Simplification Pass DSA

[sadrabt]

Data Structure Analysis re implemented to use simplification pass functionality.
use flag --dsa none to generate constraints or --dsa norm to perform dsa
(both require --simplify)

The following are changes from the DSA as it exists in main (--analyse flag):

• Can perform DSA on CNTLM
• Separates Constraint generation from DSA (into SVA and Const Gen) which allows the constraints to be used in other analysis (future version of DSA or any other memory analysis which may have compatible constraints)
• Remove dependency on SAA which required interprocedural analysis prior to DSA making the results an underapproximate if calls weren't resolved DSA Stack Inconsistencies #267 and Remove Symbolic Address Analysis #273
• include and update region start points in nodes which allows analysis to determine which exact regions are represented by cells
• Global and Stack regions are represented by a single node instead of splitting into various nodes creating fewer merges
• Invariant checking (checks pointees are maintained through merges, and checks that all memory constraints are maintained through each phase)
• Cells are node, interval pairs instead of node, offset pairs with variable size
• Nodes only maintain a seq of non-overlapping cells instead of map from offsets to cells simplifying operations
• Slices are removed. Instead create dummy cells with intervals which are in the middle of the nodes' actual cell interval. This removes the need to update slices (solves bugs with cloning graphs without slice information ) Update stackMapping to Offset -> Cell #274. This means that nodes and cells could have references (point-to) cells with intervals that aren't updated to reflect join of overlapping cells. However, each node still maintains that its cells are non-overlapping. Use get() method to get the most updated version of a cell's interval (unified with all the interval of all the cells in its node that overlap). Additionally, all pointee operations such as setPointee, removePointee or hasPointee are performed on the actual cell corresponding to the dummy cell's intervals.
• Resolves some calls
• Unify graphs of procedures in SCCs

[ailrst]

Some initial comments

[ailrst]

We should make sure this is sound, there's a couple cases here making too-strong assumptions. The extract cases might be interesting to narrow with the known bits analysis (e.g. checking the high bits are zero for Extract(32, 0, body)) . We would probably also want to handle the case (R0 + R1 * constant). Maybe I'm missing something but it seems complex to expand this representation to arbitrary value analysis domains that don't represent every element, but I guess thats future work.

[sadrabt]

I think assuming that slicing/extracting a value preserves the pointers it represents (although it probably loses some precision). What is missing is that it could also represents other pointers but for the Extract(32, 0, body) case hopefully this is less of a concern since now we have 32 bit value.
For (R0 + R1 * constant), we could only handle it if for example R1 is a constant which will be removed in the copyprop.

[ailrst]

Can we add the indirect call tests with the DSA to see if it will solve them? Indirect calls are definitely not a priority since we only have one in cntlm but it would be interesting to know.

[ailrst]

I can't put comments on Constraints.scala cause its not in the review but it could use the iterator over the procedure directly i.e. for (c: CFGPosition <- proc) which will be more efficient than computeDomain but it will include non-reachable blocks.

[ailrst]

Invariant that every cell has a pointee cell? I'm not sure why if pointee is empty it creates a pointee

[ailrst]

Feel free to merge when you are happy with this