │ └── symbol-lookup.project ├── statistics.project ├── schema │ ├── activate-sanity.dl │ ├── debug.dl │ ├── unreachable-instr.dl │ ├── asm.dl │ └── ordering.dl ├── context │ └── context.project ├── subset.project ├── unification.project ├── subset-and-unification.project ├── common.project ├── export │ ├── statistics.dl │ ├── subset.dl │ └── unification.dl └── points-to │ ├── types.dl │ └── points-to.project ├── docker ├── dev.dockerfile.dockerignore └── dist.dockerfile.dockerignore ├── test ├── gold │ ├── .gitignore │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── rename.py │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_may_alias_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_must_alias_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_may_alias_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_must_alias_ctx.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv │ ├── ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_may_alias_ctx.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_may_alias_ctx.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_must_alias_ctx.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_must_alias_ctx.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.operand_points_to.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.operand_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv │ ├── allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv │ ├── notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv │ ├── type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv │ ├── points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv │ ├── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv │ └── points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv ├── c │ ├── standalone.c │ ├── df-sig-arg-to-ret.c │ ├── df-sig-arg-to-arg-pts.c │ ├── heap_oob_malloc.c │ ├── uninit-stack-var-use.c │ ├── extra-args.c │ ├── points-to_context.c │ ├── oob-condition.c │ ├── uninit-stack-array-use.c │ ├── strings.cpp │ ├── array-tests.c │ ├── underconstrained_oob_read.c │ ├── stack-args.c │ ├── fake-strtol.c │ ├── underconstrained_oob_write.c │ ├── test-dataflow.c │ ├── cfg-test.c │ ├── guessing-game-cxx.cpp │ ├── guessing-game.c │ ├── df-sig-arg-to-arg-pts-agg.c │ ├── underconstrained_cpp_vector.cpp │ ├── underconstrained_symbolic_offset_read.c │ ├── underconstrained_complex_inheritance2.cpp │ ├── truncated-integer.cpp │ ├── errno.c │ ├── struct-by-ptr.c │ ├── interprocedural_dataflow_test.cpp │ ├── dangerous-vla.c │ ├── underconstrained_silent_oob_write.c │ ├── mmap.c │ ├── issue_1137.c │ ├── simple-uaf.cpp │ ├── global.c │ ├── ex_symb_index.c │ ├── deadcode.c │ ├── issue_1522.cpp │ ├── deadcode2.c │ ├── points-to_new-context.cpp │ ├── underconstrained_virtual_method.cpp │ ├── oob-write.c │ ├── sql_injection.c │ ├── virtual-multiple-inheritance.cpp │ ├── struct_bounds.c │ ├── simple-uaf-read.c │ ├── nested_structs.c │ ├── underconstrained_symbolic_offset_write.c │ ├── simple-uaf-write.c │ ├── ex_simple.c │ ├── points-to_malloc-context.c │ ├── varargs.c │ ├── cxxbasic.cpp │ ├── guessing-game-heap.c │ ├── inlineasm3.c │ ├── recurse.c │ ├── globalvars.c │ ├── underconstrained_complex_inheritance.cpp │ ├── recurselambda.cpp │ ├── type-backprop.c │ ├── unused_argument.c │ ├── lambda.cpp │ ├── nested.c │ ├── stack-args-2.c │ ├── overflowable-allocations.cpp │ ├── voidptr.c │ ├── customclass.cpp │ └── nestedlambda.cpp ├── mypy.ini └── callgraph_test.py ├── stats └── requirements.txt ├── FactGenerator ├── src │ ├── TypeAccumulator.cpp │ └── PredicateGroups.cpp └── include │ ├── Unknown.hpp │ ├── MalformedModule.hpp │ ├── Signatures.hpp │ ├── ParseException.hpp │ ├── LlvmEnums.hpp │ ├── Wrapper.hpp │ └── PredicateGroups.hpp ├── contrib ├── README.md └── nix │ └── default.nix ├── scripts ├── version.sh ├── format.sh └── lint.sh ├── .clang-format ├── cmake └── sanitize.cmake └── flake.nix /doc/.gitignore: -------------------------------------------------------------------------------- 1 | build 2 | -------------------------------------------------------------------------------- /datalog/debuginfo/debuginfo.project: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /docker/dev.dockerfile.dockerignore: -------------------------------------------------------------------------------- 1 | * -------------------------------------------------------------------------------- /test/gold/.gitignore: -------------------------------------------------------------------------------- 1 | *.actual.csv 2 | -------------------------------------------------------------------------------- /docker/dist.dockerfile.dockerignore: -------------------------------------------------------------------------------- 1 | * 2 | !build/*.deb -------------------------------------------------------------------------------- /stats/requirements.txt: -------------------------------------------------------------------------------- 1 | pandas 2 | plotly 3 | kaleido 4 | -------------------------------------------------------------------------------- /datalog/callgraph/callgraph.project: -------------------------------------------------------------------------------- 1 | #include "entry-points.dl" 2 | -------------------------------------------------------------------------------- /doc/requirements.txt: -------------------------------------------------------------------------------- 1 | sphinx==5.3.0 2 | sphinx-rtd-theme==1.0.0 3 | -------------------------------------------------------------------------------- /datalog/import/import.project: -------------------------------------------------------------------------------- 1 | #line 1 "import.dl" 2 | #include "import.dl" 3 | -------------------------------------------------------------------------------- /datalog/symbol-lookup/symbol-lookup.project: -------------------------------------------------------------------------------- 1 | #include "resolve-func-calls.dl" 2 | -------------------------------------------------------------------------------- /datalog/statistics.project: -------------------------------------------------------------------------------- 1 | #include "master.project" 2 | #include "export/statistics.dl" 3 | -------------------------------------------------------------------------------- /datalog/schema/activate-sanity.dl: -------------------------------------------------------------------------------- 1 | // Enable all sanity checks of this project 2 | schema_sanity(). 3 | -------------------------------------------------------------------------------- /datalog/context/context.project: -------------------------------------------------------------------------------- 1 | #include "drop.dl" 2 | #include "interface.dl" 3 | #include "lift.dl" 4 | -------------------------------------------------------------------------------- /datalog/subset.project: -------------------------------------------------------------------------------- 1 | #include "common.project" 2 | #include "export/subset.dl" 3 | #include "points-to/subset.dl" -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /FactGenerator/src/TypeAccumulator.cpp: -------------------------------------------------------------------------------- 1 | #include "TypeAccumulator.hpp" 2 | // !! Test that the template class compiles cleanly !! 3 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /datalog/unification.project: -------------------------------------------------------------------------------- 1 | #include "common.project" 2 | #include "export/unification.dl" 3 | #include "points-to/unification.dl" 4 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /contrib/README.md: -------------------------------------------------------------------------------- 1 | The files in this directory are provided for convenience, they are not 2 | maintained to the same standard as the rest of the project. 3 | -------------------------------------------------------------------------------- /scripts/version.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -eo pipefail 4 | 5 | grep 'cclyzer++' CMakeLists.txt | \ 6 | grep -E -o '[0-9]\.[0-9]\.?[0-9]?' 7 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/rename.py: -------------------------------------------------------------------------------- 1 | import os 2 | 3 | for f in os.listdir("."): 4 | if ".canonical." in f: 5 | os.rename(f, f.replace(".canonical.", ".")) 6 | -------------------------------------------------------------------------------- /test/c/standalone.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main(int argc, char const *argv[]) { 4 | printf("this is a very small program\n"); 5 | return 0; 6 | } 7 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *unknown* nil *unknown* 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *unknown* nil *unknown* 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /scripts/format.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -eo pipefail 4 | 5 | for f in ./src/*.cpp ./FactGenerator/**/*.cpp; do 6 | clang-format-14 -i "${f}" 7 | done 8 | -------------------------------------------------------------------------------- /test/c/df-sig-arg-to-ret.c: -------------------------------------------------------------------------------- 1 | extern int df_sig_arg_to_ret(int) __attribute__((weak)); 2 | 3 | int main(int argc, char *argv[]) { return df_sig_arg_to_ret(argc); } 4 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 1-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.user_options.golden.csv: -------------------------------------------------------------------------------- 1 | context_sensitivity 2-callsite 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *unknown* nil *unknown* 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *unknown* nil *unknown* 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *unknown* nil *unknown* 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *unknown* nil *unknown* 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global *global_alloc@global 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global *global_alloc@global 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global *global_alloc@global 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global *global_alloc@global 2 | -------------------------------------------------------------------------------- /datalog/schema/debug.dl: -------------------------------------------------------------------------------- 1 | .type File <: symbol 2 | .type Line <: number 3 | 4 | // When true, this predicate enables all sanity checks of the project. 5 | .decl schema_sanity() 6 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:5 *heap_alloc@main[i8* %call] 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:5 *heap_alloc@main[i8* %call] 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:3 *heap_alloc@main[i8* %call] 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:3 *heap_alloc@main[i8* %call] 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | -------------------------------------------------------------------------------- /.clang-format: -------------------------------------------------------------------------------- 1 | BasedOnStyle: Google 2 | AlignAfterOpenBracket: AlwaysBreak 3 | BinPackArguments: false 4 | BinPackParameters: false 5 | ConstructorInitializerAllOnOneLineOrOnePerLine: true 6 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :my_calloc:9 *heap_alloc@my_calloc[i8* %call] 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :my_calloc:9 *heap_alloc@my_calloc[i8* %call] 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc[0] *argv-alloc 2 | nil *argv[0]-alloc[0] *argv[0]-alloc 3 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc[0] *argv-alloc 2 | nil *argv[0]-alloc[0] *argv[0]-alloc 3 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_may_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_must_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_may_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 2 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_must_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 2 | -------------------------------------------------------------------------------- /test/c/df-sig-arg-to-arg-pts.c: -------------------------------------------------------------------------------- 1 | extern int df_sig_arg_to_arg_pts(int, int *) __attribute__((weak)); 2 | 3 | int main(int argc, char *argv[]) { 4 | int x; 5 | return df_sig_arg_to_arg_pts(argc, &x); 6 | } 7 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i8 :main:26 *typed_stack_alloc@main[i8* %vla] 2 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i8 :main:26 *typed_stack_alloc@main[i8* %vla] 2 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i8 :main:19 *typed_stack_alloc@main[i8* %vla] 2 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i8 :main:19 *typed_stack_alloc@main[i8* %vla] 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str.1 *global_alloc@.str.1 2 | :@str *global_alloc@str 3 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str.1 *global_alloc@.str.1 2 | :@str *global_alloc@str 3 | -------------------------------------------------------------------------------- /FactGenerator/include/Unknown.hpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | template 4 | static void unknown(const std::string &s, T t) { 5 | std::cerr << "[warn] Unknown " << s << " " << t << std::endl; 6 | } 7 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@global_obj *global_alloc@global_obj 2 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %class.Animal* :main:5 *typed_heap_alloc@main[%class.Animal** %call] 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %class.Animal* :main:5 *typed_heap_alloc@main[%class.Animal** %call] 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %class.Animal* :main:3 *typed_heap_alloc@main[%class.Animal** %call] 2 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %class.Animal* :main:3 *typed_heap_alloc@main[%class.Animal** %call] 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :hex_str:29 *heap_alloc@hex_str[i8* %call] 2 | :notes_malloc:6 *heap_alloc@notes_malloc[i8* %call] 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :hex_str:29 *heap_alloc@hex_str[i8* %call] 2 | :notes_malloc:6 *heap_alloc@notes_malloc[i8* %call] 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :handle:128 *heap_alloc@handle[i8* %call.i.i.i23] 2 | :handle:22 *heap_alloc@handle[i8* %call.i.i.i] 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :handle:128 *heap_alloc@handle[i8* %call.i.i.i23] 2 | :handle:22 *heap_alloc@handle[i8* %call.i.i.i] 3 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | *argv-alloc[*] 8 2 | *argv-alloc[0] 8 3 | *argv[0]-alloc[*] 8 4 | *argv[0]-alloc[0] 8 5 | *global_alloc@global[*] 4 6 | *global_alloc@global[0] 4 7 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | *argv-alloc[*] 8 2 | *argv-alloc[0] 8 3 | *argv[0]-alloc[*] 8 4 | *argv[0]-alloc[0] 8 5 | *global_alloc@global[*] 4 6 | *global_alloc@global[0] 4 7 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z16hardcoded_sharedv:24 *heap_alloc@_Z16hardcoded_sharedv[i8* %call5.i.i.i21.i.i.i.i2.i] 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z16hardcoded_sharedv:24 *heap_alloc@_Z16hardcoded_sharedv[i8* %call5.i.i.i21.i.i.i.i2.i] 2 | -------------------------------------------------------------------------------- /test/c/heap_oob_malloc.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | void func() { 4 | char *s = "afsdfiuhsdofiuhsdfiqudfhngghodfiuyghdfiguhdfug"; 5 | char *dst = malloc(8 * sizeof(char)); 6 | strcpy(dst, s); 7 | } 8 | 9 | int main() { 10 | func(); 11 | return 0; 12 | } -------------------------------------------------------------------------------- /test/c/uninit-stack-var-use.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int vuln(int arg) { 5 | int res; 6 | res = res + arg; 7 | return res; 8 | } 9 | 10 | int main() { 11 | srand(time(NULL)); 12 | int r = rand(); 13 | return vuln(r); 14 | } 15 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i8 :_Z16hardcoded_sharedv:24 *typed_heap_alloc@_Z16hardcoded_sharedv[i8* %call5.i.i.i21.i.i.i.i2.i] 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i8 :_Z16hardcoded_sharedv:24 *typed_heap_alloc@_Z16hardcoded_sharedv[i8* %call5.i.i.i21.i.i.i.i2.i] 2 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :fun1:0 *heap_alloc@fun1[i8* %call] 2 | :fun2:0 *heap_alloc@fun2[i8* %call] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :fun1:0 *heap_alloc@fun1[i8* %call] 2 | :fun2:0 *heap_alloc@fun2[i8* %call] 3 | -------------------------------------------------------------------------------- /test/c/extra-args.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | void __attribute__((noinline)) printi(int i) { printf("%i", i); } 4 | 5 | typedef void fun_t(int argc, char **argv); 6 | 7 | int main(int argc, char **argv) { 8 | ((fun_t *)printi)(argc, argv); 9 | return 0; 10 | } 11 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *heap_alloc@main[i8* %call.i] 2 | :main:3 *heap_alloc@main[i8* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *heap_alloc@main[i8* %call.i] 2 | :main:3 *heap_alloc@main[i8* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *heap_alloc@main[i8* %call.i] 2 | :main:3 *heap_alloc@main[i8* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *heap_alloc@main[i8* %call.i] 2 | :main:3 *heap_alloc@main[i8* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.cmd :notes_malloc:6 *typed_heap_alloc@notes_malloc[%struct.cmd* %call] 2 | i8 :notes_malloc:6 *typed_heap_alloc@notes_malloc[i8* %call] 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.cmd :notes_malloc:6 *typed_heap_alloc@notes_malloc[%struct.cmd* %call] 2 | i8 :notes_malloc:6 *typed_heap_alloc@notes_malloc[i8* %call] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z4fun1v:0 *heap_alloc@_Z4fun1v[i8* %call] 2 | :_Z4fun2v:0 *heap_alloc@_Z4fun2v[i8* %call] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z4fun1v:0 *heap_alloc@_Z4fun1v[i8* %call] 2 | :_Z4fun2v:0 *heap_alloc@_Z4fun2v[i8* %call] 3 | -------------------------------------------------------------------------------- /datalog/subset-and-unification.project: -------------------------------------------------------------------------------- 1 | #include "common.project" 2 | #include "export/subset.dl" 3 | #include "export/unification.dl" 4 | #include "points-to/assertions.dl" 5 | #include "points-to/points-to-statistics.dl" 6 | #include "points-to/subset.dl" 7 | #include "points-to/unification.dl" 8 | -------------------------------------------------------------------------------- /datalog/common.project: -------------------------------------------------------------------------------- 1 | #include "schema/schema.project" 2 | #include "import/import.project" 3 | #include "symbol-lookup/symbol-lookup.project" 4 | #include "callgraph/callgraph.project" 5 | #include "points-to/points-to.project" 6 | #include "context/context.project" 7 | #include "options/user-options.dl" -------------------------------------------------------------------------------- /test/c/points-to_context.c: -------------------------------------------------------------------------------- 1 | void h(int **px, int *x) { *px = x; } 2 | 3 | void f(int **px, int *x) { h(px, x); } 4 | 5 | void g(int **px, int *x) { h(px, x); } 6 | 7 | int main() { 8 | int *pa, a = 0; 9 | int *pb, b = 0; 10 | f(&pa, &a); 11 | g(&pb, &b); 12 | return *pa + *pb; 13 | } 14 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc[0] *argv-alloc 3 | nil *argv[0]-alloc[0] *argv[0]-alloc 4 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc[0] *argv-alloc 3 | nil *argv[0]-alloc[0] *argv[0]-alloc 4 | -------------------------------------------------------------------------------- /datalog/export/statistics.dl: -------------------------------------------------------------------------------- 1 | .output subset._merge.count_context_items (compress=true) 2 | .output subset._merge.count_contexts (compress=true) 3 | .output func_degree (compress=true) 4 | .output func_out_degree (compress=true) 5 | .output var_alias_sizes (compress=true) 6 | .output var_points_to_sizes (compress=true) 7 | -------------------------------------------------------------------------------- /test/c/oob-condition.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main() { 4 | int buf[(int)'a'] = {0}; 5 | 6 | char a = 0; 7 | char b = 0; 8 | 9 | read(0, &a, 1); 10 | read(0, &b, 1); 11 | 12 | if (a != 'f') { 13 | return buf[0]; 14 | } else { 15 | return buf[(int)a - (int)b]; 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *unknown* nil *unknown* 6 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *unknown* nil *unknown* 6 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *unknown* nil *unknown* 6 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *unknown* nil *unknown* 6 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[%class.Llama* %llama] 2 | :main:1 *stack_alloc@main[%class.Dog* %dog] 3 | :main:2 *stack_alloc@main[%class.Poodle* %poodle] 4 | -------------------------------------------------------------------------------- /test/gold/virtual.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[%class.Llama* %llama] 2 | :main:1 *stack_alloc@main[%class.Dog* %dog] 3 | :main:2 *stack_alloc@main[%class.Poodle* %poodle] 4 | -------------------------------------------------------------------------------- /test/c/uninit-stack-array-use.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int vuln(int arg) { 5 | int res[10]; 6 | res[3] = arg * 2; 7 | res[5] = arg + res[3]; 8 | return res[0] + res[5]; 9 | } 10 | 11 | int main() { 12 | srand(time(NULL)); 13 | int r = rand(); 14 | return vuln(r); 15 | } 16 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *unknown* nil *unknown* 6 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *unknown* nil *unknown* 6 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :fun1:0 *typed_heap_alloc@fun1[%struct.obj* %call] 2 | %struct.obj :fun2:0 *typed_heap_alloc@fun2[%struct.obj* %call] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :fun1:0 *typed_heap_alloc@fun1[%struct.obj* %call] 2 | %struct.obj :fun2:0 *typed_heap_alloc@fun2[%struct.obj* %call] 3 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i8* %__c.addr.i32] 2 | :main:1 *stack_alloc@main[i8* %__c.addr.i] 3 | :main:2 *stack_alloc@main[%"class.std::__cxx11::basic_string"* %foo] 4 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i8* %__c.addr.i32] 2 | :main:1 *stack_alloc@main[i8* %__c.addr.i] 3 | :main:2 *stack_alloc@main[%"class.std::__cxx11::basic_string"* %foo] 4 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :main:0 *typed_heap_alloc@main[%struct.obj* %call.i] 2 | %struct.obj :main:3 *typed_heap_alloc@main[%struct.obj* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :main:0 *typed_heap_alloc@main[%struct.obj* %call.i] 2 | %struct.obj :main:3 *typed_heap_alloc@main[%struct.obj* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :main:0 *typed_heap_alloc@main[%struct.obj* %call.i] 2 | %struct.obj :main:3 *typed_heap_alloc@main[%struct.obj* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :main:0 *typed_heap_alloc@main[%struct.obj* %call.i] 2 | %struct.obj :main:3 *typed_heap_alloc@main[%struct.obj* %call.i13] 3 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@__const.main.table *global_alloc@__const.main.table 2 | :@str *global_alloc@str 3 | :@str.3 *global_alloc@str.3 4 | :@str.4 *global_alloc@str.4 5 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@__const.main.table *global_alloc@__const.main.table 2 | :@str *global_alloc@str 3 | :@str.3 *global_alloc@str.3 4 | :@str.4 *global_alloc@str.4 5 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :_Z4fun1v:0 *typed_heap_alloc@_Z4fun1v[%struct.obj* %call] 2 | %struct.obj :_Z4fun2v:0 *typed_heap_alloc@_Z4fun2v[%struct.obj* %call] 3 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.obj :_Z4fun1v:0 *typed_heap_alloc@_Z4fun1v[%struct.obj* %call] 2 | %struct.obj :_Z4fun2v:0 *typed_heap_alloc@_Z4fun2v[%struct.obj* %call] 3 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.cmd :handle:22 *typed_heap_alloc@handle[%struct.cmd* %call.i.i.i] 2 | i32 :handle:22 *typed_heap_alloc@handle[i32* %call.i.i.i] 3 | i8 :handle:22 *typed_heap_alloc@handle[i8* %call.i.i.i] 4 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.cmd :handle:22 *typed_heap_alloc@handle[%struct.cmd* %call.i.i.i] 2 | i32 :handle:22 *typed_heap_alloc@handle[i32* %call.i.i.i] 3 | i8 :handle:22 *typed_heap_alloc@handle[i8* %call.i.i.i] 4 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.double_struct :my_calloc:9 *typed_heap_alloc@my_calloc[%struct.double_struct* %call] 2 | %struct.int_struct :my_calloc:9 *typed_heap_alloc@my_calloc[%struct.int_struct* %call] 3 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | %struct.double_struct :my_calloc:9 *typed_heap_alloc@my_calloc[%struct.double_struct* %call] 2 | %struct.int_struct :my_calloc:9 *typed_heap_alloc@my_calloc[%struct.int_struct* %call] 3 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | :@.str.2 *global_alloc@.str.2 4 | :@__const.main.table *global_alloc@__const.main.table 5 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | :@.str.2 *global_alloc@.str.2 4 | :@__const.main.table *global_alloc@__const.main.table 5 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :countdown:0 *stack_alloc@countdown[i32* %x.addr] 2 | :main:0 *stack_alloc@main[i32* %retval] 3 | :main:1 *stack_alloc@main[i32* %argc.addr] 4 | :main:2 *stack_alloc@main[i8*** %argv.addr] 5 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :countdown:0 *stack_alloc@countdown[i32* %x.addr] 2 | :main:0 *stack_alloc@main[i32* %retval] 3 | :main:1 *stack_alloc@main[i32* %argc.addr] 4 | :main:2 *stack_alloc@main[i8*** %argv.addr] 5 | -------------------------------------------------------------------------------- /doc/templates/layout.html: -------------------------------------------------------------------------------- 1 | {% extends '!layout.html' %} 2 | {% block document %} 3 | {{super()}} 4 | 5 | Fork me on GitHub 6 | 7 | {% endblock %} 8 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[[8 x i32]* %small_const_size_stack] 2 | :main:1 *stack_alloc@main[[128 x i32]* %large_const_size_stack] 3 | :main:19 *stack_alloc@main[i32* %vla] 4 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[[8 x i32]* %small_const_size_stack] 2 | :main:1 *stack_alloc@main[[128 x i32]* %large_const_size_stack] 3 | :main:19 *stack_alloc@main[i32* %vla] 4 | -------------------------------------------------------------------------------- /test/c/strings.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int dup(std::string str) { 4 | std::string copy(str); 5 | auto newstr = new std::string(copy); 6 | auto sz = (copy + *newstr).size(); 7 | if (*newstr == str) { 8 | sz++; 9 | } 10 | delete newstr; 11 | return sz; 12 | } 13 | 14 | int main(int argc, char **argv) { return dup(std::string(argv[0])); } 15 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:17 *heap_alloc@main[i8* %call2] 2 | :main:31 *heap_alloc@main[i8* %call3] 3 | :main:35 *heap_alloc@main[i8* %call4] 4 | :main:42 *heap_alloc@main[i8* %call7] 5 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:17 *heap_alloc@main[i8* %call2] 2 | :main:31 *heap_alloc@main[i8* %call3] 3 | :main:35 *heap_alloc@main[i8* %call4] 4 | :main:42 *heap_alloc@main[i8* %call7] 5 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:22 *heap_alloc@main[i8* %call3] 2 | :main:25 *heap_alloc@main[i8* %call4] 3 | :main:28 *heap_alloc@main[i8* %call7] 4 | :main:9 *heap_alloc@main[i8* %call2] 5 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:22 *heap_alloc@main[i8* %call3] 2 | :main:25 *heap_alloc@main[i8* %call4] 3 | :main:28 *heap_alloc@main[i8* %call7] 4 | :main:9 *heap_alloc@main[i8* %call2] 5 | -------------------------------------------------------------------------------- /test/mypy.ini: -------------------------------------------------------------------------------- 1 | [mypy] 2 | disallow_any_generics = True 3 | disallow_incomplete_defs = True 4 | # TODO(lb): Enable this 5 | disallow_untyped_defs = False 6 | ignore_missing_imports = True 7 | implicit_reexport = False 8 | no_implicit_optional = True 9 | show_error_codes = True 10 | warn_redundant_casts = True 11 | warn_unused_configs = True 12 | warn_unused_ignores = True -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i32* %retval] 2 | :main:1 *stack_alloc@main[i32* %argc.addr] 3 | :main:2 *stack_alloc@main[i8*** %argv.addr] 4 | :main:3 *stack_alloc@main[[3 x void ()*]* %table] 5 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i32* %retval] 2 | :main:1 *stack_alloc@main[i32* %argc.addr] 3 | :main:2 *stack_alloc@main[i8*** %argv.addr] 4 | :main:3 *stack_alloc@main[[3 x void ()*]* %table] 5 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :handle:0 *stack_alloc@handle[[1024 x i8]* %data.i] 2 | :handle:1 *stack_alloc@handle[[32 x i8]* %data.i.i] 3 | :handle_loop:0 *stack_alloc@handle_loop[[1024 x i8]* %req] 4 | :main:0 *stack_alloc@main[%struct.sockaddr_in* %sa] 5 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :handle:0 *stack_alloc@handle[[1024 x i8]* %data.i] 2 | :handle:1 *stack_alloc@handle[[32 x i8]* %data.i.i] 3 | :handle_loop:0 *stack_alloc@handle_loop[[1024 x i8]* %req] 4 | :main:0 *stack_alloc@main[%struct.sockaddr_in* %sa] 5 | -------------------------------------------------------------------------------- /test/c/array-tests.c: -------------------------------------------------------------------------------- 1 | static int c; 2 | 3 | int fun(int n) { 4 | c = n; 5 | int arr[n]; 6 | int arr2[c]; 7 | int arr3[1] = {0}; 8 | int i; 9 | for (i = 0; i < n; i++) { 10 | arr[i] = n * 2; 11 | arr2[i] = arr[i] - 4; 12 | arr3[0] = arr3[0] + arr2[i]; 13 | } 14 | return arr[n - 1] + arr2[n / 3] + arr3[0]; 15 | } 16 | 17 | int main() { return fun(24); } 18 | -------------------------------------------------------------------------------- /test/c/underconstrained_oob_read.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct data { 5 | unsigned int val; 6 | char array[10]; 7 | struct data *next; 8 | }; 9 | 10 | int func(struct data *d) { 11 | return d->array[d->next->val]; // OOB read 12 | } 13 | 14 | int main(int argc, char const *argv[]) { 15 | struct data foo = {}; 16 | return func(&foo); 17 | } -------------------------------------------------------------------------------- /datalog/schema/unreachable-instr.dl: -------------------------------------------------------------------------------- 1 | // llvm.org/docs/LangRef.html#unreachable-instr 2 | // keywords: terminator; instr 3 | 4 | .type UnreachableInstruction <: symbol 5 | .decl unreachable_instr(instr:UnreachableInstruction) 6 | 7 | instr(v) :- unreachable_instr(v). 8 | terminator_instr(Insn) :- unreachable_instr(Insn). 9 | 10 | // The ‘unreachable‘ instr has no defined semantics. 11 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z16hardcoded_sharedv:0 *stack_alloc@_Z16hardcoded_sharedv[%"class.std::shared_ptr"* %mylambda] 2 | :_ZNK10FakeLambda7inspectEv:0 *stack_alloc@_ZNK10FakeLambda7inspectEv[%class.FakeLambda** %this.addr] 3 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z16hardcoded_sharedv:0 *stack_alloc@_Z16hardcoded_sharedv[%"class.std::shared_ptr"* %mylambda] 2 | :_ZNK10FakeLambda7inspectEv:0 *stack_alloc@_ZNK10FakeLambda7inspectEv[%class.FakeLambda** %this.addr] 3 | -------------------------------------------------------------------------------- /cmake/sanitize.cmake: -------------------------------------------------------------------------------- 1 | function(address_sanitizer target) 2 | target_compile_options(${target} PUBLIC -fsanitize=address) 3 | target_link_libraries(${target} PUBLIC -fsanitize=address) 4 | endfunction() 5 | 6 | function(undefined_behavior_sanitizer target) 7 | target_compile_options(${target} PUBLIC -fsanitize=undefined) 8 | target_link_libraries(${target} PUBLIC -fsanitize=undefined) 9 | endfunction() -------------------------------------------------------------------------------- /test/c/stack-args.c: -------------------------------------------------------------------------------- 1 | int f(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j, 2 | int k, int l, int m, int n) { 3 | return (a + b) + (c * d) * (e - f) - (g / h) / (i % j) % (k && l) && (m || n); 4 | } 5 | 6 | int main(int argc, char *argv[] /* unused */) { 7 | return f(argc, argc, argc, argc, argc, argc, argc, argc, argc, argc, argc, 8 | argc, argc, argc); 9 | } 10 | -------------------------------------------------------------------------------- /doc/install.rst: -------------------------------------------------------------------------------- 1 | Installation 2 | ============ 3 | 4 | Pre-built Debian packages are available from the `releases page`_. 5 | 6 | You can download Docker images from GHCR or them build yourself; see 7 | :doc:`docker`. 8 | 9 | If you need to use a older version of LLVM, you'll have to build from source. 10 | See :doc:`build`. 11 | 12 | .. _releases page: https://github.com/GaloisInc/cclyzerpp/releases 13 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc[0] *argv-alloc 2 | nil *argv[0]-alloc[0] *argv[0]-alloc 3 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 4 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 5 | nil *global_alloc@str[0] *global_alloc@str 6 | nil *global_alloc@str[0][*] *global_alloc@str[0] 7 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc[0] *argv-alloc 2 | nil *argv[0]-alloc[0] *argv[0]-alloc 3 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 4 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 5 | nil *global_alloc@str[0] *global_alloc@str 6 | nil *global_alloc@str[0][*] *global_alloc@str[0] 7 | -------------------------------------------------------------------------------- /test/c/fake-strtol.c: -------------------------------------------------------------------------------- 1 | // Test that signature handling code handles definitions of functions with 2 | // declarations that don't match the standards they're supposed to conform to. 3 | long strtol(const char *restrict nptr, int base) { 4 | return (long)base + (long)(nptr != 0); 5 | } 6 | 7 | int main(int argc, char **argv) { 8 | if (argc > 0) { 9 | return strtol(argv[0], 10); 10 | } 11 | return 0; 12 | } 13 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_ZN9__gnu_cxx13new_allocatorISt23_Sp_counted_ptr_inplaceI10FakeLambdaSaIS2_ELNS_12_Lock_policyE2EEE8allocateEmPKv:23 *heap_alloc@_ZN9__gnu_cxx13new_allocatorISt23_Sp_counted_ptr_inplaceI10FakeLambdaSaIS2_ELNS_12_Lock_policyE2EEE8allocateEmPKv[i8* %call5] 2 | -------------------------------------------------------------------------------- /test/gold/ovington-extra-minimal.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_ZN9__gnu_cxx13new_allocatorISt23_Sp_counted_ptr_inplaceI10FakeLambdaSaIS2_ELNS_12_Lock_policyE2EEE8allocateEmPKv:23 *heap_alloc@_ZN9__gnu_cxx13new_allocatorISt23_Sp_counted_ptr_inplaceI10FakeLambdaSaIS2_ELNS_12_Lock_policyE2EEE8allocateEmPKv[i8* %call5] 2 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc[0] *argv-alloc 2 | nil *argv[0]-alloc[0] *argv[0]-alloc 3 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 4 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 5 | nil *global_alloc@.str[0] *global_alloc@.str 6 | nil *global_alloc@.str[0][*] *global_alloc@.str[0] 7 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc[0] *argv-alloc 2 | nil *argv[0]-alloc[0] *argv[0]-alloc 3 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 4 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 5 | nil *global_alloc@.str[0] *global_alloc@.str 6 | nil *global_alloc@.str[0][*] *global_alloc@.str[0] 7 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@dynamic_size_global *global_alloc@dynamic_size_global 3 | :@large_const_size_global *global_alloc@large_const_size_global 4 | :@small_const_size_global *global_alloc@small_const_size_global 5 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@dynamic_size_global *global_alloc@dynamic_size_global 3 | :@large_const_size_global *global_alloc@large_const_size_global 4 | :@small_const_size_global *global_alloc@small_const_size_global 5 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@dynamic_size_global *global_alloc@dynamic_size_global 3 | :@large_const_size_global *global_alloc@large_const_size_global 4 | :@small_const_size_global *global_alloc@small_const_size_global 5 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@dynamic_size_global *global_alloc@dynamic_size_global 3 | :@large_const_size_global *global_alloc@large_const_size_global 4 | :@small_const_size_global *global_alloc@small_const_size_global 5 | -------------------------------------------------------------------------------- /test/c/underconstrained_oob_write.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct data { 5 | unsigned int val; 6 | char array[10]; 7 | struct data *next; 8 | }; 9 | 10 | int func(struct data *d) { 11 | // Write 42 at symbolic offset 12 | d->array[d->next->val] = 42; // OOB write 13 | return 0; 14 | } 15 | 16 | int main(int argc, char const *argv[]) { 17 | struct data foo = {}; 18 | return func(&foo); 19 | } -------------------------------------------------------------------------------- /test/c/test-dataflow.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | void __attribute__((noinline)) printi(int i) { printf("%i", i); } 6 | 7 | const int DIGITS[] = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9}; 8 | 9 | int main() { 10 | int x = getc(stdin); 11 | int z = x + 2; 12 | printi(z); // thin dataflow 13 | if (x < sizeof(DIGITS)) { 14 | printi(DIGITS[x]); // non-thin dataflow 15 | } 16 | return 0; 17 | } 18 | -------------------------------------------------------------------------------- /test/c/cfg-test.c: -------------------------------------------------------------------------------- 1 | int global = 0; 2 | 3 | int bar(int x) { return x; } 4 | 5 | int foo(int x) { 6 | int a = bar(x); // foo1 7 | int b = bar(x); 8 | return a + b + global; 9 | } 10 | 11 | void baz() { global = 1; } 12 | 13 | int main(int argc, char **argv) { 14 | int a = 0; 15 | int b = 1; 16 | 17 | int c = foo(a); // main1 18 | baz(); 19 | int d = foo(b); // main2 20 | int e = bar(d); // main3 21 | 22 | return c + d + e; 23 | } 24 | -------------------------------------------------------------------------------- /test/c/guessing-game-cxx.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | using namespace std; 5 | 6 | int main() { 7 | int hidden_answer = rand() % 10 + 1; 8 | 9 | int guess = 0; 10 | cout << "Guess a number 1-10" << endl; 11 | cin >> guess; 12 | 13 | if (guess == hidden_answer) { 14 | cout << "You win! Number was " << hidden_answer << '.' << endl; 15 | } else { 16 | cout << "You lose!" << endl; 17 | } 18 | return 0; 19 | } 20 | -------------------------------------------------------------------------------- /test/c/guessing-game.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int main() { 5 | int hidden_answer = rand() % 10 + 1; 6 | 7 | printf("Guess a number 1-10: "); 8 | int guess; 9 | int no = scanf("%d", &guess); 10 | if (no != 1) { 11 | return 1; 12 | } 13 | 14 | if (guess == hidden_answer) { 15 | printf("You win! Number was %d.\n", hidden_answer); 16 | } else { 17 | printf("You lose!\n"); 18 | } 19 | return 0; 20 | } 21 | -------------------------------------------------------------------------------- /scripts/lint.sh: -------------------------------------------------------------------------------- 1 | #!/usr/bin/env bash 2 | 3 | set -eo pipefail 4 | 5 | for f in ./src/*.cpp ./FactGenerator/**/*.cpp; do 6 | "clang-format-${CLANG_VERSION}" "${f}" | diff "${f}" - 7 | done 8 | 9 | if ! [[ -f build/compile_commands.json ]]; then 10 | printf "Run cmake -DCMAKE_EXPORT_COMPILE_COMMANDS=1 -G Ninja -S . -B build.\n" 11 | exit 1 12 | fi 13 | 14 | cmake --build build -j "$(nproc)" --target factgen-tidy 15 | 16 | cd test 17 | mypy . 18 | mypy ../scripts/*.py 19 | -------------------------------------------------------------------------------- /test/c/df-sig-arg-to-arg-pts-agg.c: -------------------------------------------------------------------------------- 1 | typedef struct { 2 | int u; 3 | int v; 4 | } pt; 5 | 6 | extern int df_sig_arg_to_arg_pts_agg(int, pt *, int *, int *) 7 | __attribute__((weak)); 8 | 9 | int main(int argc, char *argv[]) { 10 | pt x; 11 | // We need to pass &x.u and &x.v because otherwise those allocations won't 12 | // have any variables pointing to them, and so won't show up in the CPG. 13 | return df_sig_arg_to_arg_pts_agg(argc, &x, &x.u, &x.v); 14 | } 15 | -------------------------------------------------------------------------------- /test/c/underconstrained_cpp_vector.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int func(std::vector &vec) { 4 | int res = 0; 5 | int i; 6 | for (i = 0; i < 10; i++) 7 | vec.push_back(i); 8 | for (i = 0; i < 3; i++) 9 | vec.pop_back(); 10 | for (int val : vec) 11 | res += val; 12 | if (vec.size() == 9) 13 | return res; 14 | else 15 | return 0; 16 | } 17 | 18 | int main(int argc, char **argv) { 19 | std::vector vec; 20 | return func(vec); 21 | } -------------------------------------------------------------------------------- /FactGenerator/include/MalformedModule.hpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | [[noreturn]] static void malformedModule(const std::string &explanation) { 4 | std::cerr << "[error] Malformed LLVM module, " << explanation << std::endl; 5 | std::cerr << "[error] Try opt -disable-output -verify prog.bc" << std::endl; 6 | std::cerr << "[error] Or report a bug: " 7 | "https://github.com/GaloisInc/cclyzerpp/issues" 8 | << std::endl; 9 | std::exit(1); 10 | } 11 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | *argv-alloc[*] 8 2 | *argv-alloc[0] 8 3 | *argv[0]-alloc[*] 8 4 | *argv[0]-alloc[0] 8 5 | *global_alloc@.str.1 4 6 | *global_alloc@.str.1[*] 4 7 | *global_alloc@.str.1[*][*] 1 8 | *global_alloc@.str.1[0] 4 9 | *global_alloc@.str.1[0][*] 1 10 | *global_alloc@str 5 11 | *global_alloc@str[*] 5 12 | *global_alloc@str[*][*] 1 13 | *global_alloc@str[0] 5 14 | *global_alloc@str[0][*] 1 15 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | *argv-alloc[*] 8 2 | *argv-alloc[0] 8 3 | *argv[0]-alloc[*] 8 4 | *argv[0]-alloc[0] 8 5 | *global_alloc@.str.1 4 6 | *global_alloc@.str.1[*] 4 7 | *global_alloc@.str.1[*][*] 1 8 | *global_alloc@.str.1[0] 4 9 | *global_alloc@.str.1[0][*] 1 10 | *global_alloc@str 5 11 | *global_alloc@str[*] 5 12 | *global_alloc@str[*][*] 1 13 | *global_alloc@str[0] 5 14 | *global_alloc@str[0][*] 1 15 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | :@.str.2 *global_alloc@.str.2 4 | :@_ZSt4cout *global_alloc@_ZSt4cout 5 | :@_ZStL8__ioinit *global_alloc@_ZStL8__ioinit 6 | :@__dso_handle *global_alloc@__dso_handle 7 | :@llvm.global_ctors *global_alloc@llvm.global_ctors 8 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | :@.str.2 *global_alloc@.str.2 4 | :@_ZSt4cout *global_alloc@_ZSt4cout 5 | :@_ZStL8__ioinit *global_alloc@_ZStL8__ioinit 6 | :@__dso_handle *global_alloc@__dso_handle 7 | :@llvm.global_ctors *global_alloc@llvm.global_ctors 8 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | :@.str.2 *global_alloc@.str.2 4 | :@_ZSt4cout *global_alloc@_ZSt4cout 5 | :@_ZStL8__ioinit *global_alloc@_ZStL8__ioinit 6 | :@__dso_handle *global_alloc@__dso_handle 7 | :@llvm.global_ctors *global_alloc@llvm.global_ctors 8 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.global_allocation_by_variable.golden.csv: -------------------------------------------------------------------------------- 1 | :@.str *global_alloc@.str 2 | :@.str.1 *global_alloc@.str.1 3 | :@.str.2 *global_alloc@.str.2 4 | :@_ZSt4cout *global_alloc@_ZSt4cout 5 | :@_ZStL8__ioinit *global_alloc@_ZStL8__ioinit 6 | :@__dso_handle *global_alloc@__dso_handle 7 | :@llvm.global_ctors *global_alloc@llvm.global_ctors 8 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | *argv-alloc[*] 8 2 | *argv-alloc[0] 8 3 | *argv[0]-alloc[*] 8 4 | *argv[0]-alloc[0] 8 5 | *global_alloc@.str 4 6 | *global_alloc@.str.1 4 7 | *global_alloc@.str.1[*] 4 8 | *global_alloc@.str.1[*][*] 1 9 | *global_alloc@.str.1[0] 4 10 | *global_alloc@.str.1[0][*] 1 11 | *global_alloc@.str[*] 4 12 | *global_alloc@.str[*][*] 1 13 | *global_alloc@.str[0] 4 14 | *global_alloc@.str[0][*] 1 15 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.allocation_size.golden.csv: -------------------------------------------------------------------------------- 1 | *argv-alloc[*] 8 2 | *argv-alloc[0] 8 3 | *argv[0]-alloc[*] 8 4 | *argv[0]-alloc[0] 8 5 | *global_alloc@.str 4 6 | *global_alloc@.str.1 4 7 | *global_alloc@.str.1[*] 4 8 | *global_alloc@.str.1[*][*] 1 9 | *global_alloc@.str.1[0] 4 10 | *global_alloc@.str.1[0][*] 1 11 | *global_alloc@.str[*] 4 12 | *global_alloc@.str[*][*] 1 13 | *global_alloc@.str[0] 4 14 | *global_alloc@.str[0][*] 1 15 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc[0] *argv-alloc 3 | nil *argv[0]-alloc[0] *argv[0]-alloc 4 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 5 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 6 | nil *global_alloc@.str[0] *global_alloc@.str 7 | nil *global_alloc@.str[0][*] *global_alloc@.str[0] 8 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc[0] *argv-alloc 3 | nil *argv[0]-alloc[0] *argv[0]-alloc 4 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 5 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 6 | nil *global_alloc@.str[0] *global_alloc@.str 7 | nil *global_alloc@.str[0][*] *global_alloc@.str[0] 8 | -------------------------------------------------------------------------------- /test/c/underconstrained_symbolic_offset_read.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct data { 5 | uint32_t val; 6 | int array[10]; 7 | struct data *next; 8 | }; 9 | 10 | int func(struct data *d) { 11 | int a = d->array[d->next->val % 10]; // Symbolic offset read 12 | if (a == 42) 13 | d->next->val = 0; 14 | else 15 | d->next->val = 1; 16 | return d->val; 17 | } 18 | 19 | int main(int argc, char const *argv[]) { 20 | struct data foo = {}; 21 | return func(&foo); 22 | } -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :llvm.dbg.value [<>, nil] :main:0 2 | nil :llvm.dbg.value [<>, nil] :main:1 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:3 5 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :llvm.dbg.value [<>, nil] :main:0 2 | nil :llvm.dbg.value [<>, nil] :main:1 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:3 5 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :llvm.dbg.value [<>, nil] :main:0 2 | nil :llvm.dbg.value [<>, nil] :main:1 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:3 5 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :llvm.dbg.value [<>, nil] :main:0 2 | nil :llvm.dbg.value [<>, nil] :main:1 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:3 5 | -------------------------------------------------------------------------------- /test/c/underconstrained_complex_inheritance2.cpp: -------------------------------------------------------------------------------- 1 | class Abstract1 { 2 | public: 3 | int _b; 4 | char _d; 5 | }; 6 | 7 | class Abstract2 { 8 | public: 9 | int _a; 10 | char _c; 11 | }; 12 | 13 | class Value : public Abstract1, public Abstract2 { 14 | public: 15 | char _str[10]; 16 | }; 17 | 18 | int func(Value *value) { 19 | if (value->_a == value->_b) 20 | return 1; 21 | else 22 | return 0; 23 | } 24 | 25 | int main(int argc, char const *argv[]) { 26 | Value value; 27 | return func(&value); 28 | } -------------------------------------------------------------------------------- /datalog/import/import.dl: -------------------------------------------------------------------------------- 1 | // Try: mcpp -e utf8 -W0 -I "." datalog/import/import.dl 2 | // 3 | // GROUP_BEGIN, GROUP_END not needed 4 | #define GROUP_BEGIN(g) 5 | #define GROUP_END(group_end) 6 | // TODO(#42): Derive relation/file name from group + predicate name 7 | #define Q(x) #x 8 | #define QUOTE(x) Q(x) 9 | #define PREDICATE(g, p, f) .input f(IO="file", delimiter="\t", filename=QUOTE(f.csv.gz)) 10 | // TODO(lb): Maybe this should be accomplished with a -I to Souffle? 11 | #include "../../FactGenerator/include/predicates.inc" 12 | -------------------------------------------------------------------------------- /test/c/truncated-integer.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | __attribute__((noinline)) char *alloc_buffer(unsigned long alloc_size) { 5 | return new char[alloc_size]; 6 | } 7 | 8 | void print_truncated_alloc_size(int alloc_size) { 9 | std::cout << alloc_size << std::endl; 10 | } 11 | 12 | int main(int argc, char **argv) { 13 | unsigned long alloc_size; 14 | scanf("%lu", &alloc_size); 15 | char *buf = alloc_buffer(alloc_size); 16 | print_truncated_alloc_size(alloc_size); 17 | delete[] buf; 18 | } 19 | -------------------------------------------------------------------------------- /datalog/schema/asm.dl: -------------------------------------------------------------------------------- 1 | //---------------------- 2 | // Inline ASM 3 | //---------------------- 4 | 5 | // Inline ASM values do not need to be constants. The only reason it 6 | // is currently so, is so that we do not have to add yet another type 7 | // of operand (other than variable and constant). 8 | 9 | .type InlineASM = Constant 10 | .decl inline_asm(asm:InlineASM) 11 | 12 | constant(asm) :- inline_asm(asm). 13 | 14 | .decl inline_asm_text(asm:InlineASM, text:symbol) 15 | .decl inline_asm_constraints(asm:InlineASM, constraints:symbol) 16 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_may_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc *argv-alloc 2 | nil *argv-alloc *argv-alloc[0] 3 | nil *argv-alloc[0] *argv-alloc 4 | nil *argv-alloc[0] *argv-alloc[0] 5 | nil *argv[0]-alloc *argv[0]-alloc 6 | nil *argv[0]-alloc *argv[0]-alloc[0] 7 | nil *argv[0]-alloc[0] *argv[0]-alloc 8 | nil *argv[0]-alloc[0] *argv[0]-alloc[0] 9 | nil *global_alloc@global *global_alloc@global 10 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 11 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_may_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc *argv-alloc 2 | nil *argv-alloc *argv-alloc[0] 3 | nil *argv-alloc[0] *argv-alloc 4 | nil *argv-alloc[0] *argv-alloc[0] 5 | nil *argv[0]-alloc *argv[0]-alloc 6 | nil *argv[0]-alloc *argv[0]-alloc[0] 7 | nil *argv[0]-alloc[0] *argv[0]-alloc 8 | nil *argv[0]-alloc[0] *argv[0]-alloc[0] 9 | nil *global_alloc@global *global_alloc@global 10 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 11 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_must_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc *argv-alloc 2 | nil *argv-alloc *argv-alloc[0] 3 | nil *argv-alloc[0] *argv-alloc 4 | nil *argv-alloc[0] *argv-alloc[0] 5 | nil *argv[0]-alloc *argv[0]-alloc 6 | nil *argv[0]-alloc *argv[0]-alloc[0] 7 | nil *argv[0]-alloc[0] *argv[0]-alloc 8 | nil *argv[0]-alloc[0] *argv[0]-alloc[0] 9 | nil *global_alloc@global *global_alloc@global 10 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 11 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_must_alias_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc *argv-alloc 2 | nil *argv-alloc *argv-alloc[0] 3 | nil *argv-alloc[0] *argv-alloc 4 | nil *argv-alloc[0] *argv-alloc[0] 5 | nil *argv[0]-alloc *argv[0]-alloc 6 | nil *argv[0]-alloc *argv[0]-alloc[0] 7 | nil *argv[0]-alloc[0] *argv[0]-alloc 8 | nil *argv[0]-alloc[0] *argv[0]-alloc[0] 9 | nil *global_alloc@global *global_alloc@global 10 | nil *global_alloc@llvm.dbg.value *global_alloc@llvm.dbg.value 11 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.operand_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:0:0:@llvm.dbg.value 2 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:1:0:@llvm.dbg.value 3 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:2:0:@llvm.dbg.value 4 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:3:0:@llvm.dbg.value 5 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.operand_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:0:0:@llvm.dbg.value 2 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:1:0:@llvm.dbg.value 3 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:2:0:@llvm.dbg.value 4 | nil *global_alloc@llvm.dbg.value [<>, nil] :main:3:0:@llvm.dbg.value 5 | -------------------------------------------------------------------------------- /test/c/errno.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int changesErrno() { 5 | errno = -1; 6 | return 0; 7 | } 8 | 9 | int checksErrno() { 10 | int sc = changesErrno(); 11 | if (errno != 0) { 12 | printf("Error detected!\n"); 13 | } 14 | return sc; 15 | } 16 | 17 | int ignoresErrno() { 18 | int sc = changesErrno(); 19 | printf("Hahaha! I don't care. Not going to check the errno"); 20 | return sc; 21 | } 22 | 23 | int main(int argc, char *argv[]) { 24 | 25 | checksErrno(); 26 | ignoresErrno(); 27 | 28 | return 0; 29 | } -------------------------------------------------------------------------------- /test/c/struct-by-ptr.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct data { 5 | uint32_t val; 6 | int array[10]; 7 | struct data *next; 8 | }; 9 | 10 | int func(struct data *d) { 11 | d->array[1] = d->array[2]; // Read/write, simple indirection 12 | if (d->next->val % 2 == 0) // Double indirection variable access 13 | d->next->array[1] = 0; 14 | else 15 | d->next->array[1] = 1; 16 | return d->val; 17 | } 18 | 19 | int main(int argc, char const *argv[]) { 20 | struct data foo = {}; 21 | return func(&foo); 22 | } 23 | -------------------------------------------------------------------------------- /test/c/interprocedural_dataflow_test.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | int no_args_int_return() { return 3; } 7 | 8 | int bar(int x, int y) { 9 | if (y < 4) { 10 | return y; 11 | } 12 | return x; 13 | } 14 | 15 | int foo() { 16 | int x = no_args_int_return(); 17 | int y = no_args_int_return(); 18 | int result0 = bar(x, y); 19 | int w = x * 2; 20 | int z = y / 2; 21 | int result1 = bar(w, z); 22 | return std::min(result0, result1); 23 | } 24 | 25 | int main() { return foo(); } 26 | -------------------------------------------------------------------------------- /FactGenerator/include/Signatures.hpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | #include "ForwardingFactWriter.hpp" 9 | #include "PredicateGroups.hpp" 10 | 11 | auto preprocess_signatures(const boost::filesystem::path &signatures_path) 12 | -> std::vector>; 13 | 14 | void emit_signatures( 15 | cclyzer::ForwardingFactWriter &writer, 16 | const std::string &function_name, 17 | const llvm::json::Array &signatures); 18 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :countdown [<>, nil] :main:2 2 | nil :countdown nil :countdown:7 3 | nil :llvm.dbg.value [<>, nil] :main:0 4 | nil :llvm.dbg.value [<>, nil] :main:1 5 | nil :llvm.dbg.value nil :countdown:0 6 | nil :printf nil :countdown:5 7 | nil :puts nil :countdown:3 8 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :countdown [<>, nil] :main:2 2 | nil :countdown nil :countdown:7 3 | nil :llvm.dbg.value [<>, nil] :main:0 4 | nil :llvm.dbg.value [<>, nil] :main:1 5 | nil :llvm.dbg.value nil :countdown:0 6 | nil :printf nil :countdown:5 7 | nil :puts nil :countdown:3 8 | -------------------------------------------------------------------------------- /test/c/dangerous-vla.c: -------------------------------------------------------------------------------- 1 | /* Taken from http://phrack.org/issues/63/14.html, tweaked slightly to take 2 | * user input instead of argv. 3 | */ 4 | 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | int func(int len, char *stuff) { 12 | char x[len]; 13 | 14 | printf("sizeof(x): %zu\n", sizeof(x)); 15 | strncpy(x, stuff, 4); 16 | return 58; 17 | } 18 | 19 | int main(int argc, char **argv) { 20 | char input[64]; 21 | scanf("%c", input); 22 | return func(atoi(input), argv[1]); 23 | } 24 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :id:0 *stack_alloc@id[%struct.obj** %x.addr] 2 | :main:0 *stack_alloc@main[i32* %retval] 3 | :main:1 *stack_alloc@main[%struct.obj** %a] 4 | :main:2 *stack_alloc@main[%struct.obj** %b] 5 | :main:3 *stack_alloc@main[%struct.obj** %c] 6 | :main:4 *stack_alloc@main[%struct.obj** %d] 7 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :id:0 *stack_alloc@id[%struct.obj** %x.addr] 2 | :main:0 *stack_alloc@main[i32* %retval] 3 | :main:1 *stack_alloc@main[%struct.obj** %a] 4 | :main:2 *stack_alloc@main[%struct.obj** %b] 5 | :main:3 *stack_alloc@main[%struct.obj** %c] 6 | :main:4 *stack_alloc@main[%struct.obj** %d] 7 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :countdown [<>, nil] :main:2 2 | nil :countdown nil :countdown:7 3 | nil :llvm.dbg.value [<>, nil] :main:0 4 | nil :llvm.dbg.value [<>, nil] :main:1 5 | nil :llvm.dbg.value nil :countdown:0 6 | nil :printf nil :countdown:5 7 | nil :puts nil :countdown:3 8 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | nil :countdown [<>, nil] :main:2 2 | nil :countdown nil :countdown:7 3 | nil :llvm.dbg.value [<>, nil] :main:0 4 | nil :llvm.dbg.value [<>, nil] :main:1 5 | nil :llvm.dbg.value nil :countdown:0 6 | nil :printf nil :countdown:5 7 | nil :puts nil :countdown:3 8 | -------------------------------------------------------------------------------- /test/c/underconstrained_silent_oob_write.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct data { 5 | unsigned int val; 6 | char array[10]; 7 | struct data *next; 8 | }; 9 | 10 | int func(struct data *d) { 11 | // Write 42 at symbolic offset 12 | // This access can overwrite the 'next' field but 13 | // doesn't exceed the object bounds 14 | d->array[d->next->val % 18] = 42; 15 | return d->next->next->val; // d->next could be invalid now 16 | } 17 | 18 | int main(int argc, char const *argv[]) { 19 | struct data foo = {}; 20 | return func(&foo); 21 | } -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i32* %retval] 2 | :main:1 *stack_alloc@main[i32* %argc.addr] 3 | :main:2 *stack_alloc@main[i8*** %argv.addr] 4 | :main:3 *stack_alloc@main[%"class.std::__cxx11::basic_string"* %foo] 5 | :main:4 *stack_alloc@main[%"class.std::allocator"* %ref.tmp] 6 | :main:5 *stack_alloc@main[i8** %exn.slot] 7 | :main:6 *stack_alloc@main[i32* %ehselector.slot] 8 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i32* %retval] 2 | :main:1 *stack_alloc@main[i32* %argc.addr] 3 | :main:2 *stack_alloc@main[i8*** %argv.addr] 4 | :main:3 *stack_alloc@main[%"class.std::__cxx11::basic_string"* %foo] 5 | :main:4 *stack_alloc@main[%"class.std::allocator"* %ref.tmp] 6 | :main:5 *stack_alloc@main[i8** %exn.slot] 7 | :main:6 *stack_alloc@main[i32* %ehselector.slot] 8 | -------------------------------------------------------------------------------- /test/c/mmap.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #define SIZE 8 5 | 6 | int main(int argc, char **argv) { 7 | char *buf = mmap(0, // starting address hint 8 | SIZE, // size = 8 bytes 9 | PROT_READ // can be read 10 | | PROT_WRITE, // can be written 11 | MAP_ANONYMOUS, // not file-backed, zero-initialized 12 | 0, 0); 13 | for (int i = 0; i < SIZE; i++) { 14 | putchar(buf[i]); 15 | } 16 | return munmap(buf, SIZE); 17 | } 18 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z2idP3obj:0 *stack_alloc@_Z2idP3obj[%struct.obj** %x.addr] 2 | :main:0 *stack_alloc@main[i32* %retval] 3 | :main:1 *stack_alloc@main[%struct.obj** %a] 4 | :main:2 *stack_alloc@main[%struct.obj** %b] 5 | :main:3 *stack_alloc@main[%struct.obj** %c] 6 | :main:4 *stack_alloc@main[%struct.obj** %d] 7 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :_Z2idP3obj:0 *stack_alloc@_Z2idP3obj[%struct.obj** %x.addr] 2 | :main:0 *stack_alloc@main[i32* %retval] 3 | :main:1 *stack_alloc@main[%struct.obj** %a] 4 | :main:2 *stack_alloc@main[%struct.obj** %b] 5 | :main:3 *stack_alloc@main[%struct.obj** %c] 6 | :main:4 *stack_alloc@main[%struct.obj** %d] 7 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i32* %argc.addr] [<>, nil] :main:%argc.addr 2 | [<>, nil] *stack_alloc@main[i32* %retval] [<>, nil] :main:%retval 3 | [<>, nil] *stack_alloc@main[i8*** %argv.addr] [<>, nil] :main:%argv.addr 4 | nil *argv-alloc [<>, nil] :main:%argv 5 | nil *stack_alloc@countdown[i32* %x.addr] nil :countdown:%x.addr 6 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i32* %argc.addr] [<>, nil] :main:%argc.addr 2 | [<>, nil] *stack_alloc@main[i32* %retval] [<>, nil] :main:%retval 3 | [<>, nil] *stack_alloc@main[i8*** %argv.addr] [<>, nil] :main:%argv.addr 4 | nil *argv-alloc [<>, nil] :main:%argv 5 | nil *stack_alloc@countdown[i32* %x.addr] nil :countdown:%x.addr 6 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | nil *global_alloc@__const.main.table[*] [<>, nil] :main:%arrayidx 3 | nil *global_alloc@__const.main.table[0][*] [<>, nil] :main:%arrayidx 4 | nil *global_alloc@bar [<>, nil] :main:%0 5 | nil *global_alloc@baz [<>, nil] :main:%0 6 | nil *global_alloc@foo [<>, nil] :main:%0 7 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.var_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] :main:%argv 2 | nil *global_alloc@__const.main.table[*] [<>, nil] :main:%arrayidx 3 | nil *global_alloc@__const.main.table[0][*] [<>, nil] :main:%arrayidx 4 | nil *global_alloc@bar [<>, nil] :main:%0 5 | nil *global_alloc@baz [<>, nil] :main:%0 6 | nil *global_alloc@foo [<>, nil] :main:%0 7 | -------------------------------------------------------------------------------- /test/c/issue_1137.c: -------------------------------------------------------------------------------- 1 | /* This is a regression case for MATE#1137. 2 | * Ref: https://gitlab-ext.galois.com/mate/MATE/-/issues/1137 3 | */ 4 | 5 | #include 6 | #include 7 | 8 | struct foo { 9 | int n; 10 | int things[0]; 11 | }; 12 | 13 | int main(int argc, char const *argv[]) { 14 | int n = getchar(); 15 | if (n <= 0) { 16 | return 1; 17 | } 18 | 19 | struct foo *flexible = malloc(sizeof(struct foo) + (n * sizeof(int))); 20 | 21 | flexible->n = n; 22 | for (int i = 0; i < n; ++i) { 23 | flexible->things[i] = i; 24 | } 25 | 26 | return flexible->things[n - 1]; 27 | } 28 | -------------------------------------------------------------------------------- /test/c/simple-uaf.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | struct List { 4 | explicit List(int data) : data(data), next(nullptr) {} 5 | List(int data, List *next) : data(data), next(next) {} 6 | int data; 7 | List *next; 8 | }; 9 | 10 | int main(int argc, char *argv[]) { 11 | int a = 1, b = 2, c = 3; 12 | 13 | List *elem1 = new List(a); 14 | List *elem2 = new List(b, elem1); 15 | List *head = new List(c, elem2); 16 | 17 | delete head->next; 18 | 19 | List *iter = head; 20 | while (iter) { 21 | std::cout << iter->data << std::endl; 22 | iter = iter->next; 23 | } 24 | 25 | return 0; 26 | } 27 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i32 :main:22 *typed_heap_alloc@main[i32* %call3] 2 | i32 :main:25 *typed_heap_alloc@main[i32* %call4] 3 | i32 :main:28 *typed_heap_alloc@main[i32* %call7] 4 | i8 :main:22 *typed_heap_alloc@main[i8* %call3] 5 | i8 :main:25 *typed_heap_alloc@main[i8* %call4] 6 | i8 :main:28 *typed_heap_alloc@main[i8* %call7] 7 | i8 :main:9 *typed_heap_alloc@main[i8* %call2] 8 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i32 :main:22 *typed_heap_alloc@main[i32* %call3] 2 | i32 :main:25 *typed_heap_alloc@main[i32* %call4] 3 | i32 :main:28 *typed_heap_alloc@main[i32* %call7] 4 | i8 :main:22 *typed_heap_alloc@main[i8* %call3] 5 | i8 :main:25 *typed_heap_alloc@main[i8* %call4] 6 | i8 :main:28 *typed_heap_alloc@main[i8* %call7] 7 | i8 :main:9 *typed_heap_alloc@main[i8* %call2] 8 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc[0] *argv-alloc 3 | nil *argv[0]-alloc[0] *argv[0]-alloc 4 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 5 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 6 | nil *global_alloc@.str.2[0] *global_alloc@.str.2 7 | nil *global_alloc@.str.2[0][*] *global_alloc@.str.2[0] 8 | nil *global_alloc@.str[0] *global_alloc@.str 9 | nil *global_alloc@.str[0][*] *global_alloc@.str[0] 10 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc[0] *argv-alloc 3 | nil *argv[0]-alloc[0] *argv[0]-alloc 4 | nil *global_alloc@.str.1[0] *global_alloc@.str.1 5 | nil *global_alloc@.str.1[0][*] *global_alloc@.str.1[0] 6 | nil *global_alloc@.str.2[0] *global_alloc@.str.2 7 | nil *global_alloc@.str.2[0][*] *global_alloc@.str.2[0] 8 | nil *global_alloc@.str[0] *global_alloc@.str 9 | nil *global_alloc@.str[0][*] *global_alloc@.str[0] 10 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:countdown:6, nil] :printf nil :countdown:6 2 | [:countdown:9, nil] :printf nil :countdown:9 3 | nil :countdown [<>, nil] :main:8 4 | nil :countdown nil :countdown:12 5 | nil :llvm.dbg.declare [<>, nil] :main:5 6 | nil :llvm.dbg.declare [<>, nil] :main:7 7 | nil :llvm.dbg.declare nil :countdown:2 8 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:countdown:6, nil] :printf nil :countdown:6 2 | [:countdown:9, nil] :printf nil :countdown:9 3 | nil :countdown [<>, nil] :main:8 4 | nil :countdown nil :countdown:12 5 | nil :llvm.dbg.declare [<>, nil] :main:5 6 | nil :llvm.dbg.declare [<>, nil] :main:7 7 | nil :llvm.dbg.declare nil :countdown:2 8 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:countdown:6, nil] :printf nil :countdown:6 2 | [:countdown:9, nil] :printf nil :countdown:9 3 | nil :countdown [<>, nil] :main:8 4 | nil :countdown nil :countdown:12 5 | nil :llvm.dbg.declare [<>, nil] :main:5 6 | nil :llvm.dbg.declare [<>, nil] :main:7 7 | nil :llvm.dbg.declare nil :countdown:2 8 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:countdown:6, nil] :printf nil :countdown:6 2 | [:countdown:9, nil] :printf nil :countdown:9 3 | nil :countdown [<>, nil] :main:8 4 | nil :countdown nil :countdown:12 5 | nil :llvm.dbg.declare [<>, nil] :main:5 6 | nil :llvm.dbg.declare [<>, nil] :main:7 7 | nil :llvm.dbg.declare nil :countdown:2 8 | -------------------------------------------------------------------------------- /test/c/global.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int global = 42; 4 | 5 | int reads_global(int) __attribute__((noinline)); 6 | int reads_global(int x) { return x + global; } 7 | 8 | char reads_global_cast(char) __attribute__((noinline)); 9 | char reads_global_cast(char x) { return x + (char)global; } 10 | 11 | int writes_global(int) __attribute__((noinline)); 12 | int writes_global(int x) { 13 | global = global + x; 14 | return global; 15 | } 16 | 17 | int main() { 18 | int env = atoi(getenv("ENV")); 19 | global = env; 20 | return reads_global(env) ^ ((int)reads_global_cast((char)env)) ^ 21 | writes_global(env); 22 | } 23 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 3 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr] 4 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 5 | nil *argv[0]-alloc nil *argv-alloc 6 | nil *argv[0]-alloc nil *argv-alloc[0] 7 | nil *argv[0]-alloc[0] nil *argv-alloc 8 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 9 | nil *unknown* nil *unknown* 10 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 3 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr] 4 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 5 | nil *argv[0]-alloc nil *argv-alloc 6 | nil *argv[0]-alloc nil *argv-alloc[0] 7 | nil *argv[0]-alloc[0] nil *argv-alloc 8 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 9 | nil *unknown* nil *unknown* 10 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 3 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr] 4 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 5 | nil *argv[0]-alloc nil *argv-alloc 6 | nil *argv[0]-alloc nil *argv-alloc[0] 7 | nil *argv[0]-alloc[0] nil *argv-alloc 8 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 9 | nil *unknown* nil *unknown* 10 | -------------------------------------------------------------------------------- /test/gold/recurse.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 3 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr] 4 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 5 | nil *argv[0]-alloc nil *argv-alloc 6 | nil *argv[0]-alloc nil *argv-alloc[0] 7 | nil *argv[0]-alloc[0] nil *argv-alloc 8 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 9 | nil *unknown* nil *unknown* 10 | -------------------------------------------------------------------------------- /test/c/ex_symb_index.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int oob(int index) { 5 | // This function has an out of bounds index read in the SECRET variable 6 | // printf("Passed index: %d\n", index); 7 | char SECRET[25]; 8 | return (int)(SECRET[index]); 9 | } 10 | 11 | int main(int argc, char **argv) { 12 | if (argc != 2) { 13 | printf("Usage: %s ", argv[0]); 14 | return -1; 15 | } 16 | 17 | int o = atoi(argv[1]); 18 | // printf("Converted index: %d\n", o); 19 | 20 | // A 0 means error, so just don't let user enter 0 21 | if (o != 0) { 22 | return oob(o); 23 | } 24 | return -1; 25 | } 26 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *global_alloc@bar nil *global_alloc@__const.main.table[0][1] 6 | nil *global_alloc@baz nil *global_alloc@__const.main.table[0][2] 7 | nil *global_alloc@foo nil *global_alloc@__const.main.table 8 | nil *global_alloc@foo nil *global_alloc@__const.main.table[0] 9 | nil *global_alloc@foo nil *global_alloc@__const.main.table[0][0] 10 | nil *unknown* nil *unknown* 11 | -------------------------------------------------------------------------------- /test/gold/functiontable.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *global_alloc@bar nil *global_alloc@__const.main.table[0][1] 6 | nil *global_alloc@baz nil *global_alloc@__const.main.table[0][2] 7 | nil *global_alloc@foo nil *global_alloc@__const.main.table 8 | nil *global_alloc@foo nil *global_alloc@__const.main.table[0] 9 | nil *global_alloc@foo nil *global_alloc@__const.main.table[0][0] 10 | nil *unknown* nil *unknown* 11 | -------------------------------------------------------------------------------- /FactGenerator/include/ParseException.hpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | 6 | class ParseException : public std::exception { 7 | std::string err_msg; 8 | 9 | public: 10 | ParseException(const boost::filesystem::path& inputFile) { 11 | std::ostringstream msg; 12 | 13 | // Construct error message 14 | msg << "Failed to parse " << inputFile; 15 | err_msg = msg.str(); 16 | } 17 | 18 | ~ParseException() noexcept override = default; 19 | 20 | [[nodiscard]] auto what() const noexcept -> const char* override { 21 | return err_msg.c_str(); 22 | } 23 | }; 24 | -------------------------------------------------------------------------------- /test/c/deadcode.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | int x = 100; 25 | 26 | if (false) { 27 | x = 1000; 28 | } 29 | 30 | printf("foo x=%d\n", x); 31 | return 0; 32 | } 33 | -------------------------------------------------------------------------------- /test/c/issue_1522.cpp: -------------------------------------------------------------------------------- 1 | /* This is a regression case for MATE#1522. 2 | * Ref: https://gitlab-ext.galois.com/mate/MATE/-/issues/1522 3 | */ 4 | 5 | class Abstract { 6 | public: 7 | virtual int a() = 0; 8 | virtual int b() = 0; 9 | virtual const char *str() = 0; 10 | }; 11 | 12 | class Value : public Abstract { 13 | private: 14 | int _a, _b; 15 | char _str[10]; 16 | 17 | public: 18 | Value() : _a(1), _b(2){}; 19 | ~Value() = default; 20 | virtual int a() { return _a; }; 21 | virtual int b() { return _b; }; 22 | virtual char *str() { return _str; }; 23 | }; 24 | 25 | [[clang::optnone]] int main(int argc, char const *argv[]) { 26 | Value v; 27 | return v.a(); 28 | } 29 | -------------------------------------------------------------------------------- /FactGenerator/src/PredicateGroups.cpp: -------------------------------------------------------------------------------- 1 | // Try: gcc -I include -E src/PredicateGroups.cpp 2 | 3 | #include "PredicateGroups.hpp" 4 | 5 | namespace cclyzer::predicates { 6 | // Define the predicates 7 | 8 | // GROUP_BEGIN, GROUP_END not needed 9 | #define GROUP_BEGIN(g) 10 | #define GROUP_END(group_end) 11 | #define PREDICATE(g, p, f) pred_t g::p(#f); 12 | #include "predicates.inc" 13 | 14 | // Register the predicates 15 | 16 | // GROUP_BEGIN, GROUP_END not needed 17 | #define GROUP_BEGIN(g) 18 | #define GROUP_END(group_end) 19 | #define PREDICATE(g, p, f) &g::p, 20 | 21 | Registry const predicates_reg({ 22 | #include "predicates.inc" 23 | }); 24 | } // namespace cclyzer::predicates 25 | -------------------------------------------------------------------------------- /datalog/export/subset.dl: -------------------------------------------------------------------------------- 1 | .output subset.callgraph.callgraph_edge (compress=true) 2 | .output subset.var_points_to (compress=true) 3 | .output subset.ptr_points_to (compress=true) 4 | .output subset.operand_points_to (compress=true) 5 | .output subset_lift.allocation_size_ctx (compress=true) 6 | .output subset_lift.alloc_must_alias_ctx (compress=true) 7 | .output subset_lift.alloc_may_alias_ctx (compress=true) 8 | .output subset_lift.alloc_subregion_ctx (compress=true) 9 | .output subset_lift.alloc_contains_ctx (compress=true) 10 | .output subset_lift.allocation_by_instr_ctx (compress=true) 11 | .output global_allocation_by_variable (compress=true) 12 | .output context_to_string (compress=true) 13 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i32 :main:17 *typed_heap_alloc@main[i32* %call2] 2 | i32 :main:31 *typed_heap_alloc@main[i32* %call3] 3 | i32 :main:35 *typed_heap_alloc@main[i32* %call4] 4 | i32 :main:42 *typed_heap_alloc@main[i32* %call7] 5 | i8 :main:17 *typed_heap_alloc@main[i8* %call2] 6 | i8 :main:31 *typed_heap_alloc@main[i8* %call3] 7 | i8 :main:35 *typed_heap_alloc@main[i8* %call4] 8 | i8 :main:42 *typed_heap_alloc@main[i8* %call7] 9 | -------------------------------------------------------------------------------- /test/gold/allocation-sizes.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.heap_allocation_by_type_instr.golden.csv: -------------------------------------------------------------------------------- 1 | i32 :main:17 *typed_heap_alloc@main[i32* %call2] 2 | i32 :main:31 *typed_heap_alloc@main[i32* %call3] 3 | i32 :main:35 *typed_heap_alloc@main[i32* %call4] 4 | i32 :main:42 *typed_heap_alloc@main[i32* %call7] 5 | i8 :main:17 *typed_heap_alloc@main[i8* %call2] 6 | i8 :main:31 *typed_heap_alloc@main[i8* %call3] 7 | i8 :main:35 *typed_heap_alloc@main[i8* %call4] 8 | i8 :main:42 *typed_heap_alloc@main[i8* %call7] 9 | -------------------------------------------------------------------------------- /test/c/deadcode2.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | int check = 1 & 0; 25 | int x = 100; 26 | 27 | if (check) { 28 | x = 1000; 29 | } 30 | 31 | printf("foo x=%d\n", x); 32 | return 0; 33 | } 34 | -------------------------------------------------------------------------------- /test/c/points-to_new-context.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | struct obj { 4 | int field1; 5 | int field2; 6 | }; 7 | 8 | struct obj global_obj; 9 | 10 | struct obj *id(struct obj *x) { 11 | return x; 12 | } 13 | 14 | struct obj *fun1() { 15 | return id(new struct obj); 16 | } 17 | 18 | struct obj *fun2() { 19 | return id(new struct obj); 20 | } 21 | 22 | struct obj *fun3() { 23 | return id(&global_obj); 24 | } 25 | 26 | struct obj *fun4() { 27 | return id(&global_obj); 28 | } 29 | 30 | int main() { 31 | struct obj *a = fun1(); 32 | struct obj *b = fun2(); 33 | struct obj *c = fun3(); 34 | struct obj *d = fun4(); 35 | return a->field1 + b->field1 + c->field1 + d->field1; 36 | } 37 | -------------------------------------------------------------------------------- /test/c/underconstrained_virtual_method.cpp: -------------------------------------------------------------------------------- 1 | 2 | 3 | class Abstract { 4 | public: 5 | virtual int a() = 0; 6 | virtual int b() = 0; 7 | virtual const char *str() = 0; 8 | }; 9 | 10 | class Value : public Abstract { 11 | private: 12 | int _a, _b; 13 | char _str[10]; 14 | 15 | public: 16 | Value() : _a(1), _b(2){}; 17 | ~Value() = default; 18 | virtual int a() { return _a; }; 19 | virtual int b() { return _b; }; 20 | virtual char *str() { return _str; }; 21 | }; 22 | 23 | int func(Value *value) { 24 | if (value->a() == value->b()) 25 | return 1; 26 | else 27 | return 0; 28 | } 29 | 30 | int main(int argc, char const *argv[]) { 31 | Value value; 32 | return func(&value); 33 | } -------------------------------------------------------------------------------- /test/c/oob-write.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | uint32_t x, y = 0; 25 | uint64_t src = 0xFF00FF00FF00FF00; 26 | 27 | memcpy(&x, &src, sizeof(src)); 28 | printf("x=0x%08x, y=0x%08x\n", x, y); 29 | return 0; 30 | } 31 | -------------------------------------------------------------------------------- /test/c/sql_injection.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int main() { 4 | 5 | char user_input[100]; 6 | fgets(user_input, 100, stdin); 7 | 8 | char q1[200]; 9 | sprintf(q1, "SELECT username FROM users WHERE username = '%s';", user_input); 10 | 11 | // the POI shouldn't find this string after #528 12 | // https://gitlab-ext.galois.com/mate/MATE/-/issues/528 13 | sprintf(q1, "this is just a sentence that has the word SELECT in it '%s';", 14 | user_input); 15 | 16 | // intentionally put some invalid unicode in there, to make sure it 17 | // doesn't choke up our analysis 18 | char q2[200]; 19 | sprintf(q2, "DROP user WHERE username = '\xff%s\xff';", user_input); 20 | 21 | return 0; 22 | } 23 | -------------------------------------------------------------------------------- /test/c/virtual-multiple-inheritance.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | #define COINFLIP() (rand() % 2) 5 | 6 | class B1 { 7 | public: 8 | virtual ~B1() {} 9 | void f0() {} 10 | virtual void f1() {} 11 | int int_in_b1; 12 | }; 13 | 14 | class B2 { 15 | public: 16 | virtual ~B2() {} 17 | virtual void f2() {} 18 | int int_in_b2; 19 | }; 20 | 21 | class D : public B1, public B2 { 22 | public: 23 | void d() {} 24 | void f2() override {} 25 | int int_in_d; 26 | }; 27 | 28 | int main(int argc, char const *argv[]) { 29 | if (COINFLIP()) { 30 | B2 b2{}; 31 | printf("%p\n", &b2); 32 | } else { 33 | D d{}; 34 | printf("%p\n", &d); 35 | } 36 | 37 | return 0; 38 | } 39 | -------------------------------------------------------------------------------- /doc/Makefile: -------------------------------------------------------------------------------- 1 | # Minimal makefile for Sphinx documentation 2 | # 3 | 4 | # You can set these variables from the command line, and also 5 | # from the environment for the first two. 6 | SPHINXOPTS ?= 7 | SPHINXBUILD ?= sphinx-build 8 | SOURCEDIR = . 9 | BUILDDIR = build 10 | 11 | # Put it first so that "make" without argument is like "make help". 12 | help: 13 | @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) 14 | 15 | .PHONY: help Makefile 16 | 17 | # Catch-all target: route all unknown targets to Sphinx using the new 18 | # "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS). 19 | %: Makefile 20 | @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) 21 | -------------------------------------------------------------------------------- /test/c/struct_bounds.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | // This number is chosen because it's the largest 1 digit integer 5 | #define BUFFER_SIZE 9 6 | 7 | int overflow_field(int index) { 8 | struct authentication { 9 | char buffer[BUFFER_SIZE]; 10 | int authenticated; 11 | // This will catch in-struct accesses of two digit inputs 12 | char catch_buffer[100]; 13 | } auth; 14 | // This function has an out of bounds index read in the auth.buffer 15 | return (int)auth.buffer[index]; 16 | } 17 | 18 | int main(int argc, char **argv) { 19 | if (argc != 2) { 20 | printf("Usage: %s ", argv[0]); 21 | return 1; 22 | } 23 | 24 | return overflow_field(atoi(argv[1])); 25 | } 26 | -------------------------------------------------------------------------------- /test/c/simple-uaf-read.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | typedef struct list list_t; 5 | typedef struct list { 6 | void *data; 7 | list_t *next; 8 | } list_t; 9 | 10 | int main(int argc, char const *argv[]) { 11 | int a = 1, b = 2, c = 3; 12 | list_t *head = malloc(sizeof(list_t)); 13 | 14 | head->data = &c; 15 | head->next = malloc(sizeof(list_t)); 16 | head->next->data = &b; 17 | head->next->next = malloc(sizeof(list_t)); 18 | head->next->next->data = &a; 19 | head->next->next->next = NULL; 20 | free(head->next); 21 | 22 | list_t *iter = head; 23 | while (iter != NULL) { 24 | printf("%d\n", *(int *)iter->data); 25 | iter = iter->next; 26 | } 27 | 28 | return 0; 29 | } 30 | -------------------------------------------------------------------------------- /test/c/nested_structs.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | // This number is chosen because it's the largest 1 digit integer 5 | #define BUFFER_SIZE 9 6 | 7 | struct nested { 8 | char buf[20]; 9 | char large[100]; 10 | }; 11 | 12 | int overflow_field(int index) { 13 | struct authentication { 14 | char buffer[BUFFER_SIZE]; 15 | int authenticated; 16 | struct nested nest; 17 | } auth; 18 | // This function has an out of bounds index read in the auth.buffer 19 | return (int)auth.buffer[index]; 20 | } 21 | 22 | int main(int argc, char **argv) { 23 | if (argc != 2) { 24 | printf("Usage: %s ", argv[0]); 25 | return 1; 26 | } 27 | 28 | return overflow_field(atoi(argv[1])); 29 | } 30 | -------------------------------------------------------------------------------- /test/c/underconstrained_symbolic_offset_write.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct data { 5 | unsigned int val; 6 | char array[10]; 7 | struct data *next; 8 | }; 9 | 10 | int func(struct data *d) { 11 | int i; 12 | // Init array to zeros 13 | for (i = 0; i < 10; i++) 14 | d->array[i] = 0; 15 | // Write 42 at symbolic offset 16 | d->array[d->next->val % 10] = 42; // Symbolic offset write 17 | if (d->array[6] == 42) // Branch depends on symbolic write 18 | d->next->val = 0; 19 | else 20 | d->next->val = 1; 21 | return d->next->next->val; // Triple dereference 22 | } 23 | 24 | int main(int argc, char const *argv[]) { 25 | struct data foo = {}; 26 | return func(&foo); 27 | } -------------------------------------------------------------------------------- /test/c/simple-uaf-write.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | typedef struct list list_t; 5 | typedef struct list { 6 | void *data; 7 | list_t *next; 8 | } list_t; 9 | 10 | int main(int argc, char const *argv[]) { 11 | int a = 1, b = 2, c = 3, d = 100; 12 | list_t *head = malloc(sizeof(list_t)); 13 | 14 | head->data = &a; 15 | head->next = malloc(sizeof(list_t)); 16 | 17 | head->next->data = &b; 18 | head->next->next = malloc(sizeof(list_t)); 19 | 20 | head->next->next->data = &c; 21 | head->next->next->next = NULL; 22 | 23 | free(head->next->next); 24 | 25 | list_t *iter = head; 26 | while (iter != NULL) { 27 | iter->data = &d; 28 | iter = iter->next; 29 | } 30 | 31 | return 0; 32 | } 33 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :bar:0 *stack_alloc@bar[i32* %x.addr] 2 | :foo:0 *stack_alloc@foo[i32* %x.addr] 3 | :foo:1 *stack_alloc@foo[i32* %a] 4 | :foo:2 *stack_alloc@foo[i32* %b] 5 | :main:0 *stack_alloc@main[i32* %retval] 6 | :main:1 *stack_alloc@main[i32* %argc.addr] 7 | :main:2 *stack_alloc@main[i8*** %argv.addr] 8 | :main:3 *stack_alloc@main[i32* %a] 9 | :main:4 *stack_alloc@main[i32* %b] 10 | :main:5 *stack_alloc@main[i32* %c] 11 | :main:6 *stack_alloc@main[i32* %d] 12 | :main:7 *stack_alloc@main[i32* %e] 13 | -------------------------------------------------------------------------------- /test/gold/cfg-test.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :bar:0 *stack_alloc@bar[i32* %x.addr] 2 | :foo:0 *stack_alloc@foo[i32* %x.addr] 3 | :foo:1 *stack_alloc@foo[i32* %a] 4 | :foo:2 *stack_alloc@foo[i32* %b] 5 | :main:0 *stack_alloc@main[i32* %retval] 6 | :main:1 *stack_alloc@main[i32* %argc.addr] 7 | :main:2 *stack_alloc@main[i8*** %argv.addr] 8 | :main:3 *stack_alloc@main[i32* %a] 9 | :main:4 *stack_alloc@main[i32* %b] 10 | :main:5 *stack_alloc@main[i32* %c] 11 | :main:6 *stack_alloc@main[i32* %d] 12 | :main:7 *stack_alloc@main[i32* %e] 13 | -------------------------------------------------------------------------------- /test/c/ex_simple.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | int bar(int c) { 5 | if (c > 50) { 6 | printf("secret is greater than 50\n"); 7 | return -3; 8 | } 9 | printf("Hooray! Secret is less than or equal to 50\n"); 10 | return c; 11 | } 12 | 13 | int foo(int b) { 14 | if (b < 0) { 15 | return -1; 16 | } else if (b < 5) { 17 | printf("num is less than 5\n"); 18 | return -2; 19 | } else { 20 | printf("num is greater than or equal to 5\n"); 21 | int t = bar(b * 8); 22 | return t; 23 | } 24 | } 25 | 26 | int main(int argc, char **argv) { 27 | if (argc != 2) { 28 | printf("usage: ./prog num\n"); 29 | exit(1); 30 | } 31 | 32 | int num = atoi(argv[1]); 33 | return (foo(num)); 34 | } 35 | -------------------------------------------------------------------------------- /test/c/points-to_malloc-context.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | struct obj { 4 | int field1; 5 | int field2; 6 | }; 7 | 8 | struct obj global_obj; 9 | 10 | struct obj *id(struct obj *x) { 11 | return x; 12 | } 13 | 14 | struct obj *fun1() { 15 | return id((struct obj *)malloc(sizeof(struct obj))); 16 | } 17 | 18 | struct obj *fun2() { 19 | return id((struct obj *)malloc(sizeof(struct obj))); 20 | } 21 | 22 | struct obj *fun3() { 23 | return id(&global_obj); 24 | } 25 | 26 | struct obj *fun4() { 27 | return id(&global_obj); 28 | } 29 | 30 | int main() { 31 | struct obj *a = fun1(); 32 | struct obj *b = fun2(); 33 | struct obj *c = fun3(); 34 | struct obj *d = fun4(); 35 | return a->field1 + b->field1 + c->field1 + d->field1; 36 | } 37 | -------------------------------------------------------------------------------- /test/c/varargs.c: -------------------------------------------------------------------------------- 1 | // https://www.gnu.org/software/libc/manual/html_node/Variadic-Example.html#Variadic-Example 2 | #include 3 | #include 4 | 5 | int add_em_up(int count, ...) { 6 | va_list ap; 7 | int i, sum; 8 | 9 | va_start(ap, count); /* Initialize the argument list. */ 10 | 11 | sum = 0; 12 | for (i = 0; i < count; i++) 13 | sum += va_arg(ap, int); /* Get the next argument value. */ 14 | 15 | va_end(ap); /* Clean up. */ 16 | return sum; 17 | } 18 | 19 | int main(void) { 20 | printf("%d\n", add_em_up(3, 5, 5, 6)); 21 | printf("%d\n", add_em_up(10, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10)); 22 | 23 | typeof(add_em_up) *add_em_up_ptr = add_em_up; 24 | printf("%d\n", add_em_up_ptr(4, 1, 2, 3, 4)); 25 | return 0; 26 | } 27 | -------------------------------------------------------------------------------- /datalog/export/unification.dl: -------------------------------------------------------------------------------- 1 | .output unification.callgraph.callgraph_edge (compress=true) 2 | .output unification.var_points_to_final (compress=true) 3 | .output unification.ptr_points_to_final (compress=true) 4 | .output unification.operand_points_to_final (compress=true) 5 | .output unification_lift.allocation_size_ctx (compress=true) 6 | .output unification_lift.alloc_must_alias_ctx (compress=true) 7 | .output unification_lift.alloc_may_alias_ctx (compress=true) 8 | .output unification_lift.alloc_subregion_ctx (compress=true) 9 | .output unification_lift.alloc_contains_ctx (compress=true) 10 | .output unification_lift.allocation_by_instr_ctx (compress=true) 11 | .output global_allocation_by_variable (compress=true) 12 | .output context_to_string (compress=true) 13 | -------------------------------------------------------------------------------- /test/c/cxxbasic.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | std::string foo = "bar"; 25 | 26 | if (COINFLIP()) { 27 | std::cout << "foo=" << foo << '\n'; 28 | } else { 29 | foo = "baz"; 30 | } 31 | 32 | std::cout << "foo=" << foo << '\n'; 33 | 34 | return 0; 35 | } 36 | -------------------------------------------------------------------------------- /datalog/points-to/types.dl: -------------------------------------------------------------------------------- 1 | // A number of bytes, generally a size 2 | .type Bytes <: number 3 | 4 | // A line number in a source file 5 | .type LineNumber <: number 6 | 7 | // A column number in a source file 8 | .type ColumnNumber <: number 9 | 10 | // Name of a func 11 | .type FunctionName <: symbol 12 | 13 | // Name of a global variable 14 | .type GlobalVarName <: symbol 15 | 16 | .type GlobalName 17 | = FunctionName 18 | | GlobalVarName 19 | 20 | // An index in a getelementptr 21 | .type GepIndex <: number 22 | 23 | // An index into an array, e.g. in a getelementptr instr 24 | .type ArrayIndex <: number 25 | 26 | // An index into a struct, e.g. in a getelementptr instr 27 | .type FieldIndex <: number 28 | 29 | // An index of an argument to a func 30 | .type ArgumentIndex <: number -------------------------------------------------------------------------------- /test/c/guessing-game-heap.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | struct global { 5 | int val; 6 | } global_t; 7 | 8 | struct global g = {2}; 9 | 10 | int main() { 11 | int *hidden_answer = (int *)malloc(sizeof(int)); 12 | *hidden_answer = rand() % 10 + 1; 13 | 14 | printf("Guess a number 1-10: "); 15 | int guess; 16 | int no = scanf("%d", &guess); 17 | if (no != 1) { 18 | return 1; 19 | } 20 | 21 | printf("%d", g.val); 22 | 23 | int *fake = (int *)malloc(sizeof(int)); 24 | *fake = 42; 25 | 26 | int *to_output; 27 | if (guess == *hidden_answer) { 28 | to_output = hidden_answer; 29 | } else { 30 | to_output = fake; 31 | } 32 | printf("%d\n", *to_output); 33 | 34 | free(hidden_answer); 35 | free(fake); 36 | return 0; 37 | } 38 | -------------------------------------------------------------------------------- /FactGenerator/include/LlvmEnums.hpp: -------------------------------------------------------------------------------- 1 | #ifndef LLVM_ENUMS_HPP__ 2 | #define LLVM_ENUMS_HPP__ 3 | 4 | #include 5 | #include 6 | #include 7 | #include 8 | 9 | #include 10 | 11 | namespace cclyzer::utils { 12 | // Functions that convert the various LLVM enums to strings 13 | auto to_string(llvm::GlobalValue::LinkageTypes LT) -> std::string; 14 | auto to_string(llvm::GlobalValue::VisibilityTypes Vis) -> std::string; 15 | auto to_string(llvm::GlobalVariable::ThreadLocalMode TLM) -> std::string; 16 | auto to_string(llvm::CallingConv::ID CC) -> std::string; 17 | auto to_string(llvm::AtomicOrdering AO) -> std::string; 18 | 19 | } // namespace cclyzer::utils 20 | 21 | #endif /* LLVM_ENUMS_HPP__ */ 22 | -------------------------------------------------------------------------------- /test/callgraph_test.py: -------------------------------------------------------------------------------- 1 | import csv 2 | import gzip 3 | 4 | import pytest 5 | 6 | 7 | @pytest.mark.skip(reason="Flaky in Gitlab CI") 8 | def test_callgraph_function_pointer(run, context_sensitivity, optimization_flags): 9 | out_dir = run( 10 | "unused_argument.c", 11 | context_sensitivity=context_sensitivity.value, 12 | additional_cflags=optimization_flags, 13 | ) 14 | with gzip.open(out_dir / "subset.callgraph.callgraph_edge.csv.gz", "rt") as f: 15 | edges = {(caller, callee) for (_, callee, _, caller) in csv.reader(f, delimiter="\t")} 16 | called_from_main = {callee for (caller, callee) in edges if ":main:" in caller} 17 | assert ":noargs" in called_from_main 18 | assert ":withargs" in called_from_main 19 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :f:0 *stack_alloc@f[i32*** %px.addr] 2 | :f:1 *stack_alloc@f[i32** %x.addr] 3 | :g:0 *stack_alloc@g[i32*** %px.addr] 4 | :g:1 *stack_alloc@g[i32** %x.addr] 5 | :h:0 *stack_alloc@h[i32*** %px.addr] 6 | :h:1 *stack_alloc@h[i32** %x.addr] 7 | :main:0 *stack_alloc@main[i32* %retval] 8 | :main:1 *stack_alloc@main[i32** %pa] 9 | :main:2 *stack_alloc@main[i32* %a] 10 | :main:3 *stack_alloc@main[i32** %pb] 11 | :main:4 *stack_alloc@main[i32* %b] 12 | -------------------------------------------------------------------------------- /test/gold/points-to_context.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :f:0 *stack_alloc@f[i32*** %px.addr] 2 | :f:1 *stack_alloc@f[i32** %x.addr] 3 | :g:0 *stack_alloc@g[i32*** %px.addr] 4 | :g:1 *stack_alloc@g[i32** %x.addr] 5 | :h:0 *stack_alloc@h[i32*** %px.addr] 6 | :h:1 *stack_alloc@h[i32** %x.addr] 7 | :main:0 *stack_alloc@main[i32* %retval] 8 | :main:1 *stack_alloc@main[i32** %pa] 9 | :main:2 *stack_alloc@main[i32* %a] 10 | :main:3 *stack_alloc@main[i32** %pb] 11 | :main:4 *stack_alloc@main[i32* %b] 12 | -------------------------------------------------------------------------------- /test/c/inlineasm3.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | __asm__("movq $0x3, %rax\n" 25 | "foo:\n" 26 | "subq $0x1, %rax\n" 27 | "jnz foo\n" 28 | "movq $0x6, %rax\n" 29 | "bar:\n" 30 | "subq $0x2, %rax\n" 31 | "jnz bar\n"); 32 | return 0; 33 | } 34 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 3 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr] 4 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 5 | nil *argv[0]-alloc nil *argv-alloc 6 | nil *argv[0]-alloc nil *argv-alloc[0] 7 | nil *argv[0]-alloc[0] nil *argv-alloc 8 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 9 | nil *global_alloc@_GLOBAL__sub_I_cxxbasic.cpp nil *global_alloc@llvm.global_ctors[0][0].?/1 10 | nil *null* nil *global_alloc@llvm.global_ctors[0][0].?/2 11 | nil *unknown* nil *unknown* 12 | -------------------------------------------------------------------------------- /test/gold/cxxbasic.clang++.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr] 2 | nil *argv-alloc [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 3 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr] 4 | nil *argv-alloc[0] [<>, nil] *stack_alloc@main[i8*** %argv.addr][0] 5 | nil *argv[0]-alloc nil *argv-alloc 6 | nil *argv[0]-alloc nil *argv-alloc[0] 7 | nil *argv[0]-alloc[0] nil *argv-alloc 8 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 9 | nil *global_alloc@_GLOBAL__sub_I_cxxbasic.cpp nil *global_alloc@llvm.global_ctors[0][0].?/1 10 | nil *null* nil *global_alloc@llvm.global_ctors[0][0].?/2 11 | nil *unknown* nil *unknown* 12 | -------------------------------------------------------------------------------- /test/c/recurse.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | void countdown(int x) __attribute__((noinline)); 24 | 25 | int main(int argc, char const *argv[]) { 26 | countdown(10); 27 | return 0; 28 | } 29 | 30 | void countdown(int x) { 31 | if (x <= 0) { 32 | printf("done\n"); 33 | return; 34 | } 35 | 36 | printf("%d\n", x); 37 | countdown(x - 1); 38 | } 39 | -------------------------------------------------------------------------------- /FactGenerator/include/Wrapper.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include 4 | #include 5 | 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | 13 | #include "ContextSensitivity.hpp" 14 | 15 | namespace fs = boost::filesystem; 16 | 17 | // Return both the directory with the facts and the identifying information 18 | // generated for the pointers being analyzed. 19 | auto factgen_module( 20 | llvm::Module &, 21 | const fs::path &, 22 | const llvm::Optional &, 23 | const ContextSensitivity) 24 | -> std::tuple< 25 | boost::filesystem::path, 26 | std::map, const llvm::Value *>>; 27 | -------------------------------------------------------------------------------- /datalog/schema/ordering.dl: -------------------------------------------------------------------------------- 1 | // Ordering as an enum 2 | .type Ordering <: symbol 3 | .decl ordering(o:Ordering) 4 | 5 | .decl unordered_ordering(o:Ordering) 6 | .decl monotonic_ordering(o:Ordering) 7 | .decl acquire_ordering(o:Ordering) 8 | .decl release_ordering(o:Ordering) 9 | .decl acq_rel_ordering(o:Ordering) 10 | .decl seq_cst_ordering(o:Ordering) 11 | 12 | ordering(o) :- unordered_ordering(o). 13 | ordering(o) :- monotonic_ordering(o). 14 | ordering(o) :- acquire_ordering(o). 15 | ordering(o) :- release_ordering(o). 16 | ordering(o) :- acq_rel_ordering(o). 17 | ordering(o) :- seq_cst_ordering(o). 18 | 19 | unordered_ordering("unordered"). 20 | monotonic_ordering("monotonic"). 21 | acquire_ordering("acquire"). 22 | release_ordering("release"). 23 | acq_rel_ordering("acq_rel"). 24 | seq_cst_ordering("seq_cst"). 25 | -------------------------------------------------------------------------------- /test/c/globalvars.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int x, y, z; 24 | static char *foo = "foo"; 25 | const char *bar = "bar"; 26 | float baz[] = {1, 2, 3, 4}; 27 | 28 | int main(int argc, char const *argv[]) { 29 | x = 0; 30 | y = COINFLIP(); 31 | z = COINFLIP(); 32 | 33 | printf("%d %d %d %s %s %f\n", x, y, z, foo, bar, baz[COINFLIP()]); 34 | return 0; 35 | } 36 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *heap_alloc@main[i8* %call.i13][0] *heap_alloc@main[i8* %call.i13] 2 | [<>, nil] *heap_alloc@main[i8* %call.i][0] *heap_alloc@main[i8* %call.i] 3 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0] *typed_heap_alloc@main[%struct.obj* %call.i13] 4 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i13][0] 5 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0] *typed_heap_alloc@main[%struct.obj* %call.i] 6 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i][0] 7 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *heap_alloc@main[i8* %call.i13][0] *heap_alloc@main[i8* %call.i13] 2 | [<>, nil] *heap_alloc@main[i8* %call.i][0] *heap_alloc@main[i8* %call.i] 3 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0] *typed_heap_alloc@main[%struct.obj* %call.i13] 4 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i13][0] 5 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0] *typed_heap_alloc@main[%struct.obj* %call.i] 6 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i][0] 7 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *heap_alloc@main[i8* %call.i13][0] *heap_alloc@main[i8* %call.i13] 2 | [<>, nil] *heap_alloc@main[i8* %call.i][0] *heap_alloc@main[i8* %call.i] 3 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0] *typed_heap_alloc@main[%struct.obj* %call.i13] 4 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i13][0] 5 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0] *typed_heap_alloc@main[%struct.obj* %call.i] 6 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i][0] 7 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset_lift.alloc_subregion_ctx.golden.csv: -------------------------------------------------------------------------------- 1 | [<>, nil] *heap_alloc@main[i8* %call.i13][0] *heap_alloc@main[i8* %call.i13] 2 | [<>, nil] *heap_alloc@main[i8* %call.i][0] *heap_alloc@main[i8* %call.i] 3 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0] *typed_heap_alloc@main[%struct.obj* %call.i13] 4 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i13][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i13][0] 5 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0] *typed_heap_alloc@main[%struct.obj* %call.i] 6 | [<>, nil] *typed_heap_alloc@main[%struct.obj* %call.i][0].?/0 *typed_heap_alloc@main[%struct.obj* %call.i][0] 7 | -------------------------------------------------------------------------------- /flake.nix: -------------------------------------------------------------------------------- 1 | # NOTE: This configuration is not evaluated during Continuous Integration (CI) processes and may not 2 | # be as well-maintained or up-to-date as the CMake and Docker setup. Use with caution. 3 | 4 | { 5 | inputs = { 6 | nixpkgs.url = "github:nixos/nixpkgs/nixos-22.11"; 7 | flake-utils.url = "github:numtide/flake-utils"; 8 | }; 9 | 10 | outputs = { self, nixpkgs, flake-utils }: 11 | flake-utils.lib.eachDefaultSystem (system: 12 | let 13 | pkgs = import nixpkgs { 14 | inherit system; 15 | }; 16 | 17 | inherit (pkgs) callPackage; 18 | in 19 | rec { 20 | defaultPackage = packages.cclyzerpp; 21 | packages = { 22 | cclyzerpp = callPackage ./contrib/nix/default.nix { }; 23 | }; 24 | }); 25 | } 26 | 27 | 28 | -------------------------------------------------------------------------------- /test/c/underconstrained_complex_inheritance.cpp: -------------------------------------------------------------------------------- 1 | class Abstract1 { 2 | int _b; 3 | 4 | public: 5 | virtual int b() { return _b; }; 6 | virtual const char *str() = 0; 7 | }; 8 | 9 | class Abstract2 { 10 | int _a; 11 | char _c; 12 | 13 | public: 14 | virtual int a() { return _a; }; 15 | virtual char c() { return _c; }; 16 | }; 17 | 18 | class Value : public Abstract1, public Abstract2 { 19 | private: 20 | char _str[10]; 21 | 22 | public: 23 | Value() = default; 24 | ~Value() = default; 25 | virtual char *str() { return _str; }; 26 | virtual char c() { return _str[0]; }; 27 | }; 28 | 29 | int func(Value *value) { 30 | if (value->a() == value->b()) 31 | return 1; 32 | else 33 | return 0; 34 | } 35 | 36 | int main(int argc, char const *argv[]) { 37 | Value value; 38 | return func(&value); 39 | } -------------------------------------------------------------------------------- /test/c/recurselambda.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | std::function countdown; 25 | countdown = [&countdown](int x) { 26 | if (x <= 0) { 27 | std::cout << "done\n"; 28 | return; 29 | } 30 | 31 | std::cout << x << '\n'; 32 | countdown(x - 1); 33 | }; 34 | 35 | countdown(10); 36 | 37 | return 0; 38 | } 39 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, nil] :_Znwm [<>, nil] :main:0 2 | [:main:3, nil] :_Znwm [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, nil] :_Znwm [<>, nil] :main:0 2 | [:main:3, nil] :_Znwm [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/c/type-backprop.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | 4 | char *my_calloc(size_t count, size_t size) { return malloc(count * size); } 5 | 6 | typedef struct { 7 | int *ptr; 8 | } int_struct; 9 | 10 | typedef struct { 11 | double *ptr; 12 | } double_struct; 13 | 14 | void print_int(int_struct *s) { printf("%d\n", *s->ptr); } 15 | 16 | void print_double(double_struct *s) { printf("%f\n", *s->ptr); } 17 | 18 | void use_int() { 19 | int x = 0; 20 | int_struct *s = (int_struct *)my_calloc(1, sizeof(int_struct)); 21 | s->ptr = &x; 22 | print_int(s); 23 | } 24 | 25 | void use_double() { 26 | double x = 0; 27 | double_struct *s = (double_struct *)my_calloc(1, sizeof(double_struct)); 28 | s->ptr = &x; 29 | print_double(s); 30 | } 31 | 32 | int main(int argc, char *argv[]) { 33 | use_int(); 34 | use_double(); 35 | } 36 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, nil] :malloc [<>, nil] :main:0 2 | [:main:3, nil] :malloc [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, nil] :malloc [<>, nil] :main:0 2 | [:main:3, nil] :malloc [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/c/unused_argument.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | __attribute__((noinline)) int noargs() { return COINFLIP(); } 24 | __attribute__((noinline)) int withargs(int i) { return i; } 25 | 26 | int main(int argc, char const *argv[]) { 27 | int (*f)(int); 28 | if (COINFLIP()) { 29 | f = noargs; // NOLINT 30 | } else { 31 | f = withargs; 32 | } 33 | printf("noargs = %d\n", f(42)); 34 | return 0; 35 | } 36 | -------------------------------------------------------------------------------- /test/c/lambda.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | int x = 100; 25 | 26 | if (COINFLIP()) { 27 | auto lambda = [x]() { 28 | std::cout << "x=" << x << '\n'; 29 | if (COINFLIP()) { 30 | std::cout << "foo" << '\n'; 31 | } else { 32 | std::cout << "bar" << '\n'; 33 | } 34 | }; 35 | 36 | lambda(); 37 | } 38 | return 0; 39 | } 40 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.1-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *global_alloc@.str nil *global_alloc@TOO_FEW_ARGS 6 | nil *global_alloc@.str nil *global_alloc@TOO_FEW_ARGS[0] 7 | nil *global_alloc@.str[0] nil *global_alloc@TOO_FEW_ARGS 8 | nil *global_alloc@.str[0] nil *global_alloc@TOO_FEW_ARGS[0] 9 | nil *global_alloc@.str[0][*] nil *global_alloc@TOO_FEW_ARGS 10 | nil *global_alloc@.str[0][*] nil *global_alloc@TOO_FEW_ARGS[0] 11 | nil *null* nil *heap_alloc@handle[i8* %call.i.i.i][8] 12 | nil *null* nil *typed_heap_alloc@handle[i32* %call.i.i.i][2] 13 | nil *null* nil *typed_heap_alloc@handle[i8* %call.i.i.i][8] 14 | nil *unknown* nil *unknown* 15 | -------------------------------------------------------------------------------- /test/gold/notes.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.ptr_points_to.golden.csv: -------------------------------------------------------------------------------- 1 | nil *argv[0]-alloc nil *argv-alloc 2 | nil *argv[0]-alloc nil *argv-alloc[0] 3 | nil *argv[0]-alloc[0] nil *argv-alloc 4 | nil *argv[0]-alloc[0] nil *argv-alloc[0] 5 | nil *global_alloc@.str nil *global_alloc@TOO_FEW_ARGS 6 | nil *global_alloc@.str nil *global_alloc@TOO_FEW_ARGS[0] 7 | nil *global_alloc@.str[0] nil *global_alloc@TOO_FEW_ARGS 8 | nil *global_alloc@.str[0] nil *global_alloc@TOO_FEW_ARGS[0] 9 | nil *global_alloc@.str[0][*] nil *global_alloc@TOO_FEW_ARGS 10 | nil *global_alloc@.str[0][*] nil *global_alloc@TOO_FEW_ARGS[0] 11 | nil *null* nil *heap_alloc@handle[i8* %call.i.i.i][8] 12 | nil *null* nil *typed_heap_alloc@handle[i32* %call.i.i.i][2] 13 | nil *null* nil *typed_heap_alloc@handle[i8* %call.i.i.i][8] 14 | nil *unknown* nil *unknown* 15 | -------------------------------------------------------------------------------- /test/c/nested.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | 25 | if (COINFLIP()) { 26 | puts("foo"); 27 | if (COINFLIP()) { 28 | puts("bar"); 29 | if (COINFLIP()) { 30 | puts("baz"); 31 | return 0; 32 | } 33 | } 34 | } else { 35 | puts("quux"); 36 | if (COINFLIP()) { 37 | puts("bang"); 38 | } 39 | } 40 | 41 | return 0; 42 | } 43 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.1-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i32* %argc.addr] 2 | :main:1 *stack_alloc@main[i8*** %argv.addr] 3 | :my_calloc:0 *stack_alloc@my_calloc[i64* %count.addr] 4 | :my_calloc:1 *stack_alloc@my_calloc[i64* %size.addr] 5 | :print_double:0 *stack_alloc@print_double[%struct.double_struct** %s.addr] 6 | :print_int:0 *stack_alloc@print_int[%struct.int_struct** %s.addr] 7 | :use_double:0 *stack_alloc@use_double[double* %x] 8 | :use_double:1 *stack_alloc@use_double[%struct.double_struct** %s] 9 | :use_int:0 *stack_alloc@use_int[i32* %x] 10 | :use_int:1 *stack_alloc@use_int[%struct.int_struct** %s] 11 | -------------------------------------------------------------------------------- /test/gold/type-backprop.clang.-g-grecord-gcc-switches-O1-O0-fno-discard-value-names.2-callsite.stack_allocation_by_instr.golden.csv: -------------------------------------------------------------------------------- 1 | :main:0 *stack_alloc@main[i32* %argc.addr] 2 | :main:1 *stack_alloc@main[i8*** %argv.addr] 3 | :my_calloc:0 *stack_alloc@my_calloc[i64* %count.addr] 4 | :my_calloc:1 *stack_alloc@my_calloc[i64* %size.addr] 5 | :print_double:0 *stack_alloc@print_double[%struct.double_struct** %s.addr] 6 | :print_int:0 *stack_alloc@print_int[%struct.int_struct** %s.addr] 7 | :use_double:0 *stack_alloc@use_double[double* %x] 8 | :use_double:1 *stack_alloc@use_double[%struct.double_struct** %s] 9 | :use_int:0 *stack_alloc@use_int[i32* %x] 10 | :use_int:1 *stack_alloc@use_int[%struct.int_struct** %s] 11 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, [<>, nil]] :_Znwm [<>, nil] :main:0 2 | [:main:3, [<>, nil]] :_Znwm [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/c/stack-args-2.c: -------------------------------------------------------------------------------- 1 | #include 2 | 3 | int f(int, int, int, int, int, int, int, int, int, int, int, int, int, int) 4 | __attribute__((noinline)); 5 | int f(int a, int b, int c, int d, int e, int f, int g, int h, int i, int j, 6 | int k, int l, int m, int n) { 7 | printf("%d", a); 8 | printf("%d", b); 9 | printf("%d", c); 10 | printf("%d", d); 11 | printf("%d", e); 12 | printf("%d", f); 13 | printf("%d", g); 14 | printf("%d", h); 15 | printf("%d", i); 16 | printf("%d", j); 17 | printf("%d", k); 18 | printf("%d", l); 19 | printf("%d", m); 20 | printf("%d", n); 21 | return a; 22 | } 23 | 24 | int main(int argc, char *argv[] /* unused */) { 25 | return f(argc * 2, argc * 3, argc * 4, argc * 5, argc * 6, argc * 7, argc * 8, 26 | argc * 9, argc * 10, argc * 11, argc * 12, argc * 13, argc * 14, 27 | argc * 15); 28 | } 29 | -------------------------------------------------------------------------------- /test/gold/points-to_new-context.clang++.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, [<>, nil]] :_Znwm [<>, nil] :main:0 2 | [:main:3, [<>, nil]] :_Znwm [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/c/overflowable-allocations.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | 5 | struct Buffer { 6 | Buffer() { val.fill(0); } 7 | std::array val; 8 | }; 9 | 10 | __attribute__((noinline)) Buffer *allocate_buffer() { return new Buffer; } 11 | 12 | __attribute__((noinline)) char * 13 | allocate_variable_length_buffer(unsigned long buf_size) { 14 | char *buf = new char[buf_size + 1024]; 15 | memset(buf, 0x0, buf_size); 16 | return buf; 17 | } 18 | 19 | int main(int argc, char **argv) { 20 | Buffer *buf1 = allocate_buffer(); 21 | for (char c : buf1->val) { 22 | std::cout << c; 23 | } 24 | std::cout << std::endl; 25 | unsigned long num1; 26 | scanf("%lu", &num1); 27 | char *buf2 = allocate_variable_length_buffer(num1); 28 | std::cout << buf2 << std::endl; 29 | delete buf1; 30 | delete[] buf2; 31 | return 0; 32 | } 33 | -------------------------------------------------------------------------------- /test/c/voidptr.c: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | void voidptr(void *thing) { 24 | if (COINFLIP()) { 25 | printf("foo: %p\n", thing); 26 | } else { 27 | printf("bar: %p\n", thing); 28 | } 29 | } 30 | 31 | int main(int argc, char const *argv[]) { 32 | int x = COINFLIP(); 33 | 34 | int y = COINFLIP(); 35 | double z = COINFLIP() + 3.14; 36 | 37 | if (x) { 38 | voidptr(&y); 39 | } else { 40 | voidptr(&z); 41 | } 42 | } 43 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.subset.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, [<>, nil]] :malloc [<>, nil] :main:0 2 | [:main:3, [<>, nil]] :malloc [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /test/gold/points-to_malloc-context.clang.-g-grecord-gcc-switches-O1-O1-fno-discard-value-names.2-callsite.unification.callgraph.callgraph_edge.golden.csv: -------------------------------------------------------------------------------- 1 | [:main:0, [<>, nil]] :malloc [<>, nil] :main:0 2 | [:main:3, [<>, nil]] :malloc [<>, nil] :main:3 3 | nil :llvm.dbg.value [<>, nil] :main:2 4 | nil :llvm.dbg.value [<>, nil] :main:5 5 | nil :llvm.dbg.value [<>, nil] :main:6 6 | nil :llvm.dbg.value [<>, nil] :main:7 7 | -------------------------------------------------------------------------------- /FactGenerator/include/PredicateGroups.hpp: -------------------------------------------------------------------------------- 1 | #ifndef PREDICATE_GROUPS_H__ 2 | #define PREDICATE_GROUPS_H__ 3 | 4 | #include "Predicate.hpp" 5 | 6 | namespace cclyzer::predicates { 7 | // type aliases 8 | typedef Predicate pred_t; 9 | 10 | // A struct is used instead of a namespace, so that it can be 11 | // passed as a template argument 12 | struct predicate_group {}; 13 | 14 | // The predicates 15 | extern Registry const predicates_reg; 16 | 17 | //---------------------------------------------------- 18 | // Predicate group definitions, from this point on. 19 | //---------------------------------------------------- 20 | 21 | #define GROUP_BEGIN(g) struct g : public predicate_group { 22 | #define GROUP_END(g) \ 23 | } \ 24 | ; 25 | #define PREDICATE(g, p, f) static pred_t p; 26 | #include "./predicates.inc" 27 | 28 | } // namespace cclyzer::predicates 29 | 30 | #endif 31 | -------------------------------------------------------------------------------- /test/c/customclass.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | using namespace std; 24 | 25 | class Animal { 26 | public: 27 | void act() { 28 | if (COINFLIP()) { 29 | cout << "woof" << endl; 30 | } else { 31 | cout << "meow" << endl; 32 | } 33 | } 34 | }; 35 | 36 | int main(int argc, char const *argv[]) { 37 | Animal a, b, c; 38 | 39 | a.act(); 40 | a.act(); 41 | b.act(); 42 | b.act(); 43 | c.act(); 44 | c.act(); 45 | return 0; 46 | } 47 | -------------------------------------------------------------------------------- /contrib/nix/default.nix: -------------------------------------------------------------------------------- 1 | # NOTE: This configuration is not evaluated during Continuous Integration (CI) processes and may not 2 | # be as well-maintained or up-to-date as the CMake and Docker setup. Use with caution. 3 | 4 | { lib 5 | , fetchFromGitHub 6 | , cmake 7 | , llvmPackages_14 8 | , boost 9 | , souffle 10 | , ninja 11 | }: 12 | 13 | let 14 | inherit (llvmPackages_14) llvm stdenv openmp; 15 | in 16 | stdenv.mkDerivation { 17 | pname = "cclyzerpp"; 18 | version = "0.7.0"; 19 | 20 | src = ../../.; 21 | 22 | nativeBuildInputs = [ 23 | cmake 24 | llvm 25 | boost 26 | souffle 27 | openmp 28 | ]; 29 | 30 | buildInputs = [ 31 | souffle 32 | ]; 33 | 34 | meta = with lib; { 35 | description = "cclyzer++ is a precise and scalable global pointer analysis for LLVM code"; 36 | homepage = "https://github.com/GaloisInc/cclyzerpp/tree/main"; 37 | license = licenses.bsd3; 38 | }; 39 | } 40 | -------------------------------------------------------------------------------- /test/c/nestedlambda.cpp: -------------------------------------------------------------------------------- 1 | #include 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | 11 | #ifdef __cplusplus 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | #include 19 | #endif 20 | 21 | #define COINFLIP() (rand() % 2) 22 | 23 | int main(int argc, char const *argv[]) { 24 | auto lambda = []() { 25 | if (COINFLIP()) { 26 | std::cout << "foo" << '\n'; 27 | 28 | auto lambda2 = []() { std::cout << "baz" << '\n'; }; 29 | 30 | lambda2(); 31 | } else { 32 | std::cout << "bar" << '\n'; 33 | 34 | auto lambda3 = []() { std::cout << "quux" << '\n'; }; 35 | 36 | lambda3(); 37 | } 38 | }; 39 | 40 | lambda(); 41 | 42 | return 0; 43 | } 44 | -------------------------------------------------------------------------------- /datalog/points-to/points-to.project: -------------------------------------------------------------------------------- 1 | #include "argv.dl" 2 | #include "allocations-decl.dl" 3 | #include "allocations.dl" 4 | #include "allocations-globals.dl" 5 | #include "allocations-sizes.dl" 6 | #include "allocations-type.dl" 7 | #include "allocations-subobjects.dl" 8 | #include "assignment.dl" 9 | #include "at-exit.dl" 10 | #include "type-compatibility.dl" 11 | #include "points-to-options.dl" 12 | #include "class-type.dl" 13 | #include "virtual-tables.dl" 14 | #include "type-back-propagation.dl" 15 | #include "constant-init.dl" 16 | #include "constant-exprs.dl" 17 | #include "constant-points-to.dl" 18 | #include "allocations-subobjects-aliases.dl" 19 | #include "core.dl" 20 | #include "cplusplus.dl" 21 | #include "strip-context-projections.dl" 22 | #include "interprocedural.dl" 23 | #include "memcpy.dl" 24 | #include "field-sensitivity.dl" 25 | #include "cplusplus-exceptions.dl" 26 | #include "signatures.dl" 27 | #include "types.dl" 28 | #include "region.dl" 29 | --------------------------------------------------------------------------------