similar to: How to ask MustAlias queries from DSA results

On 12/16/16 9:53 PM, 杨至轩(Zhixuan Yang) via llvm-dev wrote: > Hello, everyone! > > I'm writing an automatic memory leak fixing tool recently. For my > task, I'm using the DSA (Data Structure Analysis) for alias analysis. > In my task, when I detect a memory leak, I need to find a pointer (in > C) 'must-alias' with the corresponding resource. If I understand

Dear Josh, > If I understand correctly, if you find memory leak, you want to find the corresponding call(s) to malloc() that allocated the memory object, correct? Can you more completely explain what you are trying to accomplish? Thanks for your reply. In my task, I use data flow analysis to locate a program point where a malloc must be leaked (by must leaked, I mean (a) it must be

Dear John, > When you say "must be allocated," you mean it must have been allocated via a call to a heap allocator (e.g., malloc(), calloc(), etc), correct? Yes, I mean heap allocators. In fact, I'm implementing the idea of the ICSE 2015 paper Safe Memory-Leak Fixing for C Programs. > Also, are you performing intra-procedural or inter-procedural data-flow analysis?

Andrew Lenharth wrote: > On Fri, Aug 7, 2009 at 4:45 PM, Patrick Alexander > Simmons<simmon12 at cs.uiuc.edu> wrote: > >> I'm iterating over all LoadInst and StoreInst-type Instructions in a >> Function, and getNodeForValue() is sometimes returning NULL. Why is >> this happening? Shouldn't every load from or store to memory correspond >> to some

John Criswell wrote: > You can sometimes get NULL DSNodes if a previously-run transform pass > adds pointers to the program but doesn't update DSA while claiming to > preserve it. The pool allocation pass, for example, does this: it > claims to preserve the DSA results (when used for SAFECode) but doesn't > properly update the DSGraph when it adds pool handles. Therefore,

Patrick Alexander Simmons wrote: > Andrew Lenharth wrote: > >> On Fri, Aug 7, 2009 at 4:45 PM, Patrick Alexander >> Simmons<simmon12 at cs.uiuc.edu> wrote: >> >> >>> I'm iterating over all LoadInst and StoreInst-type Instructions in a >>> Function, and getNodeForValue() is sometimes returning NULL. Why is >>> this

Patrick Alexander Simmons wrote: > John Criswell wrote: > >> You can sometimes get NULL DSNodes if a previously-run transform pass >> adds pointers to the program but doesn't update DSA while claiming to >> preserve it. The pool allocation pass, for example, does this: it >> claims to preserve the DSA results (when used for SAFECode) but doesn't >>

Thanks for all your help so far. My problem is that what I have are the pool descriptors, which I by traversing the uses of poolinit and accessing the first argument of each call. I need to find the DSNode (in the original function) to which this pool descriptor corresponds. The rub is that this pool descriptor of course does not exist except in the clone. If I call getFuncInfo(), I get a

Hi Patrick, That's right. DSNodes are coupled to the original function. For function clones, you first need to get the original function, and then use the DSNode from that function. FuncInfo contains the information if a function is a clone and what the original function is. If you want to find the corresponding DSNode for some instruction, you must call PA::FuncInfo::MapValueToOriginal(

Harmen, your suggestion of inverting the mapping almost worked (and Andrew was correct that the function I need is the same as the one in which poolinit appears). Unfortunately, it appears that this mapping only considers the original function and not any of its clones. Since the pool descriptor in question may very well only exist in a clone, I can't use this. Is there another way?

You might want to have a look at PoolAllocate.h. Per function, a PA::FuncInfo structure keeps track of all DSNodes that should be pool allocated. ArgNodes contains pool arguments, NodesToPA contains nodes that are locally pool allocated and thus initialized using poolinit. PoolDescriptors contains a mapping from DSNodes to pool descriptors, and you could easily invert this mapping. Finding a

I'm iterating over all LoadInst and StoreInst-type Instructions in a Function, and getNodeForValue() is sometimes returning NULL. Why is this happening? Shouldn't every load from or store to memory correspond to some DSNode? --Patrick

Patrick Simmons wrote: > Thanks for all your help so far. > > My problem is that what I have are the pool descriptors, which I by > traversing the uses of poolinit and accessing the first argument of each > call. I need to find the DSNode (in the original function) to which > this pool descriptor corresponds. The rub is that this pool descriptor > of course does not

On 03/19/10 08:56, John Criswell wrote: > Patrick Simmons wrote: >> Thanks for all your help so far. >> >> My problem is that what I have are the pool descriptors, which I by >> traversing the uses of poolinit and accessing the first argument of >> each call. I need to find the DSNode (in the original function) to >> which this pool descriptor

Hi all, I just ran into a strange problem. When using the Equivalence-class Bottom-up Data Structure Analysis pass and pool allocation, I noticed some objects using different pool descriptors where I expected them to be in the same pool. We use svn revision 66285 of the DSA. The following 2 programs expose the problem. First the version that runs correctly, ie. producing a single DSNode.

On Fri, Aug 7, 2009 at 4:45 PM, Patrick Alexander Simmons<simmon12 at cs.uiuc.edu> wrote: > I'm iterating over all LoadInst and StoreInst-type Instructions in a > Function, and getNodeForValue() is sometimes returning NULL.  Why is > this happening?  Shouldn't every load from or store to memory correspond > to some DSNode? Not if the pointer is null or the pointer

Is there some efficient way to find the malloc instructions which point to the memory represented by a DSNode? Right now the only way I see is by iterating through the value map in the DSGraph object and finding every value that points to my DSNode. A possibly related question: is there a way to tell that the node has been merged, and if so, what types of nodes went into the merge? Thanks,

I figure (hopefully correctly) that I can iterate over all pool descriptors in a program by iterating over all users of poolinit and looking at the first argument. However, once I have a pool descriptor, I need to get its corresponding DSNode in the function in which it is complete (or in the global graph if it is a global). How do I do this? Thanks, --Patrick

Thank you, and I apologize for conflating the two passes. My main remaining concern is about what happens when there is a node in a function's DSGraph that points to a pool (or pools, if there are multiple callers) that is not in the DSGraph of that function. For example, on page 3 of the 2005 PLDI paper, the DSGraph given for createnode(), Data is pointing to an unlabeled node in the

I don't really have a specific question, but, as I've been looking through pool allocation and the DS graphs extensively, I wanted to verify that my understanding of the representations used is correct. Therefore, I'm summarizing my understanding below (which, if it's correct, may hopefully be helpful to others). I would appreciate if someone who understands pool allocation