refactor AE, use worklist algorithm(naive) #1786

bjjwwang · 2026-01-26T11:23:22Z

Pre-Requisite: Should Merge this Test Suite PR

Introduction: This PR replace wto with worklist algotihm, naive version.

May Need To Discuss: At svf/lib/AE/Svfexe/AbstractInterpretation.cpp line 145, I use a lambda code to build cycleHeadToCycle map. Maybe I can change it to a member function.

Next PR: Use-Def Pre-Analysis Map.

bjjwwang · 2026-01-26T11:41:43Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

+    // This maps cycle head nodes to their corresponding WTO cycles for efficient lookup
+    for (auto& [func, wto] : funcToWTO)
+    {
+        // Recursive lambda to collect cycle heads from nested WTO components


Remove lambda

yuleisui · 2026-01-29T16:44:05Z

Needs to fix this CI and move the precision-loss test case to a separate folder and address it after optimizations are enabled in later implementation.

codecov · 2026-01-30T23:53:55Z

Codecov Report

❌ Patch coverage is 85.81560% with 20 lines in your changes missing coverage. Please review.
✅ Project coverage is 64.14%. Comparing base (25f4c58) to head (d3b4fae).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
svf/lib/AE/Svfexe/AbstractInterpretation.cpp	85.81%	20 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1786      +/-   ##
==========================================
- Coverage   64.15%   64.14%   -0.01%     
==========================================
  Files         243      243              
  Lines       24569    24624      +55     
  Branches     4627     4657      +30     
==========================================
+ Hits        15762    15796      +34     
- Misses       8807     8828      +21

Files with missing lines	Coverage Δ
svf/include/AE/Svfexe/AbstractInterpretation.h	`95.23% <ø> (ø)`
svf/lib/AE/Svfexe/AbstractInterpretation.cpp	`79.10% <85.81%> (-1.48%)`	⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

I think you could continue to narrow down the usage of OPtions::HandleREcur(). I mean maybe you could put the option check inside the function. For example, "// Check if this recursive call should be skipped if (shouldSkipRecursiveCall(callNode, funObjVar)) { // In TOP mode, set return value and stores to TOP // In WIDEN\_ONLY/WIDEN\_NARROW, just skip (WTO handles it) if (Options::HandleRecur() == TOP) handleSkippedRecursiveCall(callNode); return; } " maybe you should move the if check inside the function. You could try this way to reduce the Options::handleRecur as low as possible.

yuleisui · 2026-02-02T00:32:42Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

           nonRecursiveCallSites.end();
 }

+/// Recursion Handling Decision Methods


Add examples for three cases.

describe what are set to top, where is widened and narrowed.

I think you could continue to narrow down the usage of OPtions::HandleREcur(). I mean maybe you could put the option check inside the function. For example, "// Check if this recursive call should be skipped if (shouldSkipRecursiveCall(callNode, funObjVar)) { // In TOP mode, set return value and stores to TOP // In WIDEN\_ONLY/WIDEN\_NARROW, just skip (WTO handles it) if (Options::HandleRecur() == TOP) handleSkippedRecursiveCall(callNode); return; } " maybe you should move the if check inside the function. You could try this way to reduce the Options::handleRecur as low as possible.

yuleisui · 2026-02-02T01:07:19Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

+}
+
+bool AbstractInterpretation::shouldApplyNarrowingInRecursion(const FunObjVar* fun)
+{


add an assertion if this is not recursion function.

yuleisui · 2026-02-02T01:17:15Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

+/// All recursion mode (TOP/WIDEN_ONLY/WIDEN_NARROW) logic is centralized here
+
+bool AbstractInterpretation::skipRecursiveCall(
+    const CallICFGNode* callNode, const FunObjVar* callee)


callNode is enough as the argument.

I think you could continue to narrow down the usage of OPtions::HandleREcur(). I mean maybe you could put the option check inside the function. For example, "// Check if this recursive call should be skipped if (shouldSkipRecursiveCall(callNode, funObjVar)) { // In TOP mode, set return value and stores to TOP // In WIDEN\_ONLY/WIDEN\_NARROW, just skip (WTO handles it) if (Options::HandleRecur() == TOP) handleSkippedRecursiveCall(callNode); return; } " maybe you should move the if check inside the function. You could try this way to reduce the Options::handleRecur as low as possible.

yuleisui · 2026-02-03T01:52:17Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

 }

-/// handle wto cycle (loop) using worklist-compatible widening/narrowing iteration
+/// Handle WTO cycle (loop or recursive function) using widening/narrowing iteration.


The name is ICFG cycle now?

maybe can rename handleICFGCycleOrRecursion.

HandleLoopOrRecursion. It would also be good to note that ICFGNode cycles refers to loops only, not interprocedural ICFGNode cycles

HandleLoopOrRecursion. It would also be good to note that ICFGNode cycles refers to loops only, not interprocedural ICFGNode cycles

Sure

yuleisui · 2026-02-03T01:54:42Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

-        // Skip recursive call if applicable (returns true if skipped)
-        if (skipRecursiveCall(callNode, funObjVar))
-            return;
+    const FunObjVar* callee = getCallee(callNode);


are we using the andersen's points-to result here?

I think handling indirectcall is the same as handling direct call if the calleenode is known? Can the code below be shared with the direct call handling.

are we using the andersen's points-to result here?

I think handling indirectcall is the same as handling direct call if the calleenode is known? Can the code below be shared with the direct call handling.

we use Address Domain here.
Yes, I am trying to merge them.

I think you could continue to narrow down the usage of OPtions::HandleREcur(). I mean maybe you could put the option check inside the function. For example, "// Check if this recursive call should be skipped if (shouldSkipRecursiveCall(callNode, funObjVar)) { // In TOP mode, set return value and stores to TOP // In WIDEN\_ONLY/WIDEN\_NARROW, just skip (WTO handles it) if (Options::HandleRecur() == TOP) handleSkippedRecursiveCall(callNode); return; } " maybe you should move the if check inside the function. You could try this way to reduce the Options::handleRecur as low as possible.

yuleisui · 2026-02-04T00:54:13Z

svf/include/AE/Svfexe/AbstractInterpretation.h

+     */
+    virtual void handleSVFStatement(const SVFStmt* stmt);
+
+    virtual void setRecursiveCallStoresToTop(const CallICFGNode* callnode);


setTopToObjInRecursion.

yuleisui · 2026-02-04T00:54:34Z

svf/include/AE/Svfexe/AbstractInterpretation.h

-    virtual void directCallFunPass(const CallICFGNode* callNode);
-    virtual bool isIndirectCall(const CallICFGNode* callNode);
-    virtual void indirectCallFunPass(const CallICFGNode* callNode);
+    virtual void callFunPass(const CallICFGNode* callNode);


HandleFunCall

你方便把 setRecursiveCallStoresToTop改名setTopToObjInRecursion 然后把callFunPass 改名HandleFunCall吗？改名就行

yuleisui · 2026-02-04T03:26:50Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

+        if (isExtCall(callNode))
        {
-            indirectCallFunPass(callNode);
+            extCallPass(callNode);


handleExtCall

yuleisui · 2026-02-04T03:27:11Z

svf/lib/AE/Svfexe/AbstractInterpretation.cpp

-            assert(false && "implement this part");
+        {
+            // Handle both direct and indirect calls uniformly
+            HandleFunCall(callNode);


handleFunCall

你方便把 setRecursiveCallStoresToTop改名setTopToObjInRecursion 然后把callFunPass 改名HandleFunCall吗？改名就行

refactor AE, use worklist algorithm(naive)

6846eb2

bjjwwang commented Jan 26, 2026

View reviewed changes

bjjwwang changed the title ~~refactor AE, use worklist algorithm(naive)~~ refactor AE, use worklist algorithm(naive) WIP Jan 26, 2026

bjjwwang added 2 commits January 28, 2026 15:26

sync with SSA Ass3

353871d

refactor recursion

3847a44

bjjwwang added 2 commits January 31, 2026 22:42

yuleisui reviewed Feb 2, 2026

View reviewed changes

bjjwwang added 7 commits February 2, 2026 16:25

yuleisui reviewed Feb 3, 2026

View reviewed changes

bjjwwang added 2 commits February 3, 2026 15:40

rename handleICFGCycle

bf793f8

yuleisui reviewed Feb 4, 2026

View reviewed changes

rename two functions in AbstractInterpretation (vibe-kanban 313b27a9)

76c2374

你方便把 setRecursiveCallStoresToTop改名setTopToObjInRecursion 然后把callFunPass 改名HandleFunCall吗？改名就行

bjjwwang changed the title ~~refactor AE, use worklist algorithm(naive) WIP~~ refactor AE, use worklist algorithm(naive) Feb 4, 2026

yuleisui reviewed Feb 4, 2026

View reviewed changes

bjjwwang added 2 commits February 4, 2026 14:52

rename two functions in AbstractInterpretation (vibe-kanban 313b27a9)

7fce768

你方便把 setRecursiveCallStoresToTop改名setTopToObjInRecursion 然后把callFunPass 改名HandleFunCall吗？改名就行

rename two functions in AbstractInterpretation (vibe-kanban 313b27a9)

d3b4fae

你方便把 setRecursiveCallStoresToTop改名setTopToObjInRecursion 然后把callFunPass 改名HandleFunCall吗？改名就行

yuleisui merged commit 85e1753 into SVF-tools:master Feb 4, 2026
5 checks passed

refactor AE, use worklist algorithm(naive) #1786

refactor AE, use worklist algorithm(naive) #1786

Conversation

bjjwwang commented Jan 26, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yuleisui commented Jan 29, 2026

Uh oh!

codecov bot commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov bot commented Jan 30, 2026 •

edited

Loading