Import null pointer information from PDG into static analysis #1086
Conversation
ahomescu
force-pushed
the
ahomescu/non_null
branch
from
ac9abd6
to
0a55190
Compare
|
I still need to test this on some actual code (maybe lighttpd?) |
kkysen
changed the title
ahomescu
force-pushed
the
ahomescu/non_null
branch
from
0a55190
to
1f4aa09
Compare
| if g.is_null { | ||
| // TODO: is this enough? | ||
| perms.remove(PermissionSet::NON_NULL); | ||
| } | ||
|
|
There was a problem hiding this comment.
@spernsteiner If I'm understanding #1088 correctly, the other thing we need to do here is add NON_NULL to updates_forbidden?
There was a problem hiding this comment.
Roughly, yes. Though we might want to experiment a bit - for example, it might be easier to understand the results if we set updates_forbidden only on function signatures, or only on named variables and not on temporaries.
There was a problem hiding this comment.
I think there can be two nodes with the same dest (either in different Graphs or in the same one), representing two different observations of that dest during the execution. We want to set NON_NULL in perms (and in updates_forbidden) only if all observations with the same dest show it containing a non-null pointer. So we need some additional logic beyond just doing perms.insert(NON_NULL); updates_forbidden.insert(NON_NULL); here.
Mark each PDG graph with a boolean flag that represents whether that graph corresponds to the null pointer or not. The PDG construction algorithm seems to build one unique graph for all null pointers in the entire program.
Add one test where a function argument can be either null or non-null in the recur() function of the analysis/tests/misc example code.
Remove the NON_NULL permission from all nodes in the null graph from the PDG.
Introduce a ProjectionTree data structure in the PDG construction algorithm which keeps track of assignments into projections of locals. This lets us reconstruct the correct source of some events where the direct source is missing.
The Field event instrumentation is broken because it does not distinguish between identical field indices at different depths, e.g., x.1.2 and x.2 will emit an identical Field(&x, 2) event.
ahomescu
force-pushed
the
ahomescu/non_null
branch
from
1f4aa09
to
2b30b48
Compare
No description provided.