ThreadEscape: Collect flow-insensitive set of variables reachable from globals#1075
ThreadEscape: Collect flow-insensitive set of variables reachable from globals#1075
ThreadEscape: Collect flow-insensitive set of variables reachable from globals#1075Conversation
…hem into local state on threadenter.
|
Two ideas:
|
Emit Escape event on all variables escaped on threadenter, not only those directly reachable from the thread create argument.
No, actually not. Another issue with the approach of retrieving the variables escaped via globals and the thread-create-parameter in the
This should be doable in principle, although I fear it may be quite expensive on larger programs. For sv-comp style code it may be worth doing though. |
|
Closed in favor of #1078 |
In #1074 it was discovered that in the analysis it is not communicated to a thread that variable may escape (via a global), after the thread has been created.
Previously, the analysis was adding variables that may become reachable via the argument passed to
pthreadcreate. This does not take into account that the escaping after the thread creation may also happen via global variables.This PR collects variables that are assigned to global variables separately under a flow-insensitive variable
global_var.In the
threadenter, the set of variables escaped to globals, that was collected flow-insensitively, is then joined into the local state.This increases the imprecision of the escape analysis, due to the flow-insensitive nature of the handling of variables escaped via globals. Such variables will be considered escaped even in unique threads before they have actually escaped.
Fixes #1074.