C++ GetElementPtrInst::getPointerOperandType方法代码示例

void Executor::executeGep(Instruction *i) {
    if (DisabledSymbolicExeCurRun) {
        return;
    }
    assert(i && "Expecting an instruction!");
    GetElementPtrInst *gep = (GetElementPtrInst*) i;
    assert(gep->getNumIndices()<=2 && "Unsupported gep instruction");
    if(AllocaInst *a = dyn_cast<AllocaInst>(gep->getPointerOperand())) {
        Type *ty = a->getAllocatedType();
        if (ty->isIntegerTy()) {
            // Incompleteness: pointer dereferencement on symbolic value
            AllLocDefinite = false;
            return;
        }
    }
    unsigned idx = 0;
    Type *subTy = NULL;
    Type *ptrOpTy = gep->getPointerOperandType();    
    if (ptrOpTy && ptrOpTy->getNumContainedTypes()==1) {
        subTy = ptrOpTy->getContainedType(0);
    }
    if (subTy && subTy->getNumContainedTypes()>0) {
        idx = 1;
    } else {
        assert("Unsupported gep instruction!");
    }
    Value *ptr = (Value*) i;
    if(gep->hasIndices()) {
        Value *index = gep->getOperand(idx+1);
        if (SMAP->contains(index)) {
            // P[v->sv] // sv is a new symbolic value
            // Value *a = gep->getPointerOperand();
            // ptr = (a index)  
            //SymbolPtr Sindex = SMAP->get(index);
            //PMAP->createGepOp(ptr, a, Sindex);
            
            // Incompleteness: pointer dereferencement on symbolic value
            AllLocDefinite = false;
        } else {
            // P = P - ptr
            PMAP->remove(ptr);
        }
    }
    // Global allocation
    /*else if(isa<GlobalVariable>(ptr)) {
        // ptr in domain(P)
        if (PMAP->contains(ptr)) {
            SymbolPtr Pptr = PMAP->get(ptr);
            // P' = P[ptr->S(val)]
            PMAP->update(ptr, Pptr);
        } else {
            // P = P - ptr
            PMAP->remove(ptr);
        }
    }*/
}

  // This is the main body of our code.
  virtual bool runOnFunction(Function &F){
    errs() << " ----- Starting Range Checking Pass on Function " <<  F.getName() << " ------ \n\n";
    
    //Module* M = F.getParent();
    
    //DataLayout* dl = M->getDataLayout();
    
    RAFlowFunction raf = RAFlowFunction();
    
    std::map<Value*, ConstantRange*> representation;
    
    /*
    errs() << "We are dealing with the following function \n";
    F.print(errs());
    errs() << "Our analysis returned the following \n";
    */
    
    RALatticePoint* bottom = new RALatticePoint(true, false, representation);
    std::map<Instruction *, LatticePoint *> result = Analysis::analyze(F, bottom, &raf);
    
    int i = 1;
    bool has_range_warnings = false;
    for (inst_iterator I = inst_begin(F), E = inst_end(F); I != E; ++I){
      Instruction* current_instruction = &*I;
      LatticePoint* lp = result[current_instruction];
      RALatticePoint* rlp = dyn_cast<RALatticePoint>(lp);
      
      if (isa<GetElementPtrInst>(current_instruction)) {
        GetElementPtrInst* gep = cast<GetElementPtrInst>(current_instruction);
        Type* pt = gep->getPointerOperandType();
        PointerType* pointer_type = dyn_cast<PointerType>(pt);
        
        Type* elm_type = pointer_type->getElementType();
        
        if (isa<ArrayType>(elm_type)) {
          ArrayType* arr_type = cast<ArrayType>(elm_type);
          //errs() << " number of elements is " << arr_type->getNumElements();
          int size = arr_type->getNumElements();

          
          Value* index = helper::getGEPIndex(*gep);

          if (rlp->representation.count(index) > 0) {
            APInt* max_size = new APInt(32, size);
            APInt* zero = new APInt(32, 0);
            
            ConstantRange* arr_range = new ConstantRange(*zero, *max_size);
            
            ConstantRange* index_range = rlp->representation[index];
            
            if (!arr_range->contains(*index_range)) {
              has_range_warnings = true;
              errs() << "Warning: possible out of bounds array access at line " << i;
              errs() << "\n-Instruction: ";
              gep->print(errs());
              errs() << "\n--- Valid array possitions: ";
              arr_range->print(errs());
              errs() << "\n--- Index has possible range: ";
              index_range->print(errs());
              errs() << "\n";
            }
            
          }
          else if (isa<ConstantInt>(index)){
            ConstantInt* index_value = cast<ConstantInt>(index);
            ConstantRange* index_range = new ConstantRange(index_value->getValue());
            
            APInt* max_size = new APInt(index_value->getBitWidth(), size - 1);
            APInt* zero = new APInt(index_value->getBitWidth(), 0);
            
            ConstantRange* arr_range = new ConstantRange(*zero, *max_size);
            
            if (!arr_range->contains(*index_range)) {
              has_range_warnings = true;
              errs() << "Warning: possible out of bounds array access at line " << i;
              errs() << "\n-Instruction: ";
              gep->print(errs());
              errs() << "\n--- Valid array possitions: ";
              arr_range->print(errs());
              errs() << "\n--- Index has possible range: ";
              index_range->print(errs());
              errs() << "\n";
            }
          }
        }
      }
      i++;
    }
    
    if (has_range_warnings) {
      errs() << "\nDone with range checking. Exited with warnings!\n\n";
    }
    else{
      errs() << "\nDone with range checking. Exited with no warnings.\n\n";

    }
    
    errs() << " ----- Ending Range Checking Pass on Function " <<  F.getName() << " ------ \n";
    
//.........这里部分代码省略.........