Repository navigation
Release v2610 - #870
Merged
Merged
Release v2610#870
Conversation
* Make the compose and join functions in the EdgeFunction implementations optional, if the IDETabulkationProblem impl provides extend and combine * Remove obsolete compose/join dummies from IDEFeatureTaintAnalysis * Use explicit vtable thunks in EdgeFunction to allow function merging + minor * Remove unnecessary inline
* Make most namespace-scope operators hidden friends * Remove now invalid operator-exports from module definitions * Remove some operator fwd decls and replace with direct inline impl * Aim for fixing CI with DebugLibDeps+Modules Apparently, some compiler versions do not export hidden friends with C++20 modules... * ci
* Decouple ICFG from analysis domain in IDESolver/IFDSSolver * Decouple ICFG from analysis domain in IterativeIDESolver * Better pretty-printing of StaticIDESolverConfig names * Use EndSummaryTab by default in IterativeIDESolver * Fix IFDSSolver ctor * Deprecate IDE/IFDSSolver_P typedefs * Fix deprecation warnings with IFDSSolver_P * minor * Fix invalid CRTP instantiation in IDESolver + update PathAwareIDESolver * minor
* Remove some deprecated APIs * Remove ProjectIRDBBase * Update BreakingChanges.md * Remove has_getAsJson from module * Remove ProjectIRDBTraits from c++20 modules * Remove ProjectIRDBBase
* Add dumpResults() to IdBasedSolverResults + auto-conversion from owning->non-owning * Integrate result[s]AtInLLVMSSA() into IdBasedSolverResults + fix dumpResults() * Fix missing explicit ctor invocation
* Make FlowFunctionPtrType a unique_ptr instead of a shared_ptr * Simplify FlowEdgeFunctionCache * Fix implicit pointer-->unique_ptr conversion + minor * Some fixes + some AI comments * Small addition to BreakingChanges.md * Fix EquivalenceClassMapNG::const_iterator
Also detected (and fixed) bug in TypeAssignmentGraph construction
* Make phasar compile with LLVM 22 * Fix debug-info retrieval with the new DbgRange concept in LLVM * Fix LLVMBasedICFG_OTFTest * Fix TaintConfigTest & LLVMUnionFindAATest with LLVM 22 * More fixes + backport fixes to LLVM 16 * Revert bumping the default LLVM version for now * Set new defaults + update CI * Adjust ci clang version * try fix ci * next attempt to fix ci * Adjust config of run_sample_programs to use the correct LLVM version * Update BUILD.md * Update InstallAptDependencies
) * Fix LLVMTaintConfig struct-field tainting mapping all struct types (#835) The StructConfigMap-building loop incorrectly mapped every identified LLVM struct type to the configured field name whenever any debug-info struct type matched the configured scope. This caused fields of unrelated struct types with the same name to be wrongly tainted. Fix: build the map by walking debug-declare records on allocas and correlating DICompositeType names with the alloca's allocated type, avoiding any dependency on LLVM IR type naming conventions. Performance: pre-build a StringMap (scope→name) so each alloca lookup is O(1) instead of O(|Variables|); replace double contains/at with a single find in the GEP check; add early-out when Config.Variables is empty. Boilerplate: extract forEachDbgDeclare and stripTypedefsToStruct into LLVMIRToSrc (LLVM-version-specific includes confined to the .cpp; header uses llvm::function_ref for a stable interface). Regression test: DataMember_02_Json verifies that X::A GEPs are sources while Y::A GEPs are not when only X is configured. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * Fix unittest::OperandOf::operator< * some smaller refactoring --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* Improve soundness and precision of UnionFindAA / LLVMPointerAssignmentGraph
- Model varargs: route extra pointer args through the callee's va_list
alloca via StorePOI edges (handleCallTarget).
- Fix constant GEP in handleOperand: only enqueue the pointer operand,
not integer index operands, avoiding spurious pointer merges.
- Remove dead isReturnVariable() branch from addDelayedEdges safety
fallback (return slots are always erased before that point).
- Enable field sensitivity for pointer parameters: extract
isAddressTakenImpl() from isAddressTakenVariable(), add
isAddressTakenArg() that bypasses the allocation-site guard, and use
it in handleGep so non-address-taken pointer args get GEP edges
instead of collapsing to their base.
- Filter return-slot ValueIds from BackwardView: add an optional
FilterFn predicate to consumeAAResults() on all UnionFindAA variants
and inject a !isReturnVariable() filter in computeUnionFindAARaw().
- Add doc comments clarifying intentional imprecision in
BasicUnionFindAA::onAddEdge and the K-slot constraint in
IndirectionSensUnionFindAA::onAddValue.
* Further small optimizations
* Let claude add some flow-sensitivity via MemorySSA
* Small improvements in MSSA handling
* Drastically improve alias-handling in PAG, allowing more merging on ValueCompressor-level
* Better ergonomics for AliasInfo->AliasIterator
* new results
* update readme
* Update ptaben version in readme
* Explicitly initialize TargetLibraryInfoImpl with an empty target triple to ensure compilation for LLVM >=21
* minor in readme
---------
Co-authored-by: mxHuber <huber.maximilian.leo@gmail.com>
* Add alternate API for sparse CFG information * Integrate new Sparse CFG API into IterativeIDESolver * Fix compilation * Fix issues identified by claude * Fix advanceToNextUserImplInternal with LLVM > 18
* Pull-in the WPDSSolver (TODO: value computation) * Add on-demand weight computation * Some cleanup * minor * Add IFDSRuleProvider * Consolidate IFDS and IDE RuleProvide into one to reduce code duplication (similar to how IterativeIDESolver approaches this) * Integrate sparse controlflow into WPDS analysis * Preventing warnings on compilers that do not support [[clang::lifetimebound]]
* Fix install with BUILD_SHARED_LIBS Shared libraries were not finding dependencies that are not installed at standard locations. * Add SOVERSION to shared phasar libraries for better detecting ABI issues
…puting getPointerIndicesOfType() (#843)
* Start adding MonoIFDS to phasar * Port rest of monoifds-solver * Add rest of monoifds to phasar * Integrating MonoIFDSTaintAnalysis into phasar-cli + make double_free01_c_dbg.ll pass (2nd test does not pass, though!!) * Fix ieration order + make tests pass * Add initializer to MonoIFDSSolver * Add some documentation + add summaryFlow() to MonoIFDS * Add unittest for MonoIFDS and make it pass * Add some more comments * Add shouldBeInSummary * minor * Make ICFG independent from analysis domain for MonoIFDSSolver * Add functionCompressor, usedGlobals, and CGSCCs to helperAnalyses to improve usability * minor * Some somments + renaming * domain * Some nullable-correctness in analyzeBlockImpl * Integrate MonoIFDS with HelperAnalyses * Use llvm::SmallBitVector in DataFlowEnvironment to match behavior presented in paper * monir stuff + some general changes that should go into their own PR (aliasinfo -> aliasiterator conversion) * As discussed, remove Eric from file headers * Add example, how to use MonoIFDS * pre-commit + readme * modules * llvm 22 * Fix dependency of UsedGlobals to ProjectIRDB * Fix MonoIFDSSolver typo * minor * Fix module compilation. Also use DummyFn in concept instead of lambda to prevent a clang-22 crash --------- Co-authored-by: Fabian Schiebel <fabian.schiebel@uni-paderborn.de>
* Update the readme * Section "How to use PhASAR?" should actually show, how to use phasar! * Update readme with WPDS * Add MonoIFDS solver feature to README
* Fix AccessPath comparison + some AI generated improvements in store EF * Compres kill-sets + fix monotoniticy in combine() * Perf improvement in applyTransforms * Caching edge functions + extend + combine * Internal interning of CFL edge functions to make all EdgeFunction<l_t> instances SOO. Also makes comparisons within the solver O(1) * small adjustments * Replace ad-hoc intrumentation with PAMM * minor * Measuring getResultEF performance * Some cleanup + some bugfix in walkLoadChainTo * Adapt the test * minor * Fix CFLFieldSensIFDSProblem for analyses that don't generate all aliases * minor
* Model Extern Callback Calls * Improve Extern Callback Model Validation * Validate Extern Callback Callee Types * Refine Extern Callback Model IR * Address extern callback review comments * Format call graph builder overload
* Initial vide-coded impl of andersen analysis with OTF CG construction
* Add online cycle detection
* Fix reference invalidation, missing retroactive firing, and arg aliasing in AndersenOTFSolver
- grow() may reallocate Nodes; all constraint methods now call every
grow() before indexing Nodes[X], and snapshot pts sets before any
addAssignEdge call that fires inside a foreach callback
- onNewPointee snapshots all four constraint lists upfront for the
same reason
- merge() snapshots NonRep vectors before any addAssignEdge call, and
retroactively fires load/store/memcopy constraints for Rep's merged
pts set (previously those constraints were silently dropped for
already-existing pointees)
- ConnectKnownTargets and checkUnresolvedFPCalls snapshot pts(FPId)
before iterating: connectCallee->propagate() can grow that set
- handleCall now collects all resolved IDs per argument (not just the
last one) via SmallVector<ValueId,2> per slot; FPCallRecord::Args
and connectCallee updated accordingly
- Add dedup guards (LoadDstSet, StoreSrcSet, MemCopyAs{Src,Dst}Set)
to NodeInfo to avoid redundant constraint firing
- Remove unused NoArgId sentinel and <cstdint> include
- Mark rep() [[nodiscard]]
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Vibe code some tests + identify bug that converts many alias sets into speensgaard sets
* Reduce the size of AndersenVar by half (sth the AI apparently could not do...)
* Add AndersenOTF tests for deep chains, recursion, and function pointers
- Fix OperandOf::operator< (was comparing R2.Inst instead of R1.Inst)
- DeepChainTwoObjectsMerge (context_04_1): three-level id chain with x/y
- RecursiveSelfAlias (context_08): SCC collapsing under self-recursion
- MutualRecursionAlias (context_10_0): Forth↔Back two-way recursion
- ReturnSecondArgContextInsensitive (context_12_1): argretq precision
- FuncPtrCallbackIdentity (context_14_1): OTF resolves indirect call
- RecursionTwoObjectsMerge (context_09_0): recursive with two objects
- MutualRecursionTwoObjects (context_10_1): mutual recursion, two objects
- ThreeWayMutualRecursion (context_11_0): Forth↔Back↔Stop recursion
- ThreeArgReturnQContextInsensitive (context_13_1): three-param function
- FuncPtrCallbackThreeWayMerge (context_14_2): three function pointers
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* Perf improvement in AndersOTFAA
* Vibe-code delta propagation
* Let AI write more tests
* Handle global initializers
* Reduce unnecessary copies
* Fix globals + fnptr handling
* Better vtable handling
* Fix minor bug in vtable handling + add failing test case for too early fixpoint
* Let claude fix the early fixpoint bug
* minor
* minor
* Expose call-graph built by AndersenOTFAA + add some configurable soundness with extern functions
* Debug missing callees in AndersenOTFAA
* minor perf improvement
* minor
* Add library-summary handling to AndersenOTFAA.
XXX: Should we allow passing-in an instance of LLVMFunctionDataFlowFacts?
* Best-effort approach to more precisely handle calls through hand-rolled vtables
* Small deduplication
* Small manual refactorings
* minor in test
* Add MemorySSA to AndersenOTFAA + let AI debug a soundness-bug.
Root-cause was integral stores being found as reaching definition for a ptr-load
* Add other lightweight alias oracles from LLVM to MemSSABundle for slightly better precision
* Remove stale commented-out debug print in handleCall
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
* pre-commit
* Fix compilation with LLVM > 19
* Add missing parts from phasarllvm/pointer to C++20 module
* Let AI fix a LLVM-version compatibility issue in AndersenOTFAATest
* Fix dependency between phasar_llvm_controlflow and phasar_llvm_pointer
* pre-commit
* Fix CRoaring install
* Fix small bug that pointer-params of entry-functions had no aliases + bump CRoaring + minor
* Let the AI add a special case for factory functions
* Allow analyzing a single file with the ptaben benchmark tool
* Guard AllocWrapper classification against escaping pointer uses
A function that mallocs and returns a pointer, but also leaks it to
another function beforehand (e.g. create_context() passing the pointer
to init_api_function(), which stores through it), was wrongly
classified as a plain allocation wrapper. Giving each call site of
such a function a fresh, disconnected object then silently dropped
whatever the escaping use wrote, causing indirect calls resolved
through the returned object's fields to see empty points-to sets and
report spurious NoAlias.
traceIsFreshAlloc now rejects the classification whenever the
allocated pointer (or anything derived from it via casts/PHIs/a local
spill-reload) is used for anything besides flowing to the return or
the standard null-check idiom.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmY8CXhusSXhR4MKMJ7Ex4
* Resolve heap/stack function-pointer dispatch tables field-sensitively
Track observed `store Function, GEP(base, const-indices)` writes per
allocation site and consult them in resolveStructVCall, extending the
existing const-global precedent to heap/stack objects. Any write that
doesn't provably match poisons the object, falling back to today's
sound over-approximation.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XmY8CXhusSXhR4MKMJ7Ex4
* Split FieldWriteRecord
* Fix TypedArray::enumerate with LLVM 22
* added anders-otf results to README
* Attempt to fix CI by explicitly disallowing march=native
* Use newer clang in CI to fix internal compiler error
---------
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: mxHuber <huber.maximilian.leo@gmail.com>
* Attempt to reduce overhead of PAMM counter increments * Rework PAMM counters to be more efficient in hot loops & less tedious to work with (getting the string names right, ...) * Make it possible to en/disable PAMM categories selectively * Rework PAMM histograms + rename REG_ macros to PAMM_ macros for better namespacing * Selective printing * Timers * Fix qualifiers() + some minor stuff * Make PAMM usable with unittests enabled + refactor PAMMTest * Add MinMaxCounter + remove unused initial-value for counters * Let AI reduce some boilerplate * Prevent different PAMM-element instances per IDESolver/FECache tmpl instantiation to improve compile-times * Deprecating the PAMM class * Add some thread-safety + comments * minor * Fix PAMM without thread-safety * Fix PAMM usage in merged-in CFLFieldSensIFDSProblem + fix Core sev level * Attempt to fix release builds in CI with ccache * Try to use newer clang to prevent internal compiler error with clang-20 in release mode * minor
* Make HelperAnalyses constructible with unique_ptr of LLVMProjectIRDB + improve entry-points and auto-globals handling in phasar-cli * Fix my mail address in README.dox * Make HA part of AnalysisController (no pointer indirection) * Refactor phasar-cli to use LLVM's zero-copy filesystem utilities instead of std::filesystem, which uses std::fiulesyste::path that is not compatible with anything in phasar * Remove unnecessary checks from phasar-cli * Deduplicate EntryPoints in AnalysisController + some restructuring in phasar-cli * Fix compilation of phasar-cli with LLVM 16 * Fix project-id construction
* Add PathAwareIterIDESolver * Add unit-test * Better HasNoCalleeInformation wiring * Fix call-flow/ctr-flow ordering bug in IterIDESolver
* initial context sensitivity * Keep points-to elements canonical to preserve object identity * Re-check fn-ptr callback entry points every round * Small update on ptaben benchmark tool * Let AI add failing test cases * Fix the AndersenOTFAA defects found in the review * Remove redundant set * Report invalid context-selection globs; annotate solver lifetimes * Retune the dynamic context-sensitivity defaults * Model punned pointer accesses in the PAG builder * Model atomicrmw and cmpxchg in the PAG builder * Recover aliases that addAlias could not record * Announce pre-populated ValueCompressor ids to the PAG strategy * Share the LLVM memory-access semantics between both PAG frontends * Annotate the union-find AA lifetimes with PSR_LIFETIMEBOUND * Clean up leftovers from the AndersenOTFAA review * Untrack the AndersenOTFAA context-sensitivity design doc * Dump IR to debug issue on ARM in CI * Attempt to fix issue on ARM * Unify UnionFindAAResult etc. to RawAAResult, making it fit for andersen results as well + integrate into HelperAnalyses * Fix double global-model construction + make LLVMProjectIRDB::insertFunction() more robust * Fix modules build after rename --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: mxHuber <huber.maximilian.leo@gmail.com>
* Add FlowFunctionFactory concept * Add EdgeFunctionFactory concept * Add IFDSProblem concept * Add IDEProblem * Use IDEProblem in IterativeIDESolver * Add IFDS/IDE problem-wrappers * flow-function abstraction * PSR_INTERNAL_LINKAGE * Add virtual wrapper for non-virtual ide problem * Make LegacyIDEProblemWrapper work for IFDS problems as well + integrate into IDESolver/IFDSSolver (Not testsed yet!) * Devirtualize IDELinearConstantAnalysis + create mixin to make transition easier * Integrate devirt IDEProblem into PathAwareIDESolver + several minor things * Devirt IFDSTaintAnalysis + make CFLFieldSensIFDSProblem compatible * minor * Devirtualize default Ifds/Ide problems * minor * Many small changes (mostly in FE-Cache) * Further devirtualize CFLFieldSensIFDSProblem * Devirtualize IIA * Devirtualize FTA + XTaint * Devirtualize TSA * Fix sample ifds program * minor * minor * Correct allTopFunction() for IFDS problems * Deprecate the ref-taking IFDSSolver ctor overload * Deprecate the overload of the IDESolver ctor that takes the problem by reference * small comment * Fix some issues * Let AI simplify the code a bit * Further simplificytion, based on guarantees of IFDSProblem/IDEPooblem concepts * minor * Attempt to fix CI caching * More explicit types + better Nullable * minor * Fix compilation with gcc * Reduce warnings by GCC * Fix IterIDESolver requirement * Use newer clang in CI to fix internal compiler error * Update BreakingChanges.md
* Remove TBB requirement, which is unused * A moved-from BitSet must be empty to prevent UB in ValueIdMap's dtor with non-trivial value-type * Improve .foreach()-style iteration with early-exit + add ValueIdMap::foreach * Fix DefaultIDESolverConfig with problem-concepts * Some fixes in sparse WPDS * Make CachedLLVMAliasIterator conform to the IsAliasInfo concept * Better CanEfficientlyPassByValue * minor * Small improvement in MemSSA * Improve sparsity in sparse-IDE/IFDS/WPDS
* added lit test suite for xtaint tests * moved lit comments to the bottom, so new tests added don't disrupt leak lines * added prefixes, ifds-fieldsens and fixed ideextaint prints * added ide-xtaint test lines after print fix * moved xtaint domain and printer selector * added custom target for lit tests * added Fabians double free tests * added xtaint lit test to both taint_analysis/double_free tests * added lit commands to df tests * added "No leaks found!" print for more clarity and better lit testing * Removed addition print, as it was moved in previous commit * added monoifds and sparse-ifds lit tests for double free tests * added mono and sparse ifds lit tests for xtaint tests * CMake Lit config + path substitutions * Fix xtaint tests + add cmake option PHASAR_ENABLE_INTEGRATIONTESTS + integrate into ci * Reverting obsolete artifacts * Install required apt package for lit / filecheck * Next attempt to fix ci * Next attempt to fix ci * Fix mono-ifds ground-truth * Fix paths in double-free tests * Next attempt to fix CI * Fix docker CI + bump checkout action * Remove phasar_pass from libphasar to prevent double-registration of cli options with shared libraries * modules * Fix df_21 compilation with clang-22 * Standalone lit test support --------- Co-authored-by: mxHuber <huber.maximilian.leo@gmail.com>
* Add callsite-level, source-located call graph export example * LLVM'ify the export_callsite_cg_streaming tool * minor --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com> Co-authored-by: Fabian Schiebel <fabianbs@mail.upb.de>
* Fix inconcistencies with LLVMIRToSrc * Fix compilation with GCC
* Bump cmake required version + add docs about build requirements * minor in docs * Move phasar+conan section * Update max tested CMake version to 4.2
* Add DFISolver: IFDS solving via DFS-interval reachability * Support followReturnsPastSeeds in DFISolver * Add dfi-taint to phasar-cli; pass CLI SolverConfig to ifds-taint * Add backward index direction to DFISolver * Small perf improvement in IterativeIDESolver by caching summary-ffs as well * minor * Remove the agent's design doc * Update readme + minor --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
* Remove TBB requirement, which is unused * A moved-from BitSet must be empty to prevent UB in ValueIdMap's dtor with non-trivial value-type * Improve .foreach()-style iteration with early-exit + add ValueIdMap::foreach * Fix DefaultIDESolverConfig with problem-concepts * Some fixes in sparse WPDS * Make CachedLLVMAliasIterator conform to the IsAliasInfo concept * Better CanEfficientlyPassByValue * minor * Small improvement in MemSSA * Improve sparsity in sparse-IDE/IFDS/WPDS * Set of misc changes * Add call-graph iteration + fix installation with tbb * Fix function types in TypeTraits + deprecate psr::identity * Fix tbb handling for install target
* Bump v2610 * Fix typo in BreakingChanges
fabianbs96
marked this pull request as ready for review
October 24, 2026 10:38
fabianbs96
requested review from
MMory,
janniclas,
pdschubert,
sritejakv and
vulder
as code owners
October 24, 2026 10:38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.