SVF: Use our CallGraph when SVF's is not sufficient

include/dg/llvm/LLVMDependenceGraph.h

@@ -180,6 +180,9 @@ class LLVMDependenceGraph : public DependenceGraph<LLVMNode> {
     void handleInstruction(llvm::Value *val, LLVMNode *node,
                            LLVMNode *prevNode);
 
+    void handleCalledFunction(const llvm::CallInst *CInst,
+                              const llvm::Function *F, LLVMNode *node);
+
     // convert llvm basic block to our basic block
     // That includes creating all the nodes and adding them
     // to this graph and creating the basic block and

include/dg/llvm/PointerAnalysis/SVFPointerAnalysis.h

@@ -15,6 +15,8 @@
 
 #include "dg/PointerAnalysis/Pointer.h"
 
+#include "dg/llvm/CallGraph/CallGraph.h"
+
 #include "dg/llvm/PointerAnalysis/LLVMPointerAnalysisOptions.h"
 #include "dg/llvm/PointerAnalysis/LLVMPointsToSet.h"
 #include "dg/llvm/PointerAnalysis/PointerAnalysis.h"
@@ -23,6 +25,7 @@
 
 namespace dg {
 
+using llvmdg::LazyLLVMCallGraph;
 using pta::Pointer;
 
 using SVF::LLVMModuleSet;
@@ -96,6 +99,7 @@ class SVFPointerAnalysis : public LLVMPointerAnalysis {
     const llvm::Module *_module{nullptr};
     SVF::SVFModule *_svfModule{nullptr};
     std::unique_ptr<SVF::PointerAnalysis> _pta{};
+    std::unique_ptr<LazyLLVMCallGraph> _cg;
 
     PointsTo &getUnknownPTSet() const {
         static PointsTo _unknownPTSet;
@@ -127,6 +131,15 @@ class SVFPointerAnalysis : public LLVMPointerAnalysis {
         return !pts.empty();
     }
 
+    ///
+    // SVF's call graph usually lacks information about calls made through
+    // function pointers.  If that happens, use our, more precise, call graph.
+    LazyLLVMCallGraph &getPreciseCallGraph() {
+        if (!_cg)
+            _cg.reset(new LazyLLVMCallGraph(_module));
+        return *_cg;
+    }
+
     ///
     // Get the points-to information for the given LLVM value.
     // The return object has methods begin(), end() that can be used
@@ -165,6 +178,7 @@ class SVFPointerAnalysis : public LLVMPointerAnalysis {
         _svfModule->buildSymbolTableInfo();
 
         PAGBuilder builder;
+        PAG::handleBlackHole(true);
         PAG *pag = builder.build(_svfModule);
 
         _pta.reset(new Andersen(pag));

lib/llvm/LLVMDependenceGraph.cpp

@@ -28,6 +28,9 @@
 #include "dg/llvm/LLVMDependenceGraph.h"
 #include "dg/llvm/LLVMNode.h"
 #include "dg/llvm/PointerAnalysis/PointerAnalysis.h"
+#ifdef HAVE_SVF
+#include "dg/llvm/PointerAnalysis/SVFPointerAnalysis.h"
+#endif
 // !FIXME
 #include "../lib/llvm/ControlDependence/InterproceduralCD.h"
 #include "../lib/llvm/ControlDependence/NTSCD.h"
@@ -393,6 +396,33 @@ static bool isMemAllocationFunc(const llvm::Function *func) {
            name.equals("realloc");
 }
 
+void LLVMDependenceGraph::handleCalledFunction(const llvm::CallInst *CInst,
+                                               const llvm::Function *F,
+                                               LLVMNode *node) {
+    if (F->empty() || !llvmutils::callIsCompatible(F, CInst)) {
+        if (threads && F && F->getName() == "pthread_create") {
+            auto possibleFunctions =
+                    getCalledFunctions(CInst->getArgOperand(2), PTA);
+            for (auto &function : possibleFunctions) {
+                if (!function->empty()) {
+                    LLVMDependenceGraph *subg = buildSubgraph(
+                            node, const_cast<llvm::Function *>(function),
+                            true /*this is fork*/);
+                    node->addSubgraph(subg);
+                }
+            }
+        } else {
+            // incompatible prototypes or the function
+            // is only declaration
+            return;
+        }
+    } else {
+        LLVMDependenceGraph *subg =
+                buildSubgraph(node, const_cast<llvm::Function *>(F));
+        node->addSubgraph(subg);
+    }
+}
+
 void LLVMDependenceGraph::handleInstruction(llvm::Value *val, LLVMNode *node,
                                             LLVMNode *prevNode) {
     using namespace llvm;
@@ -413,34 +443,28 @@ void LLVMDependenceGraph::handleInstruction(llvm::Value *val, LLVMNode *node,
             if (pts.empty()) {
                 llvmutils::printerr("Had no PTA node", strippedValue);
             }
-            for (const LLVMPointer &ptr : pts) {
-                // vararg may introduce imprecision here, so we
-                // must check that it is really pointer to a function
-                Function *F = dyn_cast<Function>(ptr.value);
-                if (!F)
-                    continue;
-
-                if (F->empty() || !llvmutils::callIsCompatible(F, CInst)) {
-                    if (threads && F && F->getName() == "pthread_create") {
-                        auto possibleFunctions = getCalledFunctions(
-                                CInst->getArgOperand(2), PTA);
-                        for (auto &function : possibleFunctions) {
-                            if (!function->empty()) {
-                                LLVMDependenceGraph *subg = buildSubgraph(
-                                        node,
-                                        const_cast<llvm::Function *>(function),
-                                        true /*this is fork*/);
-                                node->addSubgraph(subg);
-                            }
-                        }
-                    } else {
-                        // incompatible prototypes or the function
-                        // is only declaration
+
+            if (PTA->getOptions().isSVF() && pts.size() == 1 &&
+                pts.hasUnknown()) {
+#ifdef HAVE_SVF
+                auto &CG = static_cast<SVFPointerAnalysis *>(PTA)
+                                   ->getPreciseCallGraph();
+
+                const auto &functions = CG.getCalledFunctions(CInst);
+                for (const auto *F : functions)
+                    handleCalledFunction(CInst, F, node);
+#else
+                assert(false && "trying to use SVF on a non-SVF build");
+#endif
+            } else {
+                for (const LLVMPointer &ptr : pts) {
+                    // vararg may introduce imprecision here, so we
+                    // must check that it is really pointer to a function
+                    Function *F = dyn_cast<Function>(ptr.value);
+                    if (!F)
                         continue;
-                    }
-                } else {
-                    LLVMDependenceGraph *subg = buildSubgraph(node, F);
-                    node->addSubgraph(subg);
+
+                    handleCalledFunction(CInst, F, node);
                 }
             }
         }

lib/llvm/ReadWriteGraph/Instructions.cpp

@@ -14,6 +14,9 @@
 //#include "dg/llvm/PointerAnalysis/PointerGraph.h"
 //#include "llvm/ForkJoin/ForkJoin.h"
 #include "dg/ReadWriteGraph/RWNode.h"
+#ifdef HAVE_SVF
+#include "dg/llvm/PointerAnalysis/SVFPointerAnalysis.h"
+#endif
 #include "llvm/ReadWriteGraph/LLVMReadWriteGraphBuilder.h"
 #include "llvm/llvm-utils.h"
 
@@ -306,9 +309,25 @@ LLVMReadWriteGraphBuilder::createCall(const llvm::Instruction *Inst) {
 
     const auto &functions = getCalledFunctions(calledVal, PTA);
     if (functions.empty()) {
-        llvm::errs() << "[RWG] error: could not determine the called function "
-                        "in a call via pointer: \n"
-                     << ValInfo(CInst) << "\n";
+#ifdef HAVE_SVF
+        if (PTA->getOptions().isSVF()) {
+            errs() << "[RWG] warning: could not determine the called function "
+                      "in a call via pointer from SVF pointer analysis: \n"
+                   << ValInfo(CInst) << "\n"
+                   << "[RWG] note: trying our CallGraph instead!\n";
+
+            auto &CG = static_cast<SVFPointerAnalysis *>(PTA)
+                               ->getPreciseCallGraph();
+
+            const auto &functions = CG.getCalledFunctions(CInst);
+            if (!functions.empty())
+                return createCallToFunctions(functions, CInst);
+        }
+#endif
+
+        errs() << "[RWG] error: could not determine the called function "
+                  "in a call via pointer: \n"
+               << ValInfo(CInst) << "\n";
         return {createUnknownCall(CInst)};
     }
     return createCallToFunctions(functions, CInst);