Skip to content

SVF CPP API

Jump to bottom
JoelYYoung edited this page Aug 11, 2026 · 38 revisions

SVFUtil

Members Meanings
SVF::SVFUtil::outs() return the output stream backed by std::cout
SVF::SVFUtil::isa<T>(value) return whether value is an instance of T
SVF::SVFUtil::cast<T>(value) cast from a parent class to a child class, asserting if the type is incorrect
SVF::SVFUtil::dyn_cast<T>(value) dynamically cast from a parent class to a child class, returning null if unsuccessful
SVF::LLVMUtil::getSourceLoc(const llvm::Value* value) return the source line and filename for an LLVM value
SVF::SVFUtil::isCallSite(const SVF::ICFGNode* node) return whether an ICFG node is a call site
SVF::LLVMUtil::isCallSite(const llvm::Instruction* inst) return whether an LLVM instruction is a call site
SVF::LLVMUtil::isIRFile(const std::string& filename) return whether a file is LLVM IR

ICFGNode

Members Meanings
SVF::ICFGNode::getId() return the node identifier
SVF::ICFGNode::getOutEdges() return the outgoing ICFG edges
SVF::ICFGNode::toString() return the node identifier, node kind, and corresponding program statement as a string
SVF::ICFGNode::getSVFStmts() return the program statements residing in this ICFG node
SVF::CallICFGNode::getRetICFGNode() return the corresponding RetICFGNode
SVF::RetICFGNode::getCallICFGNode() return the corresponding CallICFGNode
SVF::RetICFGNode::getActualRet() return the actual return variable
SVF::CallICFGNode::getActualParms() return the actual parameters

ICFGEdge

Members Meanings
SVF::ICFGEdge::getSrcNode() return the source ICFG node
SVF::ICFGEdge::getDstNode() return the destination ICFG node
SVF::ICFGEdge::isIntraCFGEdge() return whether it is an intra-procedural edge
SVF::ICFGEdge::isCallCFGEdge() return whether it is a call edge
SVF::ICFGEdge::isRetCFGEdge() return whether it is a return edge

Worklist operations

Members Meanings
SVF::WPASolver<GraphType>::isWorklistEmpty() return whether the worklist is empty; inherited by SVF::AndersenBase
SVF::WPASolver<GraphType>::popFromWorklist() remove and return a node identifier; inherited by SVF::AndersenBase
SVF::WPASolver<GraphType>::pushIntoWorklist(NodeID id) add a node identifier; inherited by SVF::AndersenBase

Points-to set operations

The following operations can be used for every pointer analysis implementation (e.g., AndersenPTA)

A points-to set, denoted as pts(ptr), in SVF is a mapping from pointer ptr to a set containing objects that ptr points to. Note that both the ptr and the objects are represented by identifiers (NodeID).

Members Meanings
SVF::BVDataPTAImpl::addPts(NodeID ptr, NodeID obj) add obj to the points-to set of ptr; return true if the set changes
SVF::BVDataPTAImpl::unionPts(NodeID ptr1, NodeID ptr2) union the points-to set of ptr2 into that of ptr1; return true if the set changes
SVF::BVDataPTAImpl::getPts(NodeID ptr) return the points-to set of ptr

Alias Relations

Two pointers (SVFVars) are aliases if their points-to sets share common object(s) determined by points-to analysis (e.g., AndersenPTA)

Members Meanings
SVF::BVDataPTAImpl::alias(NodeID ptr1, NodeID ptr2) return an SVF::AliasResult describing the alias relation
SVF::PointerAnalysis::mayAlias(NodeID ptr1, NodeID ptr2) return whether the two pointers may, must, or partially alias

ConstraintGraph, ConstraintNode and ConstraintEdge

Members Meanings
SVF::ConstraintGraph::getConstraintNode(NodeID id) return the ConstraintNode* identified by id
SVF::ConstraintGraph::hasEdge(ConstraintNode* src, ConstraintNode* dst, ConstraintEdge::ConstraintEdgeK kind) return whether the specified edge exists
SVF::ConstraintNode::getAddrInEdges() return all incoming address constraint edges
SVF::ConstraintNode::getAddrOutEdges() return all outgoing address constraint edges
SVF::ConstraintNode::getStoreInEdges() return all incoming store constraint edges
SVF::ConstraintNode::getStoreOutEdges() return all outgoing store constraint edges
SVF::ConstraintNode::getLoadInEdges() return all incoming load constraint edges
SVF::ConstraintNode::getLoadOutEdges() return all outgoing load constraint edges
SVF::ConstraintNode::getDirectInEdges() return all incoming copy/GEP constraint edges
SVF::ConstraintNode::getDirectOutEdges() return all outgoing copy/GEP constraint edges
SVF::ConstraintEdge::getSrcID() return the source node identifier
SVF::ConstraintEdge::getDstID() return the destination node identifier
SVF::ConstraintEdge::getSrcNode() return the source node
SVF::ConstraintEdge::getDstNode() return the destination node
AndersenPTA::addCopyEdge(NodeID src, NodeID dst) add a copy constraint edge; this teaching class is defined by Software-Analysis-Studio, not in namespace SVF
SVF::ConstraintGraph::addCopyCGEdge(NodeID src, NodeID dst) return the new CopyCGEdge*, or null if the edge already exists or is a self-edge

SVF::SVFUtil::outs()

  • Output the content of a node on ICFG

    For example,

     ICFGNode *inode = ...;  // subclass object CallICFGNode : %call = call i32 (...) @source(),
 SVFUtil::outs() << *inode << "\n"
 SVFUtil::outs() << inode->toString() << "\n"

    The output is IntraICFGNode 21 : %call = call i32 (...) @source() using one of the following two:

SVF::SVFUtil::isa<>()

  • The isa<> operator works similar to Java's “instanceof” operator. It returns true or false depending on whether a reference or pointer points to an instance of the specified class.

    For example,

    ICFGNode* inode subclass object is CallICFGNode so that we can use the following to check whether inode is of typeCallICFGNode:

    if (SVFUtil::isa<CallICFGNode>(inode)) { ... }

SVF::SVFUtil::cast<>()

  • Casting a pointer or reference to an instance of a specified class. This casting fails and abort the program if the object or reference is not the specified class at runtime.

    For example,

    SVFUtil::cast<CallICFGNode>(inode)->getParent()

SVF::SVFUtil::dyn_cast<>()

  • The dyn_cast<> operator is a "checking cast" operation. It checks to see if the operand is of the specified type, and if so, returns a pointer to it (this operator does not work with references). If the operand is not of the correct type, a null pointer is returned. Thus, this works very much like the dynamic_cast<> operator in C++, and should be used in the same circumstances.

    For example,

    if (CallICFGNode* callNode = SVFUtil::dyn_cast<CallICFGNode>(inode)) {
// ...
}

    This form of dyn_cast<> is an effective combination of isa<> and cast<> as below:

    if (SVFUtil::isa<CallICFGNode>(inode)) { 
     CallICFGNode* callNode =  SVFUtil::cast<CallICFGNode>(inode);
}

const std::string SVF::LLVMUtil::getSourceLoc(const llvm::Value* val)

  • return line number & file name of the original C/CPP source code

    For example,

    Assuming an instruction val is %call = call i32 (...) @sink() on line 6, use LLVMUtil::getSourceLoc(val) to obtain its source location.

bool SVF::LLVMUtil::isIRFile(const std::string& filename)

  • return true if a file is a LLVM IR file

const SVF::ICFGNode::SVFStmtList& SVF::ICFGNode::getSVFStmts() const

  • return the corresponding SVFStmtList of this ICFGNode,

    typedef std::list<const SVFStmt*> SVFStmtList;

    For example,

    Assuming that an ICFGNode* v represents %0 = load i32, ptr %a, obtain its statements with const ICFGNode::SVFStmtList& stmts = v->getSVFStmts().

SVF::ICFGNode::toString()

  • return the content of this ICFGNode in the form of a string consisting of the nodeID, llvm instructions and its containing function

    Output Sample: NodeID: 15\nIntraICFGNode ID: 15 store i32 1, i32* %a, align 4 \{fun: main\}}

Clone this wiki locally