c++ - LLVM:如何修复 "Referring to an argument in another function"

Question

我正在尝试在 LLVM 中编写一个函数传递来替换

read(file_descriptor, buffer, size) 用

klee_make_symbolic(缓冲区，大小，name_of_symbol)

但是，我在尝试重新使用旧函数的参数时遇到了一些麻烦。

运行我的函数 pass 会破坏新插入的函数。错误返回:

引用另一个函数中的参数!
调用 void @klee_make_symbolic(i8* %1, i64 %2, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @0, i32 0, i32 0)), !dbg !27
LLVM 错误:发现损坏的函数，编译中止!


这是我的代码的相关部分:

                    llvm::CallInst *CI = llvm::dyn_cast<llvm::CallInst>(&*I);
                    llvm::Function *func(CI->getCalledFunction());
                    llvm::StringRef func_name(func->getName());
                    for(std::string s : mksym_func_list){
                        if(func_name.equals(s)){
                            tmp = I;
                            flag = true;
                            llvm::errs() << *I << "\n";
                            I++;
                            llvm::errs() << *I << "\n";

                            llvm::IRBuilder<> builder(&*I);
                            std::vector<llvm::Value*> args(3, NULL);
                            if(func_name == "read"){
                                int counter = 0;
                                for(auto arg = func->arg_begin(); arg != func->arg_end(); arg++){
                                    if(counter == 1){
                                        //args[0] = builder.CreateAdd(llvm::dyn_cast<llvm::Value>(arg), llvm::ConstantInt::get(llvm::Type::getInt32Ty(context), 0, true));
                                        args[0] = arg;
                                    }else if(counter == 2){
                                        //args[1] = builder.CreateAdd(llvm::dyn_cast<llvm::Value>(arg), llvm::ConstantInt::get(llvm::Type::getInt64Ty(context), 0, true));
                                        args[1] = arg;
                                    }
                                    counter++;
                                }
                                llvm::Value *sym = builder.CreateGlobalStringPtr("test");
                                args[2] = sym;

                            llvm::errs() << "foge\n";
                            builder.CreateCall(func_mksym, args);

                            llvm::errs() << "unge\n";
                            llvm::errs() << "hage\n";
                            llvm::errs() << *I << "\n";
                            }
                            break;
                        }
                    }
                }
                if(!flag) I++; else flag = false;
            }

我希望 read 函数被替换为 klee_make_symbolic，但是 LLVM opt 工具返回错误。

编辑:

我已经更改了代码，以便它遍历操作数而不是参数。现在我能够检测代码，但现在程序本身在调用新函数时崩溃。

如果我手动将 read 替换为 klee_make_symbolic，程序就可以运行。但是当我使用 LLVM pass 时它仍然失败。

我什至检查了 .ll 文件以确认它没有任何问题。

调试.ll:

store i8** %1, i8*** %5, align 8
  call void @llvm.dbg.declare(metadata i8*** %5, metadata !16, metadata !DIExpression()), !dbg !17
  call void @llvm.dbg.declare(metadata [4 x i8]* %6, metadata !18, metadata !DIExpression()), !dbg !22
  %11 = getelementptr inbounds [4 x i8], [4 x i8]* %6, i32 0, i32 0, !dbg !23
  %12 = getelementptr inbounds [4 x i8], [4 x i8]* %6, i32 0, i32 0, !dbg !24
  %13 = call i64 @strlen(i8* %12) #4, !dbg !25
  %14 = call i64 @read(i32 0, i8* %11, i64 %13), !dbg !26
  call void @llvm.dbg.declare(metadata i32* %7, metadata !27, metadata !DIExpression()), !dbg !28
  %15 = getelementptr inbounds [4 x i8], [4 x i8]* %6, i64 0, i64 0, !dbg !29

debug_mksym.ll:

store i8** %1, i8*** %5, align 8
  call void @llvm.dbg.declare(metadata i8*** %5, metadata !16, metadata !DIExpression()), !dbg !17
  call void @llvm.dbg.declare(metadata [4 x i8]* %6, metadata !18, metadata !DIExpression()), !dbg !22
  %11 = getelementptr inbounds [4 x i8], [4 x i8]* %6, i32 0, i32 0, !dbg !23
  call void @klee_make_symbolic(i8* %11, i64 4, i8* getelementptr inbounds ([5 x i8], [5 x i8]* @0, i32 0, i32 0)), !dbg !24
  call void @llvm.dbg.declare(metadata i32* %7, metadata !25, metadata !DIExpression()), !dbg !24
  %12 = getelementptr inbounds [4 x i8], [4 x i8]* %6, i64 0, i64 0, !dbg !26

klee 的输出:

/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee -replay-path tests/debug/fprclap/debug-000.path tests/debug/obj/debug_symbolic.bc > tests/debug/fprclap/debug.out
KLEE: output directory is "/home/shinjitumala/E_DRIVE/TiTech/2019/undergraduate_research/CLAP/tests/debug/obj/klee-out-0"
KLEE: Using Z3 solver backend
KLEE: WARNING: undefined reference to function: printf
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_ZN4llvm3sys15PrintStackTraceERNS_11raw_ostreamE+0x2a)[0x5634b57be61a]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_ZN4llvm3sys17RunSignalHandlersEv+0x3e)[0x5634b57bc70e]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(+0x145a859)[0x5634b57bc859]
/usr/lib/libpthread.so.0(+0x13d00)[0x7fa2ab2d7d00]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_ZN4klee8Executor4forkERNS_14ExecutionStateENS_3refINS_4ExprEEEb+0x1ce2)[0x5634b468e6a2]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_ZN4klee8Executor18executeInstructionERNS_14ExecutionStateEPNS_12KInstructionE+0x4867)[0x5634b4699317]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_ZN4klee8Executor3runERNS_14ExecutionStateE+0x9fe)[0x5634b46a180e]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_ZN4klee8Executor17runFunctionAsMainEPN4llvm8FunctionEiPPcS5_+0xa7a)[0x5634b46a25fa]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(main+0x2d0f)[0x5634b463b52f]
/usr/lib/libc.so.6(__libc_start_main+0xf3)[0x7fa2aac77ee3]
/home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee(_start+0x2e)[0x5634b467875e]
/bin/sh: 1 行: 20587 Segmentation fault      (コアダンプ) /home/shinjitumala/E_DRIVE/TiTech/tools/klee/build-FPR/bin/klee -replay-path tests/debug/fprclap/debug-000.path tests/debug/obj/debug_symbolic.bc > tests/debug/fprclap/debug.out
make: *** [Makefile:46: fprclap] エラー 139

Answer 1

arg_* 迭代器迭代 Function 的形式参数。您实际上想要使用 value_op_begin()/value_op_end() 迭代 CallInst 的操作数。