SVF icon indicating copy to clipboard operation
SVF copied to clipboard

Steensgaard Points-to analysis bug.

Open mortkever opened this issue 7 months ago • 5 comments

Hello,

When I tried to compare Andersen and Steensgaard, i noticed that there was a lot less overlap in the points-to sets then i expected. Through some trial and error I found that calling analyze again after the creation of the singleton produced sets with a much larger intersection.

auto svfModule = SVF::LLVMModuleSet::getLLVMModuleSet()->getSVFModule(); 
SVF::SVFIRBuilder svfbuilder{svfModule}; 
auto svfIR = svfbuilder.build(); 
SVF::Andersen *andersenPta = SVF::AndersenWaveDiff::createAndersenWaveDiff(svfIR); 
SVF::Steensgaard *steensgaardPta = SVF::Steensgaard::createSteensgaard(svfIR); 
steensgaardPta->analyze(); 
// andersenPta->analyze();

I wouldn't expect this to be necessary as analyze is already called when the singleton is created.

Strangely if I try the same for Andersen, the analysis halts due to

SVF/svf/include/Graphs/GenericGraph.h:409: SVF::GenericGraph::NodeType *SVF::GenericGraph<SVF::SVFVar, SVF::SVFStmt>::getGNode(SVF::NodeID) const [NodeTy = SVF::SVFVar, EdgeTy = SVF::SVFStmt]: Assertion `it != IDToNodeMap.end() && "Node not found!"' failed.

Both problems seem unexpected behaviour especially because the analyze function is implemented in the common base class. Could someone look into this? These tests were done on benchmark.ll

mortkever avatar Mar 30 '25 19:03 mortkever