Interprocedural Analysis Collects All Formal Parameters

[xiaobaozidi]

Hi,

Thank you for developing such an excellent LLVM slicing framework! I’m still new to using DG and have been experimenting with it on a toy example.

  1 #include <stdio.h>
  2 #include <stdlib.h>
  3 
  4 int compute(int a, int b, int c) {
  5 
  6     int x = a + b;
  7     int z;
  8     // Branch: Depending on the value of 'x', perform different operations
  9     if (x > 10) {
 10         z = a * 2;                     // If 'x' > 10, multiply 'y' by 2
 11     } else {
 12         z = b - 1;                     // If 'x' <= 10, subtract 1 from 'y'
 13     }
 14     
 15     int result = z + a;                  // Add 'a' to 'z'
 16 
 17     // Additional branching based on 'z' and 'a'
 18     if (z < a) {
 19         result = z - b;  //Slicing starting point
 20     } else {
 21         result = 10;
 22     }
 23     
 24     return result;              
 25 }   
 26 
 27 
 28 // New function to compute 'c' based on complex logic involving 'a' and 'b'
 29 int calculateC(int a, int b) {
 30     int c;
 31     if (a > b) { 
 32         c += a - b; // If 'a' is greater than 'b', increase 'c' by the difference
 33     } else { 
 34         c -= (b - a) / 2; // If 'b' is greater, decrease 'c' by half the difference
 35     }   
 36     
 37     return c;
 38 }   
 39 
 40 
 41 int main() {
 42     int a = 4;
 43     int b = 5;
 44     int c = 10;
 45     
 46     c = calculateC(a, b);
 47     
 48     while (b > 2){
 49        int result = compute(a, b, c);       
 50        printf("Result: %d\n", result);
 51        b--;
 52     }
 53     return 0;
 54 }  

I've noticed that when performing inter-procedural slicing, DG considers all formal parameters of the function and collects all of them. For example, in this code, when I attempt to slice from line 19 in the compute function, DG includes all formal parameters (a, b and c) and I get this result for the dependency:

./llvm-slicer -cutoff-diverging -pta fs -sc toy.c#compute#23#result toy.bc

./llvm-to-source toy.sliced 
4
6
7
9
10
12
15
18
19
29
30
31
32
34
37
42
43
44
46
48
49
51

However, the formal parameter c should not be included in the slice, as it does not influence the variable result when slicing is performed at line 19. In this case, because it collects parameter c, the calculateC function is also included in the dependency analysis. I understand that DG aims to avoid false negatives by maintaining a conservative analysis. However, I was curious if, internally, DG tracks which specific function parameters affect the slicing criterion when performing inter-procedural analysis?

Thanks a lot.