pub struct FunctionSummary {Show 17 fields
pub function_id: FunctionId,
pub version: u64,
pub return_effects: Vec<ReturnEffect>,
pub memory_effects: Vec<MemoryEffect>,
pub allocation_effects: Vec<AllocationEffect>,
pub callees: BTreeSet<CalleeRef>,
pub role: Option<SummaryRole>,
pub pure: bool,
pub noreturn: bool,
pub param_nullness: BTreeMap<u32, SummaryNullness>,
pub return_nullness: Option<SummaryNullness>,
pub taint_propagation: Vec<SummaryTaintPropagation>,
pub return_bound: Option<SummaryComputedBound>,
pub param_freed: BTreeMap<u32, bool>,
pub param_dereferenced: BTreeMap<u32, bool>,
pub source: SummarySource,
pub precision: SummaryPrecision,
}Expand description
A compact, serializable description of a function’s pointer and memory behavior.
This is the universal exchange format for function behavior information. Summaries can originate from YAML specs, static analysis, or default conservative assumptions, and are used by incremental and compositional analyses to avoid re-analyzing unchanged functions.
Fields§
§function_id: FunctionIdThe function this summary describes.
version: u64Monotonically increasing version for cache invalidation.
return_effects: Vec<ReturnEffect>Effects on the return value (aliasing, fresh allocation).
memory_effects: Vec<MemoryEffect>Memory read/write side effects.
allocation_effects: Vec<AllocationEffect>Allocation effects (heap/stack objects created by this function).
callees: BTreeSet<CalleeRef>Known callees (direct and indirect).
role: Option<SummaryRole>High-level role (allocator, source, sink, etc.).
pure: boolWhether the function is pure (no side effects, result depends only on inputs).
noreturn: boolWhether the function never returns (e.g., exit, abort).
param_nullness: BTreeMap<u32, SummaryNullness>Per-parameter nullness classification.
return_nullness: Option<SummaryNullness>Return value nullness classification.
taint_propagation: Vec<SummaryTaintPropagation>Taint propagation rules.
return_bound: Option<SummaryComputedBound>Computed return value bound relative to a parameter property.
param_freed: BTreeMap<u32, bool>Per-parameter: whether the callee frees this parameter.
param_dereferenced: BTreeMap<u32, bool>Per-parameter: whether the callee dereferences this parameter.
source: SummarySourceHow this summary was produced.
precision: SummaryPrecisionPrecision guarantee.
Implementations§
Source§impl FunctionSummary
impl FunctionSummary
Sourcepub fn default_for(function_id: FunctionId) -> Self
pub fn default_for(function_id: FunctionId) -> Self
Create a new default (conservative) summary for the given function.
Sourcepub fn save(&self, cache_dir: &Path) -> Result<(), Error>
pub fn save(&self, cache_dir: &Path) -> Result<(), Error>
Save this summary to {cache_dir}/summaries/{function_id_hex}.json.
Creates the summaries/ subdirectory if it does not exist.
§Errors
Returns an I/O error if the directory cannot be created or the file cannot be written.
Sourcepub fn load(
cache_dir: &Path,
function_id: &FunctionId,
) -> Result<Option<Self>, Error>
pub fn load( cache_dir: &Path, function_id: &FunctionId, ) -> Result<Option<Self>, Error>
Load a summary from {cache_dir}/summaries/{function_id_hex}.json.
Returns Ok(None) if the file does not exist.
§Errors
Returns an I/O error if the file exists but cannot be read or parsed.
Sourcepub fn from_spec(spec: &FunctionSpec, function_id: FunctionId) -> Self
pub fn from_spec(spec: &FunctionSpec, function_id: FunctionId) -> Self
Convert a FunctionSpec into a FunctionSummary.
This conversion is lossless: every spec field maps to a corresponding
summary field. The resulting summary has source = Spec and
precision = Sound (specs are assumed to be authoritative).
Sourcefn convert_return_spec(ret: &ReturnSpec, summary: &mut Self)
fn convert_return_spec(ret: &ReturnSpec, summary: &mut Self)
Helper: convert a ReturnSpec into summary return/allocation effects.
Sourcefn convert_taint_spec(taint: &TaintSpec, summary: &mut Self)
fn convert_taint_spec(taint: &TaintSpec, summary: &mut Self)
Helper: convert a TaintSpec into summary taint propagation rules.
Sourcefn taint_location_to_access_path(loc: TaintLocation) -> Option<AccessPath>
fn taint_location_to_access_path(loc: TaintLocation) -> Option<AccessPath>
Convert a TaintLocation to an AccessPath.
Returns None for TaintLocation::Unknown.
Sourcepub fn to_simple_spec(&self, name: &str) -> FunctionSpec
pub fn to_simple_spec(&self, name: &str) -> FunctionSpec
Convert this summary to a simple FunctionSpec (lossy).
Access paths are collapsed to parameter-level reads/modifies. Complex effects (field-sensitive access, deep dereferences) are simplified. The resulting spec preserves role, pure, noreturn, nullness, taint, and parameter-level read/write information.
Sourcefn access_path_root_param(path: &AccessPath) -> Option<u32>
fn access_path_root_param(path: &AccessPath) -> Option<u32>
Extract the root parameter index from an access path, if it is
rooted at a Param.
Sourcefn access_path_to_taint_location(path: &AccessPath) -> Option<TaintLocation>
fn access_path_to_taint_location(path: &AccessPath) -> Option<TaintLocation>
Convert an AccessPath to a TaintLocation (lossy).
Only Param and Return bases are representable; other paths
return None.
Trait Implementations§
Source§impl Clone for FunctionSummary
impl Clone for FunctionSummary
Source§fn clone(&self) -> FunctionSummary
fn clone(&self) -> FunctionSummary
1.0.0 · Source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source. Read more