ziqingluo-90 wrote: For context:
This is the first patch of three aiming for solving the non-termination problem in using DFS in the pointer-flow. Problem description: The current pointer-flow graph has exactly one edge corresponding to an assignment in the source code. For example, a pointer assignment `p = q;` results in an edge `(p, i) -> (q, j)` for some pointer levels `i` and `j`. In unsafe buffer propagation, the edge encodes the meaning that if `p` is bounded, so must `q` be; additionally, if `*p/p[x]` is bounded, so must `*q/q[y]` be; and so on until the maximum pointer level of `p` or `q` is reached. Therefore, during DFS, a node `(p, i+1)` can reach `(q, j+1)` through the edge `(p, i) -> (q, j)`. This is correct ONLY when `p` and `q` have compatible types, which is true for most cases due to type checking. However, this assumption is wrong ---a pointer assignment `a = (T)b` (for some pointer type `T`) contributes an edge `(a, x) -> (b, y)` where `a` and `b` do not have compatible types. Consequently, one can have two such edges in the graph `(a, 1) -> (b, 2)` and `(b, 1) -> (a, 2)`, causing DFS never stop because the pointer levels keep growing. Note that during DFS, type information has been abstracted out. Therefore, we do not know the exact pointer level upper bounds to limit the growth of pointer levels. Solution: Let the pointer-flow graph explicitly include the finite set of edges encoded by each assignment. Type information is available during graph construction. Consequently, the graph searching can go back to being simple. As a first step, this patch uses a new data structure, DeclPointerLevel, as an intermediate representation that retains type information, instead of directly lowering pointer assignments to EntityPointerLevels. https://github.com/llvm/llvm-project/pull/218196 _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
