Expand description
Backward program slicer (DF-6).
Prepare a graph for backward slicing:
use weir::slice::prepare_slice_graph;
let graph = prepare_slice_graph(
2,
&[0, 1, 1],
&[1],
&[0xFFFF_FFFF],
).unwrap();
assert_eq!(graph.node_count(), 2);DF-6 - backward slicer.
Given a sink node s, emit the minimal sub-graph that may
affect it. Reduces to reverse reachability on the merged
dependence graph: walk backward from the sink, union-in
every predecessor along data dependences (DF-2 reaching, DF-3
points-to, DF-5 callgraph) and control dependences
(security::dominator_tree).
§Implementation
Reverse-BFS is
[csr_backward_traverse] applied to the caller-supplied
ProgramGraph. The caller merges reach, callgraph, and
dom into a single CSR before dispatch (dense-OR of three CSRs
- a one-kernel fusion via
fuse_programs). Theedge_kind_maskchannel already supports up to 32 independent edge kinds, so we admit every kind withu32::MAX- the slicer is intentionally maximal, and false-positives are filtered by the downstream rule.
§Soundness
MayOver. Rules requiring zero-FP
pair this slicer with a sanitizer filter on each edge in the
returned slice.
Structs§
- Backward
Slice - Marker type for the backward-slice dataflow primitive.
- Slice
Family
Functions§
- backward_
slice - Build one reverse-BFS step. Caller invokes this Program in a host loop until the slice bitset stops growing (same fixpoint driver pattern as DF-2 reaching, DF-3 points-to).
- backward_
slice_ with_ shape Deprecated - Deprecated alias for back-compat with callers that imported the
pre-fix
backward_slice_with_shapename. - prepare_
slice_ graph - prepare_
slice_ graph_ into - Repack backward-slice graph buffers into an existing prepared graph.
- prepare_
slice_ graph_ with_ scratch - Prepare backward-slice graph buffers using caller-owned scratch.
- prepare_
slice_ plan - Prepare backward-slice graph buffers and Program once for repeated runs.
- prepare_
slice_ plan_ into - Repack backward-slice graph buffers and refresh the emitted Program in place.
- slice_
closure_ borrowed_ into_ result_ with_ scratch_ via - slice_
closure_ borrowed_ into_ via - slice_
closure_ borrowed_ into_ with_ scratch_ via - slice_
closure_ borrowed_ via - slice_
closure_ plan_ borrowed_ into_ result_ with_ scratch_ via - slice_
closure_ plan_ borrowed_ into_ with_ scratch_ via - slice_
closure_ prepared_ borrowed_ into_ result_ with_ scratch_ via - slice_
closure_ prepared_ borrowed_ into_ with_ scratch_ via - slice_
closure_ resident_ plan_ with_ backend_ scratch - slice_
closure_ resident_ plan_ with_ backend_ scratch_ into - slice_
closure_ resident_ plan_ with_ reusable_ frontier_ scratch - slice_
closure_ resident_ plan_ with_ reusable_ frontier_ scratch_ into - slice_
closure_ resident_ plan_ with_ reusable_ frontier_ scratch_ sequence_ window - slice_
closure_ resident_ plan_ with_ reusable_ frontier_ scratch_ sequence_ window_ into - slice_
closure_ resident_ plan_ with_ scratch - slice_
closure_ resident_ plan_ with_ scratch_ into - slice_
closure_ via