Union-Find Alias Analyses (#820)

* Initial PAGBuilder

* Add UnionFind + minor

* Optional type-erasure for PBStrategy + add PBStrategyCombinator

* Add basic union-find based Steensgaard-style alias analysis (WIP)

* Add utility for UnionFindAAResults intersection and caching + make LLVM-based UnionFindAA compile

* Add alias-iterator for union-find alias-results

* Add LLVMUnionFindAliasIterator + NonNullPtr

* Start adding unit-tests for union-find-AA

* Fix PBMixin + add some comments

* Added more basic and context tests for pointers

* Small fix in IndirectionSensUnionFindAA::onAddValue

* Add summary-based union-find alias-analysis

* context tests with different depth

* renamed tests

* More context tests

* fixed error

* removed bad basic tests + expanded unittest

* added context_08 to unittest, fails

* added more context tests to unittest

* Add soundness to BottomupUnionFindAA

* Add convenience-functions to compute union-find alias info for LLVM

* minor

* added more tests + fixed some old ones

* Fixed context unit tests

* added CtxSens and IndirSens unittests

* Some fix in BottomupUnionFindAA

* Fix error due to merge

* Start adding LLVMUnionFindAliasSet (WIP)

* Continue with LLVMUnionFindAliasSet

* Integrate Union-Find-AA into phasar-cli

* debug information

* disabled context_01 indir test due to a crash

* Add library summar to PAG

* fixed Indir Context01

* fixed LLVMAliasSet tests

* Fixed Indir Context02, 03 and 04_0

* Enable passing LLVMFunctionDataFlowFacts into LLVMPAGBuilder

* added missing allocas to ground truths 01 - 04_0

* Fixed ground truth of Indir Context Tests til 08

* new basic03, added basic04, gt fixes til 10_1

* Last of Indir Context tests fixed

* New tests

* fixed cmakelists for cpp tests

* Indir Unittests output comments + 01, 02 half done

* indir unittests

* Add TracingPBStrategy to dump the PAG

* new indir tests + fixed crashes

* fixed some unittests

* fixed half of ctx-sens Context tests

* Nearly all ctx-sens context tests done

* FuncByName TestingSrcLocation

* Update breaking changes

* Fix CtxSensUnionFindAATest.Indirection01

* commit for merge

* Half of Indir Tests fixed

* all unittests working now

* test tool

* Fix LLVMUnionFindAliasSet dependency to phasar_llvm_controlflow

* Add README

* minor

* added other two analyses + results table

* fixed table formatting

* Some cleanup

* Add ValueIdMap to use as cache for alias-sets

* minor

* pre-commit

* Cleanup + bug fixing

* Add Doxygen comments to new alias-analysis headers

Documents edge types, concepts, strategy combinators, analysis variants
(BasicUnionFindAA, CallingContextSens, IndirectionSens, BottomupUnionFindAA),
LLVM adapters, and utility types (RawAliasSet, UnionFind, ValueCompressor,
TypedArray, CallingContextConstructor).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* minor

* Make ValueIdMap allocator-aware

* Extend ValueIdMap STL API: range ctor, ilist ctor/assign, erase(const_iterator), operator==, max_size

- Add iterator-range constructor with O(1) reserve for random-access iterators
- Add initializer_list constructor (delegating to range ctor) and assignment operator,
  both accepting any V constructible to ValueT to avoid unnecessary copies
- Replace erase(iterator) with erase(const_iterator) per STL convention
- Add operator== hidden friend: compares IsSet bitsets first, then values directly
  via slot() without find(), for lower constant vs. a naive lookup-per-element
- Add max_size() capped at INT_MAX (llvm::BitVector internal limit)
- Add missing type aliases: difference_type, reference, const_reference, pointer,
  const_pointer
- Add #include <limits> and <initializer_list>

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* LLVM 17 compatibility

* Fix library-summary relocation with C++20 modules

* Fix new dependency of phasar_llvm_pointer to phasar_controlflow

* ci: ccache dedup per llvm version

* Silence self-assign warning in SelfAssign test for ValueIdMap

---------

Co-authored-by: mxHuber <huber.maximilian.leo@gmail.com>
Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: 3 people

.github/workflows/ci.yml

@@ -51,7 +51,7 @@ jobs:
       - name: ccache  # This should always come after the actions/checkout step.
         uses: hendrikmuhs/ccache-action@v1.2
         with:
-          key: ${{ github.job }}-${{ matrix.os }}-${{ matrix.build }}
+          key: ${{ github.job }}-${{ matrix.os }}-llvm${{ matrix.llvm-version }}-${{ matrix.build }}
 
       - name: Install Phasar Dependencies
         shell: bash

.github/workflows/deploy-docs.yml

@@ -8,6 +8,7 @@ permissions:
   contents: write
 jobs:
   build-and-deploy:
+    if: github.repository == 'secure-software-engineering/phasar'
     runs-on: ubuntu-24.04
     strategy:
       fail-fast: true

BreakingChanges.md

@@ -2,6 +2,8 @@
 
 ## development HEAD
 
+- The function `HelperAnalyses::getAliasInfo()` no longer returns a `LLVMAliasSet &`, but a `LLVMAliasInfoRef`.
+- The location of the library summary `FunctionDataFlowFacts` and `LLVMFunctionDataFlowFacts` has moved to `phasar/Utils/` and `phasar/PhasarLLVM/Utils`, respectively.
 - `IDESolver::initialize()` does no longer return a `bool`. Now, you are always allowed to call `next()` at least once.
 - `IntraMonoProblem` and `InterMonoProblem`, and all reference-implementations of these problems do not receive a TypeHierarchy-pointer anymore in the ctor.
 - Requiring C++20 instead of C++17

CMakeLists.txt

@@ -410,7 +410,7 @@ if (PHASAR_ENABLE_WARNINGS)
   if (MSVC)
     string(APPEND CMAKE_CXX_FLAGS " /W4")
   else()
-    string(APPEND CMAKE_CXX_FLAGS " -Wall -Wextra -Wno-unused-parameter")
+    string(APPEND CMAKE_CXX_FLAGS " -Wall -Wextra -Wno-unused-parameter -Werror=return-type")
   endif()
 endif (PHASAR_ENABLE_WARNINGS)
 

include/phasar/ControlFlow/CallGraphBase.h

@@ -12,8 +12,14 @@
 
 #include "phasar/Utils/ByRef.h"
 #include "phasar/Utils/CRTPUtils.h"
+#include "phasar/Utils/Compressor.h"
+#include "phasar/Utils/GraphTraits.h"
+#include "phasar/Utils/IotaIterator.h"
+#include "phasar/Utils/NonNullPtr.h"
 #include "phasar/Utils/TypeTraits.h"
 
+#include "llvm/ADT/STLExtras.h"
+
 #include <concepts>
 #include <type_traits>
 
@@ -127,6 +133,92 @@ template <typename Derived> class CallGraphBase : public CRTPBase<Derived> {
 
   [[nodiscard]] constexpr bool empty() const noexcept { return size() == 0; }
 };
+
+/// A view over a call-graph that implements psr::GraphTraits on the
+/// getCallersOf() relation.
+/// Useful to compute CG-SCCs.
+template <typename CallGraphTy, typename DB> class ReverseCGGraph {
+  static constexpr bool NeedsMapping = !IdType<typename CallGraphTy::f_t>;
+
+  enum class FunctionIdImpl : uint32_t {};
+
+public:
+  using FunctionId = std::conditional_t<NeedsMapping, FunctionIdImpl,
+                                        typename CallGraphTy::f_t>;
+
+  constexpr ReverseCGGraph(
+      NonNullPtr<const CallGraphTy> CGView, NonNullPtr<const DB> IRDB,
+      Compressor<typename CallGraphTy::f_t, FunctionId> FC) noexcept
+    requires(NeedsMapping)
+      : CGView(CGView), IRDB(IRDB), FC(std::move(FC)) {}
+
+  constexpr ReverseCGGraph(NonNullPtr<const CallGraphTy> CGView,
+                           NonNullPtr<const DB> IRDB) noexcept
+      : CGView(CGView), IRDB(IRDB) {
+    FC.reserve(CGView->getNumVertexFunctions());
+    for (const auto &Fun : CGView->getAllVertexFunctions()) {
+      FC.insert(Fun);
+    }
+  }
+
+  NonNullPtr<const CallGraphTy> CGView;
+  NonNullPtr<const DB> IRDB;
+  [[no_unique_address]] std::conditional_t<
+      NeedsMapping, Compressor<typename CallGraphTy::f_t, FunctionId>,
+      NoneCompressor> FC{};
+};
+
+template <typename CallGraphTy, typename DB>
+ReverseCGGraph(NonNullPtr<const CallGraphTy>, NonNullPtr<const DB>)
+    -> ReverseCGGraph<CallGraphTy, DB>;
+template <typename CallGraphTy, typename DB>
+ReverseCGGraph(const CallGraphTy *, const DB *)
+    -> ReverseCGGraph<CallGraphTy, DB>;
+
+template <typename CallGraphTy, typename DB>
+struct GraphTraits<ReverseCGGraph<CallGraphTy, DB>> {
+  using graph_type = ReverseCGGraph<CallGraphTy, DB>;
+  using value_type = typename CallGraphTy::f_t;
+  using vertex_t = typename graph_type::FunctionId;
+  using edge_t = vertex_t;
+
+  static constexpr vertex_t Invalid = vertex_t(UINT32_MAX);
+
+  static constexpr auto mapToFunction(const graph_type &G) {
+    return [&G](ByConstRef<typename CallGraphTy::n_t> Inst) {
+      const auto &Fun = G.IRDB->getFunctionOf(Inst);
+      return G.FC.getOrNull(Fun).value();
+    };
+  }
+
+  static constexpr auto outEdges(const graph_type &G, vertex_t Vtx) {
+    return llvm::map_range(G.CGView->getCallersOf(G.FC[Vtx]), mapToFunction(G));
+  }
+
+  static constexpr decltype(auto) nodes(const graph_type &G) {
+    return G.CGView->getAllVertexFunctions();
+  }
+
+  // TODO: Roots
+
+  static constexpr auto vertices(const graph_type &G) {
+    return iota<vertex_t>(G.CGView->getNumVertexFunctions());
+  }
+
+  static constexpr decltype(auto) node(const graph_type &G, vertex_t Vtx) {
+    return G.FC[Vtx];
+  }
+
+  static constexpr size_t size(const graph_type &G) {
+    return G.CGView->getNumVertexFunctions();
+  }
+
+  static constexpr vertex_t target(edge_t Edge) { return Edge; }
+  static constexpr vertex_t withEdgeTarget(edge_t /*Edge*/, vertex_t Vtx) {
+    return Vtx;
+  }
+};
+
 } // namespace psr
 
 #endif // PHASAR_CONTROLFLOW_CALLGRAPHBASE_H

include/phasar/DB/ProjectIRDBBase.h

@@ -10,6 +10,7 @@
 #ifndef PHASAR_DB_PROJECTIRDBBASE_H
 #define PHASAR_DB_PROJECTIRDBBASE_H
 
+#include "phasar/Utils/ByRef.h"
 #include "phasar/Utils/Nullable.h"
 #include "phasar/Utils/TypeTraits.h"
 
@@ -84,6 +85,13 @@ class LLVM_DEPRECATED(
     return self().hasFunctionImpl(FunctionName);
   }
 
+  /// Returns the function that contains the given instruction Inst.
+  /// Each instruction must be part of a function.
+  [[nodiscard]] f_t getFunctionOf(ByConstRef<n_t> Inst) const {
+    assert(isValid());
+    return self().getFunctionOfImpl(Inst);
+  }
+
   /// Returns the global variable if available, nullptr/nullopt
   /// otherwise.
   [[nodiscard]] Nullable<g_t>

include/phasar/DataFlow/IfdsIde/Solver/Compressor.h

@@ -9,27 +9,6 @@
 
 namespace psr {
 
-struct NoneCompressor final {
-  constexpr NoneCompressor() noexcept = default;
-
-  template <typename T>
-    requires(!std::is_same_v<NoneCompressor, T>)
-  constexpr NoneCompressor(const T & /*unused*/) noexcept {}
-
-  template <typename T>
-  [[nodiscard]] decltype(auto) getOrInsert(T &&Val) const noexcept {
-    return std::forward<T>(Val);
-  }
-  template <typename T>
-  [[nodiscard]] decltype(auto) operator[](T &&Val) const noexcept {
-    return std::forward<T>(Val);
-  }
-  void reserve(size_t /*unused*/) const noexcept {}
-
-  [[nodiscard]] size_t size() const noexcept { return 0; }
-  [[nodiscard]] size_t capacity() const noexcept { return 0; }
-};
-
 class LLVMProjectIRDB;
 
 /// Once we have fast instruction IDs (as we already have in IntelliSecPhasar),

include/phasar/PhasarLLVM/ControlFlow/VTA/TypePropagator.h

@@ -11,6 +11,7 @@
 #define PHASAR_PHASARLLVM_CONTROLFLOW_TYPEPROPAGATOR_H
 
 #include "phasar/PhasarLLVM/ControlFlow/VTA/TypeAssignmentGraph.h"
+#include "phasar/Utils/SCCId.h"
 #include "phasar/Utils/TypedVector.h"
 
 #include "llvm/ADT/DenseSet.h"
@@ -22,7 +23,6 @@ class Value;
 } // namespace llvm
 
 namespace psr {
-template <typename GraphNodeId> struct SCCId;
 template <typename GraphNodeId> struct SCCHolder;
 template <typename GraphNodeId> struct SCCDependencyGraph;
 template <typename GraphNodeId> struct SCCOrder;

include/phasar/PhasarLLVM/DB/LLVMProjectIRDB.h

@@ -189,6 +189,11 @@ class LLVMProjectIRDB : public ProjectIRDBBase<LLVMProjectIRDB> {
   hasFunctionImpl(llvm::StringRef FunctionName) const noexcept {
     return Mod->getFunction(FunctionName) != nullptr;
   }
+  [[nodiscard]] f_t getFunctionOfImpl(n_t Inst) const {
+    assert(Inst != nullptr);
+    return Inst->getFunction();
+  }
+
   [[nodiscard]] g_t
   getGlobalVariableImpl(llvm::StringRef GlobalVariableName) const;
   [[nodiscard]] g_t