diff options
| -rw-r--r-- | include/klee/Internal/Support/ModuleUtil.h | 6 | ||||
| -rw-r--r-- | lib/Core/StatsTracker.cpp | 6 | ||||
| -rw-r--r-- | lib/Module/ModuleUtil.cpp | 42 |
3 files changed, 35 insertions, 19 deletions
diff --git a/include/klee/Internal/Support/ModuleUtil.h b/include/klee/Internal/Support/ModuleUtil.h index 29adc94a..c85ba591 100644 --- a/include/klee/Internal/Support/ModuleUtil.h +++ b/include/klee/Internal/Support/ModuleUtil.h @@ -29,7 +29,11 @@ namespace klee { /// null if it cannot be determined (should be only for indirect /// calls, although complicated constant expressions might be /// another possibility). - llvm::Function *getDirectCallTarget(llvm::CallSite); + /// + /// If `moduleIsFullyLinked` is set to true it will be assumed that the + // module containing the `llvm::CallSite` is fully linked. This assumption + // allows resolution of functions that are marked as overridable. + llvm::Function *getDirectCallTarget(llvm::CallSite, bool moduleIsFullyLinked); /// Return true iff the given Function value is used in something /// other than a direct call (or a constant expression that diff --git a/lib/Core/StatsTracker.cpp b/lib/Core/StatsTracker.cpp index 97ed26ea..dbd86524 100644 --- a/lib/Core/StatsTracker.cpp +++ b/lib/Core/StatsTracker.cpp @@ -167,7 +167,8 @@ static bool instructionIsCoverable(Instruction *i) { } else { Instruction *prev = --it; if (isa<CallInst>(prev) || isa<InvokeInst>(prev)) { - Function *target = getDirectCallTarget(prev); + Function *target = + getDirectCallTarget(prev, /*moduleIsFullyLinked=*/true); if (target && target->doesNotReturn()) return false; } @@ -690,7 +691,8 @@ void StatsTracker::computeReachableUncovered() { // (which should be correct anyhow). callTargets.insert(std::make_pair(it, std::vector<Function*>())); - } else if (Function *target = getDirectCallTarget(cs)) { + } else if (Function *target = getDirectCallTarget( + cs, /*moduleIsFullyLinked=*/true)) { callTargets[it].push_back(target); } else { callTargets[it] = diff --git a/lib/Module/ModuleUtil.cpp b/lib/Module/ModuleUtil.cpp index a5394067..2cd41c89 100644 --- a/lib/Module/ModuleUtil.cpp +++ b/lib/Module/ModuleUtil.cpp @@ -436,23 +436,33 @@ Module *klee::linkWithLibrary(Module *module, #endif } - - -Function *klee::getDirectCallTarget(CallSite cs) { +Function *klee::getDirectCallTarget(CallSite cs, bool moduleIsFullyLinked) { Value *v = cs.getCalledValue(); - if (Function *f = dyn_cast<Function>(v)) { - return f; - } else if (llvm::ConstantExpr *ce = dyn_cast<llvm::ConstantExpr>(v)) { - if (ce->getOpcode()==Instruction::BitCast) - if (Function *f = dyn_cast<Function>(ce->getOperand(0)->stripPointerCasts())) - return f; - - // NOTE: This assert may fire, it isn't necessarily a problem and - // can be disabled, I just wanted to know when and if it happened. - assert(0 && "FIXME: Unresolved direct target for a constant expression."); - } - - return 0; + bool viaConstantExpr = false; + // Walk through aliases and bitcasts to try to find + // the function being called. + do { + if (Function *f = dyn_cast<Function>(v)) { + return f; + } else if (llvm::GlobalAlias *ga = dyn_cast<GlobalAlias>(v)) { + if (moduleIsFullyLinked || !(ga->mayBeOverridden())) { + v = ga->getAliasee(); + } else { + v = NULL; + } + } else if (llvm::ConstantExpr *ce = dyn_cast<llvm::ConstantExpr>(v)) { + viaConstantExpr = true; + v = ce->getOperand(0)->stripPointerCasts(); + } else { + v = NULL; + } + } while (v != NULL); + + // NOTE: This assert may fire, it isn't necessarily a problem and + // can be disabled, I just wanted to know when and if it happened. + assert((!viaConstantExpr) && + "FIXME: Unresolved direct target for a constant expression"); + return NULL; } static bool valueIsOnlyCalled(const Value *v) { |