Accessing block metadata from ICFG graph nodes

[nikign]

trafficstars

We are trying to iterate over the nodes of the ICFG graph and extract information from the metadata of the blocks. While iterating, we face a segmentation fault trying to access the size of one of the blocks. We have checked and the block is not null. The code we are using is shown below:

uint64_t getBBCounter(const llvm::BasicBlock *BB) {

if(BB==NULL){ printf("\nBBConst is null\n"); return(-2); }

printf("\nBB pointer: %p ---\n", BB);

MDNode* BBid_meta = NULL; uint64_t block_counter;

if (BB->size() == 0) { printf("There is a basic block with no instructions in the program.\n"); exit(1); }
if (BB->getInstList().empty()){ printf("BB inst list was empty.\n"); return(-5); }

for (const Instruction& instr : BB->getInstList()) { if (!instr.hasMetadata()) { printf("The first instruction of the block should include block id, have you instrumented the code with set-counter-BBid-llvm-pass first?"); continue; } BBid_meta = instr.getMetadata("BBid"); break; }

if(!BBid_meta){ printf("\nSome block did not have ID in it\n"); return(-3); }

std::string meta_string = cast<MDString>(BBid_meta->getOperand(0))->getString();

block_counter = std::strtoull(meta_string.c_str(), NULL, 16);

printf("\n block id: %llu\n", block_counter);

return(block_counter); }

int main(int argc, char ** argv) { int arg_num = 0; char *arg_value = new char[argc]; std::vectorstd::string moduleNameVec; SVFUtil::processArguments(argc, argv, arg_num, arg_value, moduleNameVec); cl::ParseCommandLineOptions(arg_num, arg_value, "Whole Program Points-to Analysis\n");

SVFModule* svfModule = LLVMModuleSet::getLLVMModuleSet()->buildSVFModule(moduleNameVec);

WPAPass *wpa = new WPAPass();
wpa->runOnModule(svfModule);

ICFG *G = wpa->getPointerAnalysis()->getPAG()->getICFG();
for (const auto Node : nodes<ICFG*>(G)){
    const llvm::BasicBlock *Node_bb = Node->getBB();
    getBBCounter(Node_bb);
}
const std::string file_name = "icfg_custom_simple";
G->dump(file_name, true);

return 0;

}

[yuleisui]

Could you please attach your test cases including c file and bc file, and also the stack trace which triggered this crash?

[nikign]

I have uploaded the test-case here. The stack-trace from GDB is:

0x5555562c1308 ---

Program received signal SIGSEGV, Segmentation fault. 0x00005555555d3a92 in llvm::ilist_node_base::getNext (this=0x1) at /usr/local/google/home/nikign/SVF/llvm-10.0.0.obj/include/llvm/ADT/ilist_node_base.h:29 29 ilist_node_base *getNext() const { return Next; } quit) A debugging session is active. Inferior 1 [process 71797] will be killed.