@@ -21,6 +21,7 @@ This module defines interfaces and functionality for taint summaries.
21
21
#include < summaries/summary_dump.h>
22
22
#include < pointer-analysis/local_value_set_analysis.h>
23
23
#include < goto-programs/remove_returns.h>
24
+ #include < util/tmprof.h>
24
25
#include < util/std_types.h>
25
26
#include < util/file_util.h>
26
27
#include < util/msgstream.h>
@@ -71,6 +72,8 @@ void expand_external_objects(
71
72
const object_numbers_by_fieldnamet& by_fieldname,
72
73
const object_numberingt& taint_object_numbering)
73
74
{
75
+ TMPROF_BLOCK ();
76
+
74
77
// Whenever a value like external_value_set("external_objects.x") occurs,
75
78
// expand that to include the 'x' fields of all objects we know about,
76
79
// as what is external to the callee might be local to us.
@@ -112,6 +115,8 @@ void expand_external_objects(
112
115
113
116
static exprt transform_external_objects (const exprt& e)
114
117
{
118
+ TMPROF_BLOCK ();
119
+
115
120
if (e.id ()==ID_member && get_underlying_object (e).id ()==ID_external_value_set)
116
121
{
117
122
// Rewrite member(externals, "x") as externals("x"), to make subsequent
@@ -167,6 +172,8 @@ static void collect_lvsa_access_paths(
167
172
instruction_iteratort const & instit,
168
173
std::set<exprt> &result)
169
174
{
175
+ TMPROF_BLOCK ();
176
+
170
177
if (query_in.id ()==ID_side_effect)
171
178
{
172
179
side_effect_exprt const see=to_side_effect_expr (query_in);
@@ -245,6 +252,8 @@ static void collect_lvsa_access_paths(
245
252
lvalue_numbers_sett& result,
246
253
bool &singular)
247
254
{
255
+ TMPROF_BLOCK ();
256
+
248
257
std::set<exprt> referees;
249
258
collect_lvsa_access_paths (
250
259
query_in,
@@ -274,6 +283,8 @@ static void collect_lvsa_alias_access_paths(
274
283
object_numberingt& taint_object_numbering,
275
284
lvalue_numbers_sett& result)
276
285
{
286
+ TMPROF_BLOCK ();
287
+
277
288
value_setst::valuest dest;
278
289
lvsa.get_may_alias_values (inst_it, query_in, dest);
279
290
for (const exprt &object : dest)
@@ -288,6 +299,8 @@ static void collect_lvsa_access_paths(
288
299
instruction_iteratort const & instit,
289
300
object_numberingt& taint_object_numbering)
290
301
{
302
+ TMPROF_BLOCK ();
303
+
291
304
bool singular=false ;
292
305
293
306
collect_lvsa_access_paths (
@@ -308,6 +321,8 @@ static void populate_formals_to_actuals(
308
321
object_numberingt& taint_object_numbering,
309
322
formals_to_actuals_mapt& formals_to_actuals)
310
323
{
324
+ TMPROF_BLOCK ();
325
+
311
326
for (auto instit=prog.instructions .begin (),instend=prog.instructions .end ();
312
327
instit!=instend; ++instit)
313
328
{
@@ -382,6 +397,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
382
397
const numbered_lvalue_to_taint_mapt &a,
383
398
const numbered_lvalue_to_taint_mapt &b)
384
399
{
400
+ TMPROF_BLOCK ();
401
+
385
402
numbered_lvalue_to_taint_mapt result_dict;
386
403
if (a.get_base ()==b.get_base ())
387
404
{
@@ -428,6 +445,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
428
445
const numbered_lvalue_to_taint_mapt &a,
429
446
const numbered_lvalue_to_taint_mapt &b)
430
447
{
448
+ TMPROF_BLOCK ();
449
+
431
450
numbered_lvalue_to_taint_mapt result = a;
432
451
for (auto b_it=b.cbegin (); b_it!=b.cend (); ++b_it)
433
452
assign (result, b_it->first , b_it->second );
@@ -439,6 +458,8 @@ void taint_algorithm_computing_summary_of_functiont::assign(
439
458
taint_lvalue_numbert const lvalue,
440
459
const taint_sett &taint)
441
460
{
461
+ TMPROF_BLOCK ();
462
+
442
463
auto const it = map.find (lvalue);
443
464
if (it == map.end ())
444
465
{
@@ -454,6 +475,8 @@ void taint_algorithm_computing_summary_of_functiont::maybe_assign(
454
475
taint_lvalue_numbert const lvalue,
455
476
const taint_sett &taint)
456
477
{
478
+ TMPROF_BLOCK ();
479
+
457
480
auto const it = map.find (lvalue);
458
481
if (it == map.end ())
459
482
{
@@ -471,6 +494,8 @@ bool taint_algorithm_computing_summary_of_functiont::proper_subset(
471
494
const numbered_lvalue_to_taint_mapt &a,
472
495
const numbered_lvalue_to_taint_mapt &b)
473
496
{
497
+ TMPROF_BLOCK ();
498
+
474
499
if (b.empty ())
475
500
return false ;
476
501
bool common_base=a.get_base ()==b.get_base ();
@@ -492,6 +517,8 @@ bool taint_algorithm_computing_summary_of_functiont::subset(
492
517
const numbered_lvalue_to_taint_mapt &a,
493
518
const numbered_lvalue_to_taint_mapt &b)
494
519
{
520
+ TMPROF_BLOCK ();
521
+
495
522
return a==b || proper_subset (a,b);
496
523
}
497
524
@@ -506,6 +533,8 @@ void taint_algorithm_computing_summary_of_functiont::
506
533
const instruction_iteratort &Iit,
507
534
const irep_idt &caller_ident)
508
535
{
536
+ TMPROF_BLOCK ();
537
+
509
538
auto parameter_indices=fn_type.parameter_indices ();
510
539
511
540
for (const std::pair<taint_lvalue_numbert, taint_variablet>& input
@@ -568,6 +597,8 @@ void taint_algorithm_computing_summary_of_functiont::
568
597
const instruction_iteratort &Iit,
569
598
local_value_set_analysist &lvsa)
570
599
{
600
+ TMPROF_BLOCK ();
601
+
571
602
auto parameter_indices=fn_type.parameter_indices ();
572
603
573
604
for (const std::pair<taint_lvalue_numbert, taint_sett>& lvalue_taint :
@@ -650,6 +681,8 @@ void taint_algorithm_computing_summary_of_functiont::initialise_domain(
650
681
const std::map<goto_programt::const_targett, goto_programt::const_targetst>
651
682
&inst_predecessors)
652
683
{
684
+ TMPROF_BLOCK ();
685
+
653
686
// TODO: Improve this to only count as inputs those values which might be read
654
687
// without a preceding write within the same function.
655
688
lvalue_numbers_sett environment;
@@ -880,6 +913,8 @@ void taint_algorithm_computing_summary_of_functiont::handle_assignment(
880
913
instruction_iteratort const & Iit,
881
914
local_value_set_analysist &lvsa)
882
915
{
916
+ TMPROF_BLOCK ();
917
+
883
918
const auto & lhs_type=program->get_namespace ().follow (asgn.lhs ().type ());
884
919
if (lhs_type.id ()==ID_struct)
885
920
{
@@ -950,6 +985,8 @@ taint_sett taint_algorithm_computing_summary_of_functiont::
950
985
local_value_set_analysist &lvsa,
951
986
const numbered_lvalue_to_taint_mapt &a)
952
987
{
988
+ TMPROF_BLOCK ();
989
+
953
990
lvalue_numbers_sett numbers_of_aliases;
954
991
collect_lvsa_access_paths (
955
992
lvalue,
@@ -977,6 +1014,8 @@ void taint_algorithm_computing_summary_of_functiont::
977
1014
local_value_set_analysist &lvsa,
978
1015
numbered_lvalue_to_taint_mapt &result)
979
1016
{
1017
+ TMPROF_BLOCK ();
1018
+
980
1019
lvalue_numbers_sett numbers_of_aliases;
981
1020
bool singular=false ;
982
1021
collect_lvsa_access_paths (
@@ -1020,6 +1059,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
1020
1059
local_value_set_analysist &lvsa,
1021
1060
taint_transition_propertiest &transition_properties)
1022
1061
{
1062
+ TMPROF_BLOCK ();
1063
+
1023
1064
goto_programt::instructiont const & I=*Iit;
1024
1065
numbered_lvalue_to_taint_mapt result;
1025
1066
// Take a cheap read-only view of the incoming domain:
@@ -1028,6 +1069,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
1028
1069
{
1029
1070
case ASSIGN:
1030
1071
{
1072
+ TMPROF_BLOCK ();
1073
+
1031
1074
transition_properties[Iit].push_back (
1032
1075
{taint_transition_property_typet::ASSIGNMENT, taint_rule_idt{}, " " });
1033
1076
const code_assignt &asgn=to_code_assign (I.code );
@@ -1089,6 +1132,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
1089
1132
break ;
1090
1133
case FUNCTION_CALL:
1091
1134
{
1135
+ TMPROF_BLOCK ();
1136
+
1092
1137
const code_function_callt &fn_call = to_code_function_call (I.code );
1093
1138
const exprt &callee_expr = fn_call.function ();
1094
1139
if (callee_expr.id ()==ID_symbol)
@@ -1155,6 +1200,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
1155
1200
for (const taint_propagation_rulet &propagation_rule :
1156
1201
propagation_rules)
1157
1202
{
1203
+ TMPROF_BLOCK ();
1204
+
1158
1205
const taint_sett taint_from_rule =
1159
1206
propagation_rule.has_input_condition ()
1160
1207
? propagation_rule.apply (
@@ -1229,6 +1276,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
1229
1276
}
1230
1277
for (const taint_sanitizer_rulet &sanitizer_rule : sanitizer_rules)
1231
1278
{
1279
+ TMPROF_BLOCK ();
1280
+
1232
1281
const taintable_locationt &sanitized_location =
1233
1282
sanitizer_rule.get_sanitized_location ();
1234
1283
@@ -1280,6 +1329,8 @@ numbered_lvalue_to_taint_mapt taint_algorithm_computing_summary_of_functiont::
1280
1329
}
1281
1330
for (const taint_sink_rulet &sink_rule : sink_rules)
1282
1331
{
1332
+ TMPROF_BLOCK ();
1333
+
1283
1334
statistics->on_taint_analysis_apply_sink_rule (
1284
1335
sink_rule.get_id (), I.location_number );
1285
1336
@@ -1475,6 +1526,8 @@ void taint_algorithm_computing_summary_of_functiont::
1475
1526
taint_summaryt &summary,
1476
1527
const written_expressionst &written)
1477
1528
{
1529
+ TMPROF_BLOCK ();
1530
+
1478
1531
taint_sett end_values_taint;
1479
1532
const numbered_lvalue_to_taint_mapt &end_value_taints =
1480
1533
summary.domain .at (std::prev (fn_to_summarise.body .instructions .cend ()));
@@ -1537,6 +1590,8 @@ void taint_algorithm_computing_summary_of_functiont::
1537
1590
taint_summaryt::dbt &database,
1538
1591
local_value_set_analysist::dbt &lvsa_db)
1539
1592
{
1593
+ TMPROF_BLOCK ();
1594
+
1540
1595
const goto_functionst::function_mapt &functions=
1541
1596
program->get_functions ().function_map ;
1542
1597
const auto fn_iter=functions.find (function_id);
0 commit comments