@eagleoutice/flowr 2.10.3 → 2.10.5

package/README.md

@@ -24,7 +24,7 @@ It offers a wide variety of features, for example:
     
     ```shell
     $ docker run -it --rm eagleoutice/flowr # or npm run flowr 
-    flowR repl using flowR v2.10.2, R grammar v14 (tree-sitter engine)
+    flowR repl using flowR v2.10.4, R grammar v14 (tree-sitter engine)
     R> :query @linter "read.csv(\"/root/x.txt\")"
     ```
     
@@ -39,13 +39,13 @@ It offers a wide variety of features, for example:
        ╰ File Path Validity (file-path-validity):
            ╰ certain:
                ╰ Path `/root/x.txt` at 1.1-23
-           ╰ Metadata: totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 1, processTimeMs: 0
+           ╰ Metadata: totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Seeded Randomness (seeded-randomness):
            ╰ Metadata: consumerCalls: 0, callsWithFunctionProducers: 0, callsWithAssignmentProducers: 0, callsWithNonConstantProducers: 0, callsWithOtherBranchProducers: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Absolute Paths (absolute-file-paths):
            ╰ certain:
                ╰ Path `/root/x.txt` at 1.1-23
-           ╰ Metadata: totalConsidered: 1, totalUnknown: 0, searchTimeMs: 0, processTimeMs: 0
+           ╰ Metadata: totalConsidered: 1, totalUnknown: 0, searchTimeMs: 1, processTimeMs: 0
        ╰ Unused Definitions (unused-definitions):
            ╰ Metadata: totalConsidered: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Naming Convention (naming-convention):
@@ -53,18 +53,18 @@ It offers a wide variety of features, for example:
        ╰ Network Functions (network-functions):
            ╰ Metadata: totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Dataframe Access Validation (dataframe-access-validation):
-           ╰ Metadata: numOperations: 0, numAccesses: 0, totalAccessed: 0, searchTimeMs: 0, processTimeMs: 1
+           ╰ Metadata: numOperations: 0, numAccesses: 0, totalAccessed: 0, searchTimeMs: 0, processTimeMs: 0
        ╰ Dead Code (dead-code):
            ╰ Metadata: consideredNodes: 5, searchTimeMs: 0, processTimeMs: 0
        ╰ Useless Loops (useless-loop):
            ╰ Metadata: numOfUselessLoops: 0, searchTimeMs: 0, processTimeMs: 0
-       ╰ Problematic eval (problematic-eval):
+       ╰ Problematic inputs (problematic-inputs):
            ╰ Metadata: searchTimeMs: 0, processTimeMs: 0
        ╰ Stop without call.=False argument (stop-call):
-           ╰ Metadata: consideredNodes: 0, searchTimeMs: 0, processTimeMs: 0
+           ╰ Metadata: consideredNodes: 0, searchTimeMs: 1, processTimeMs: 0
        ╰ Roxygen Arguments (roxygen-arguments):
            ╰ Metadata: searchTimeMs: 0, processTimeMs: 0
-    All queries together required ≈2 ms (1ms accuracy, total 2 ms)
+    All queries together required ≈2 ms (1ms accuracy, total 3 ms)
     ```
     
     
@@ -86,7 +86,7 @@ It offers a wide variety of features, for example:
     
     _Results (prettified and summarized):_
     
-    Query: **linter** (3 ms)\
+    Query: **linter** (2 ms)\
        ╰ **Deprecated Functions** (deprecated-functions):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalCalls: 0, totalFunctionDefinitions: 0, searchTimeMs: 1, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **File Path Validity** (file-path-validity):\
@@ -94,11 +94,11 @@ It offers a wide variety of features, for example:
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ Path `/root/x.txt` at 1.1-23\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalReads: 1, totalUnknown: 0, totalWritesBeforeAlways: 0, totalValid: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Seeded Randomness** (seeded-randomness):\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consumerCalls: 0, callsWithFunctionProducers: 0, callsWithAssignmentProducers: 0, callsWithNonConstantProducers: 0, callsWithOtherBranchProducers: 0, searchTimeMs: 1, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consumerCalls: 0, callsWithFunctionProducers: 0, callsWithAssignmentProducers: 0, callsWithNonConstantProducers: 0, callsWithOtherBranchProducers: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Absolute Paths** (absolute-file-paths):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ certain:\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ Path `/root/x.txt` at 1.1-23\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalConsidered: 1, totalUnknown: 0, searchTimeMs: 0, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalConsidered: 1, totalUnknown: 0, searchTimeMs: 1, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Unused Definitions** (unused-definitions):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>totalConsidered: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Naming Convention** (naming-convention):\
@@ -108,20 +108,20 @@ It offers a wide variety of features, for example:
     &nbsp;&nbsp;&nbsp;╰ **Dataframe Access Validation** (dataframe-access-validation):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>numOperations: 0, numAccesses: 0, totalAccessed: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Dead Code** (dead-code):\
-    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consideredNodes: 5, searchTimeMs: 1, processTimeMs: 0</code>\
+    &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consideredNodes: 5, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Useless Loops** (useless-loop):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>numOfUselessLoops: 0, searchTimeMs: 0, processTimeMs: 0</code>\
-    &nbsp;&nbsp;&nbsp;╰ **Problematic eval** (problematic-eval):\
+    &nbsp;&nbsp;&nbsp;╰ **Problematic inputs** (problematic-inputs):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Stop without call.=False argument** (stop-call):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>consideredNodes: 0, searchTimeMs: 0, processTimeMs: 0</code>\
     &nbsp;&nbsp;&nbsp;╰ **Roxygen Arguments** (roxygen-arguments):\
     &nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;╰ _Metadata_: <code>searchTimeMs: 0, processTimeMs: 0</code>\
-    _All queries together required ≈3 ms (1ms accuracy, total 3 ms)_
+    _All queries together required ≈2 ms (1ms accuracy, total 2 ms)_
     
     <details> <summary style="color:gray">Show Detailed Results as Json</summary>
     
-    The analysis required _2.5 ms_ (including parsing and normalization and the query) within the generation environment.
+    The analysis required _2.4 ms_ (including parsing and normalization and the query) within the generation environment.
     
     In general, the JSON contains the Ids of the nodes in question as they are present in the normalized AST or the dataflow graph of flowR.
     Please consult the [Interface](https://github.com/flowr-analysis/flowr/wiki/Interface) wiki page for more information on how to get those.
@@ -173,7 +173,7 @@ It offers a wide variety of features, for example:
               "callsWithAssignmentProducers": 0,
               "callsWithNonConstantProducers": 0,
               "callsWithOtherBranchProducers": 0,
-              "searchTimeMs": 1,
+              "searchTimeMs": 0,
               "processTimeMs": 0
             }
           },
@@ -193,7 +193,7 @@ It offers a wide variety of features, for example:
             ".meta": {
               "totalConsidered": 1,
               "totalUnknown": 0,
-              "searchTimeMs": 0,
+              "searchTimeMs": 1,
               "processTimeMs": 0
             }
           },
@@ -237,7 +237,7 @@ It offers a wide variety of features, for example:
             "results": [],
             ".meta": {
               "consideredNodes": 5,
-              "searchTimeMs": 1,
+              "searchTimeMs": 0,
               "processTimeMs": 0
             }
           },
@@ -249,7 +249,7 @@ It offers a wide variety of features, for example:
               "processTimeMs": 0
             }
           },
-          "problematic-eval": {
+          "problematic-inputs": {
             "results": [],
             ".meta": {
               "searchTimeMs": 0,
@@ -273,11 +273,11 @@ It offers a wide variety of features, for example:
           }
         },
         ".meta": {
-          "timing": 3
+          "timing": 2
         }
       },
       ".meta": {
-        "timing": 3
+        "timing": 2
       }
     }
     ```
@@ -342,7 +342,7 @@ It offers a wide variety of features, for example:
     
     ```shell
     $ docker run -it --rm eagleoutice/flowr # or npm run flowr 
-    flowR repl using flowR v2.10.2, R grammar v14 (tree-sitter engine)
+    flowR repl using flowR v2.10.4, R grammar v14 (tree-sitter engine)
     R> :query @static-slice (11@sum) file://test/testfiles/example.R
     ```
     
@@ -390,7 +390,7 @@ It offers a wide variety of features, for example:
          
 
 * 🚀 **fast call-graph, data-, and control-flow graphs**\
-  Within just [<i><span title="This measurement is automatically fetched from the latest benchmark!">100.4 ms</span></i> (as of Apr 2, 2026)](https://flowr-analysis.github.io/flowr/wiki/stats/benchmark), 
+  Within just [<i><span title="This measurement is automatically fetched from the latest benchmark!">100.2 ms</span></i> (as of Apr 8, 2026)](https://flowr-analysis.github.io/flowr/wiki/stats/benchmark), 
   _flowR_ can analyze the data- and control-flow of the average real-world R&nbsp;script. See the [benchmarks](https://flowr-analysis.github.io/flowr/wiki/stats/benchmark) for more information,
   and consult the [wiki pages](https://github.com/flowr-analysis/flowr/wiki/dataflow-graph) for more details on the [dataflow graphs](https://github.com/flowr-analysis/flowr/wiki/dataflow-graph) as well as [call graphs](https://github.com/flowr-analysis/flowr/wiki/dataflow-graph#perspectives-cg).
 
@@ -426,7 +426,7 @@ It offers a wide variety of features, for example:
     
     ```shell
     $ docker run -it --rm eagleoutice/flowr # or npm run flowr 
-    flowR repl using flowR v2.10.2, R grammar v14 (tree-sitter engine)
+    flowR repl using flowR v2.10.4, R grammar v14 (tree-sitter engine)
     R> :dataflow* test/testfiles/example.R
     ```
     
@@ -734,7 +734,7 @@ It offers a wide variety of features, for example:
     ```
     
     	
-    (The analysis required _1.6 ms_ (including parse and normalize, using the [tree-sitter](https://github.com/flowr-analysis/flowr/wiki/Engines) engine) within the generation environment.)
+    (The analysis required _1.8 ms_ (including parse and normalize, using the [tree-sitter](https://github.com/flowr-analysis/flowr/wiki/Engines) engine) within the generation environment.)
     
     
     
@@ -799,8 +799,25 @@ please check out flowR's [Zenodo archive](https://zenodo.org/doi/10.5281/zenodo.
 If you are interested in the theoretical background of _flowR_,
 please check out the following publications (if you find that a paper is missing here, please open [a new issue](https://github.com/flowr-analysis/flowr/issues/new/choose)):
 
+* [Supporting the Comprehension of Data Analysis Scripts (FSE '25, Tool)](https://doi.org/10.1145/3803437.3806402)  
+  This refers to an updated tool demonstration of the framework. Preprint available at <a href="https://doi.org/10.48550/arXiv.2604.15963" target="_blank">arXiv:2604.15963</a>.
+  <details><summary>BibTeX</summary>
+  
+   
+   ```bibtex
+   @article{10.1145/3803437.3806402,
+   	author = {Sihler, Florian and Gerstl, Oliver and Pfrenger, Lars and Schubert, Julian and Tichy, Matthias},
+   	title = {Supporting the Comprehension of Data Analysis Scripts},
+   	year = {2026},
+   	doi = {10.1145/3803437.3806402}
+   }
+   ```
+   
+  
+  </details>
+
 * [Statically Analyzing the Dataflow of R Programs (OOPSLA '25)](https://doi.org/10.1145/3763087)  
-  Please cite this paper if you are using flowR in your research.
+  **Please cite this paper if you are using flowR in your research.**
   <details><summary>BibTeX</summary>
   
    
@@ -829,7 +846,7 @@ please check out the following publications (if you find that a paper is missing
   </details>
 
 * [flowR: A Static Program Slicer for R (ASE '24, Tool)](https://doi.org/10.1145/3691620.3695359)  
-  This refers to the tool-demonstration of the <a href="https://marketplace.visualstudio.com/items?itemName=code-inspect.vscode-flowr">VS Code Extension</a>.
+  This refers to the tool-demonstration of the <a href="https://marketplace.visualstudio.com/items?itemName=code-inspect.vscode-flowr" target="_blank">VS Code Extension</a>.
   <details><summary>BibTeX</summary>
   
    

package/abstract-interpretation/absint-visitor.d.ts

@@ -1,37 +1,31 @@
-import type { ControlFlowInformation } from '../control-flow/control-flow-graph';
-import { CfgVertex } from '../control-flow/control-flow-graph';
-import type { SemanticCfgGuidedVisitorConfiguration } from '../control-flow/semantic-cfg-guided-visitor';
-import { SemanticCfgGuidedVisitor } from '../control-flow/semantic-cfg-guided-visitor';
+import { type CfgExpressionVertex, type CfgStatementVertex, CfgVertex, type ControlFlowInformation } from '../control-flow/control-flow-graph';
+import { SemanticCfgGuidedVisitor, type SemanticCfgGuidedVisitorConfiguration } from '../control-flow/semantic-cfg-guided-visitor';
 import { BuiltInProcName } from '../dataflow/environments/built-in-proc-name';
 import type { DataflowGraph } from '../dataflow/graph/graph';
 import { type DataflowGraphVertexFunctionCall, type DataflowGraphVertexVariableDefinition } from '../dataflow/graph/vertex';
-import type { NoInfo, RNode } from '../r-bridge/lang-4.x/ast/model/model';
+import { type NoInfo, RNode } from '../r-bridge/lang-4.x/ast/model/model';
 import type { NormalizedAst, ParentInformation } from '../r-bridge/lang-4.x/ast/model/processing/decorate';
 import type { NodeId } from '../r-bridge/lang-4.x/ast/model/processing/node-id';
 import { type AnyAbstractDomain } from './domains/abstract-domain';
-import type { StateAbstractDomain } from './domains/state-abstract-domain';
+import type { AnyStateDomain, ValueDomain } from './domains/state-domain-like';
 export type AbsintVisitorConfiguration = Omit<SemanticCfgGuidedVisitorConfiguration<NoInfo, ControlFlowInformation, NormalizedAst>, 'defaultVisitingOrder' | 'defaultVisitingType'>;
 /**
  * A control flow graph visitor to perform abstract interpretation.
  *
  * However, the visitor does not yet support inter-procedural abstract interpretation and abstract condition semantics.
  */
-export declare abstract class AbstractInterpretationVisitor<Domain extends AnyAbstractDomain, Config extends AbsintVisitorConfiguration = AbsintVisitorConfiguration> extends SemanticCfgGuidedVisitor<NoInfo, ControlFlowInformation, NormalizedAst, DataflowGraph, Config & {
+export declare abstract class AbstractInterpretationVisitor<StateDomain extends AnyStateDomain<AnyAbstractDomain>, Config extends AbsintVisitorConfiguration = AbsintVisitorConfiguration> extends SemanticCfgGuidedVisitor<NoInfo, ControlFlowInformation, NormalizedAst, DataflowGraph, Config & {
     defaultVisitingOrder: 'forward';
     defaultVisitingType: 'exit';
 }> {
     /**
      * The abstract trace of the abstract interpretation visitor mapping node IDs to the abstract state at the respective node.
      */
-    private readonly trace;
+    protected readonly trace: Map<NodeId, StateDomain>;
     /**
      * The current abstract state domain at the currently processed AST node.
      */
-    private _currentState;
-    /**
-     * Whether the current abstract state has been copied/cloned and is save to modify in place.
-     */
-    private stateCopied;
+    protected currentState: StateDomain;
     /**
      * The current worklist stack of next vertex IDs to visit.
      */
@@ -40,10 +34,11 @@ export declare abstract class AbstractInterpretationVisitor<Domain extends AnyAb
      * A set of nodes representing variable definitions that have already been visited but whose assignment has not yet been processed.
      */
     private readonly unassigned;
-    constructor(config: Config, domain: Domain);
-    get currentState(): StateAbstractDomain<Domain>;
-    removeState(node: NodeId): void;
-    updateState(node: NodeId, value: Domain): void;
+    /**
+     * A map mapping assignments of replacement calls to their replacement calls for replacement calls that have already been visited but whose assignment has not yet been processed.
+     */
+    private readonly replacements;
+    constructor(config: Config, stateDomain: StateDomain);
     /**
      * Resolves the inferred abstract value of an AST node.
      * This requires that the abstract interpretation visitor has been completed, or at least started.
@@ -51,28 +46,29 @@ export declare abstract class AbstractInterpretationVisitor<Domain extends AnyAb
      * @param state - An optional state abstract domain used to resolve the inferred abstract value (defaults to the state at the requested node)
      * @returns The inferred abstract value of the node, or `undefined` if no value was inferred for the node
      */
-    getAbstractValue(id: RNode<ParentInformation> | NodeId | undefined, state?: StateAbstractDomain<Domain>): Domain | undefined;
+    getAbstractValue(id: RNode<ParentInformation> | NodeId | undefined, state?: StateDomain): ValueDomain<StateDomain> | undefined;
     /**
      * Gets the inferred abstract state at the location of a specific AST node.
      * This requires that the abstract interpretation visitor has been completed, or at least started.
      * @param id - The ID of the node to get the abstract state at
      * @returns The abstract state at the node, or `undefined` if the node has no abstract state (i.e. the node has not been visited or is unreachable).
      */
-    getAbstractState(id: NodeId | undefined): StateAbstractDomain<Domain> | undefined;
+    getAbstractState(id: NodeId | undefined): StateDomain | undefined;
     /**
      * Gets the inferred abstract state at the end of the program (exit nodes of the control flow graph).
      * This requires that the abstract interpretation visitor has been completed, or at least started.
      * @returns The inferred abstract state at the end of the program
      */
-    getEndState(): StateAbstractDomain<Domain>;
+    getEndState(): StateDomain;
     /**
      * Gets the inferred abstract trace mapping AST nodes to the inferred abstract state at the respective node.
      * @returns The inferred abstract trace of the program
      */
-    getAbstractTrace(): ReadonlyMap<NodeId, StateAbstractDomain<Domain>>;
+    getAbstractTrace(): ReadonlyMap<NodeId, StateDomain>;
     start(): void;
     protected startVisitor(start: readonly NodeId[]): void;
     protected visitNode(vertexId: NodeId): boolean;
+    protected visitUnknown(vertex: CfgStatementVertex | CfgExpressionVertex): void;
     protected onDispatchFunctionCallOrigin(call: DataflowGraphVertexFunctionCall, origin: BuiltInProcName): void;
     protected onVariableDefinition({ vertex }: {
         vertex: DataflowGraphVertexVariableDefinition;

package/abstract-interpretation/absint-visitor.js

@@ -11,7 +11,6 @@ const r_function_call_1 = require("../r-bridge/lang-4.x/ast/model/nodes/r-functi
 const type_1 = require("../r-bridge/lang-4.x/ast/model/type");
 const assert_1 = require("../util/assert");
 const abstract_domain_1 = require("./domains/abstract-domain");
-const state_abstract_domain_1 = require("./domains/state-abstract-domain");
 const unsupported_functions_1 = require("./unsupported-functions");
 /**
  * A control flow graph visitor to perform abstract interpretation.
@@ -26,11 +25,7 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
     /**
      * The current abstract state domain at the currently processed AST node.
      */
-    _currentState;
-    /**
-     * Whether the current abstract state has been copied/cloned and is save to modify in place.
-     */
-    stateCopied = false;
+    currentState;
     /**
      * The current worklist stack of next vertex IDs to visit.
      */
@@ -39,26 +34,13 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
      * A set of nodes representing variable definitions that have already been visited but whose assignment has not yet been processed.
      */
     unassigned = new Set();
-    constructor(config, domain) {
+    /**
+     * A map mapping assignments of replacement calls to their replacement calls for replacement calls that have already been visited but whose assignment has not yet been processed.
+     */
+    replacements = new Map();
+    constructor(config, stateDomain) {
         super({ ...config, defaultVisitingOrder: 'forward', defaultVisitingType: 'exit' });
-        this._currentState = state_abstract_domain_1.MutableStateAbstractDomain.top(domain);
-    }
-    get currentState() {
-        return this._currentState;
-    }
-    removeState(node) {
-        if (!this.stateCopied) {
-            this._currentState = this._currentState.create(this.currentState.value);
-            this.stateCopied = true;
-        }
-        this._currentState.remove(node);
-    }
-    updateState(node, value) {
-        if (!this.stateCopied) {
-            this._currentState = this._currentState.create(this.currentState.value);
-            this.stateCopied = true;
-        }
-        this._currentState.set(node, value);
+        this.currentState = stateDomain.top();
     }
     /**
      * Resolves the inferred abstract value of an AST node.
@@ -70,7 +52,10 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
     getAbstractValue(id, state) {
         const node = (id === undefined || typeof id === 'object') ? id : this.getNormalizedAst(id);
         state ??= node !== undefined ? this.getAbstractState(node.info.id) : undefined;
-        if (node === undefined) {
+        if (state?.isBottom()) {
+            return this.currentState.domain.bottom();
+        }
+        else if (node === undefined) {
             return;
         }
         else if (state?.has(node.info.id)) {
@@ -80,7 +65,8 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
         const call = (0, vertex_1.isFunctionCallVertex)(vertex) ? vertex : undefined;
         const origins = Array.isArray(call?.origin) ? call.origin : [];
         if (node.type === type_1.RType.Symbol) {
-            const values = this.getVariableOrigins(node.info.id).map(origin => state?.get(origin));
+            const values = this.getVariableOrigins(node.info.id)
+                .map(origin => (this.getAbstractState(origin)?.isBottom() ? this.currentState.domain.bottom() : state?.get(origin)));
             if (values.length > 0 && values.every(assert_1.isNotUndefined)) {
                 return abstract_domain_1.AbstractDomain.joinAll(values);
             }
@@ -130,7 +116,7 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
         const exitPoints = this.config.controlFlow.exitPoints.map(id => this.getCfgVertex(id)).filter(assert_1.isNotUndefined);
         const exitNodes = exitPoints.map(control_flow_graph_1.CfgVertex.getRootId).filter(assert_1.isNotUndefined);
         const states = exitNodes.map(node => this.trace.get(node)).filter(assert_1.isNotUndefined);
-        return abstract_domain_1.AbstractDomain.joinAll(states, this._currentState.bottom());
+        return abstract_domain_1.AbstractDomain.joinAll(states, this.currentState.bottom());
     }
     /**
      * Gets the inferred abstract trace mapping AST nodes to the inferred abstract state at the respective node.
@@ -165,40 +151,30 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
         if (vertex === undefined || this.shouldSkipVertex(vertex)) {
             return true;
         }
+        // retrieve new abstract state by joining states of predecessor nodes
         const predecessors = this.getPredecessorNodes(control_flow_graph_1.CfgVertex.getId(vertex));
         const predecessorStates = predecessors.map(pred => this.trace.get(pred)).filter(assert_1.isNotUndefined);
-        // retrieve new abstract state by joining states of predecessor nodes
-        if (predecessorStates.length <= 1) {
-            this._currentState = predecessorStates[0] ?? this._currentState.top();
-        }
-        else {
-            this._currentState = abstract_domain_1.AbstractDomain.joinAll(predecessorStates);
-            this.stateCopied = true;
-        }
+        this.currentState = abstract_domain_1.AbstractDomain.joinAll(predecessorStates, this.currentState.top());
         const nodeId = control_flow_graph_1.CfgVertex.getRootId(vertex);
         // differentiate between widening points and other vertices
         if (this.isWideningPoint(nodeId)) {
             const oldState = this.trace.get(nodeId);
             if (oldState !== undefined && this.shouldWiden(vertex)) {
-                this._currentState = oldState.widen(this._currentState);
-                this.stateCopied = true;
+                this.currentState = oldState.widen(this.currentState);
             }
-            this.trace.set(nodeId, this._currentState);
-            this.stateCopied = false;
+            this.trace.set(nodeId, this.currentState);
             const visitedCount = this.visited.get(nodeId) ?? 0;
             this.visited.set(nodeId, visitedCount + 1);
             // continue visiting after widening point if visited for the first time or the state changed
-            return visitedCount === 0 || !oldState?.equals(this._currentState);
+            return visitedCount === 0 || !oldState?.equals(this.currentState);
         }
         else {
             this.onVisitNode(vertexId);
             // discard the inferred abstract state when encountering unsupported function calls
             if (this.isUnsupportedFunctionCall(nodeId)) {
-                this._currentState = this._currentState.top();
-                this.stateCopied = true;
+                this.currentState = this.currentState.top();
             }
-            this.trace.set(nodeId, this._currentState);
-            this.stateCopied = false;
+            this.trace.set(nodeId, this.currentState);
             const predecessorVisits = predecessors.map(pred => this.visited.get(pred) ?? 0);
             const visitedCount = this.visited.get(nodeId) ?? 0;
             this.visited.set(nodeId, visitedCount + 1);
@@ -206,7 +182,31 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
             return predecessors.length <= 1 || this.stack.length === 0 || predecessorVisits.every(visits => visits === predecessorVisits[0]);
         }
     }
+    visitUnknown(vertex) {
+        const nodeId = control_flow_graph_1.CfgVertex.getRootId(vertex);
+        const replacements = this.replacements.get(nodeId);
+        if (replacements !== undefined) {
+            this.replacements.delete(nodeId);
+            for (const replacement of replacements) {
+                const call = this.getDataflowGraph(replacement);
+                if ((0, vertex_1.isFunctionCallVertex)(call)) {
+                    this.onReplacementCall({ call, ...this.getSourceAndTarget(call) });
+                }
+            }
+        }
+    }
     onDispatchFunctionCallOrigin(call, origin) {
+        if (origin === built_in_proc_name_1.BuiltInProcName.Replacement) {
+            const node = this.getNormalizedAst(call.id);
+            const assignment = model_1.RNode.iterateParents(node, this.config.normalizedAst.idMap)
+                .find(parent => this.getDataflowGraph(parent.info.id) === undefined);
+            if (node !== undefined && assignment !== undefined) {
+                const replacements = this.replacements.get(assignment.info.id) ?? [];
+                replacements.push(node.info.id);
+                this.replacements.set(assignment.info.id, replacements);
+                return;
+            }
+        }
         super.onDispatchFunctionCallOrigin(call, origin);
         switch (origin) {
             case built_in_proc_name_1.BuiltInProcName.ExpressionList:
@@ -240,9 +240,8 @@ class AbstractInterpretationVisitor extends semantic_cfg_guided_visitor_1.Semant
         const value = this.getAbstractValue(source);
         this.unassigned.delete(target);
         if (value !== undefined) {
-            this.updateState(target, value);
-            this.trace.set(target, this._currentState);
-            this.stateCopied = false;
+            this.currentState.set(target, value);
+            this.trace.set(target, this.currentState);
         }
     }
     onReplacementCall({ target }) {

package/abstract-interpretation/data-frame/dataframe-domain.d.ts

@@ -1,4 +1,3 @@
-import type { AbstractDomainValue } from '../domains/abstract-domain';
 import { PosIntervalDomain } from '../domains/positive-interval-domain';
 import { ProductDomain } from '../domains/product-domain';
 import { SetRangeDomain } from '../domains/set-range-domain';
@@ -8,8 +7,6 @@ export type AbstractDataFrameShape = {
     cols: PosIntervalDomain;
     rows: PosIntervalDomain;
 };
-/** The type of abstract values of a sub abstract domain (shape property) of the data frame shape product domain */
-export type DataFrameShapeProperty<Property extends keyof AbstractDataFrameShape> = AbstractDomainValue<AbstractDataFrameShape[Property]>;
 /**
  * The data frame abstract domain as product domain of a column names domain, column count domain, and row count domain.
  */

package/abstract-interpretation/data-frame/shape-inference.d.ts

@@ -1,6 +1,7 @@
 import type { DataflowGraphVertexFunctionCall } from '../../dataflow/graph/vertex';
 import type { NodeId } from '../../r-bridge/lang-4.x/ast/model/processing/node-id';
 import { AbstractInterpretationVisitor, type AbsintVisitorConfiguration } from '../absint-visitor';
+import { StateAbstractDomain } from '../domains/state-abstract-domain';
 import { DataFrameDomain } from './dataframe-domain';
 import { ConstraintType, type DataFrameOperationArgs, type DataFrameOperationName, type DataFrameOperationOptions } from './semantics';
 interface Operation<Name extends DataFrameOperationName> {
@@ -35,7 +36,7 @@ interface DataFrameShapeInferenceConfiguration extends AbsintVisitorConfiguratio
 /**
  * The control flow graph visitor to infer the shape of data frames using abstract interpretation
  */
-export declare class DataFrameShapeInferenceVisitor extends AbstractInterpretationVisitor<DataFrameDomain, DataFrameShapeInferenceConfiguration> {
+export declare class DataFrameShapeInferenceVisitor extends AbstractInterpretationVisitor<StateAbstractDomain<DataFrameDomain>, DataFrameShapeInferenceConfiguration> {
     /**
      * The abstract data frame operations the function call nodes are mapped to.
      */

package/abstract-interpretation/data-frame/shape-inference.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DataFrameShapeInferenceVisitor = void 0;
 const absint_visitor_1 = require("../absint-visitor");
+const state_abstract_domain_1 = require("../domains/state-abstract-domain");
 const dataframe_domain_1 = require("./dataframe-domain");
 const access_mapper_1 = require("./mappers/access-mapper");
 const function_mapper_1 = require("./mappers/function-mapper");
@@ -16,7 +17,7 @@ class DataFrameShapeInferenceVisitor extends absint_visitor_1.AbstractInterpreta
      */
     operations;
     constructor({ trackOperations = true, ...config }) {
-        super(config, dataframe_domain_1.DataFrameDomain.top());
+        super(config, state_abstract_domain_1.StateAbstractDomain.top(dataframe_domain_1.DataFrameDomain.top()));
         if (trackOperations) {
             this.operations = new Map();
         }
@@ -73,13 +74,13 @@ class DataFrameShapeInferenceVisitor extends absint_visitor_1.AbstractInterpreta
             value = (0, semantics_1.applyDataFrameSemantics)(operation, operandValue ?? dataframe_domain_1.DataFrameDomain.top(maxColNames), args, options);
             const constraintType = type ?? (0, semantics_1.getConstraintType)(operation);
             if (operand !== undefined && constraintType === semantics_1.ConstraintType.OperandModification) {
-                this.updateState(operand, value);
+                this.currentState.set(operand, value);
                 for (const origin of this.getVariableOrigins(operand)) {
-                    this.updateState(origin, value);
+                    this.currentState.set(origin, value);
                 }
             }
             else if (constraintType === semantics_1.ConstraintType.ResultPostcondition) {
-                this.updateState(node.info.id, value);
+                this.currentState.set(node.info.id, value);
             }
         }
     }

package/abstract-interpretation/domains/abstract-domain.d.ts

@@ -63,36 +63,37 @@ export declare abstract class AbstractDomain<Concrete, Abstract, Top, Bot, Value
      * The provided array of abstract values must not be empty or a default value must be provided!
      */
     static meetAll<Domain extends AnyAbstractDomain>(values: Domain[], defaultValue?: Domain): Domain;
+    /**
+     * Converts an element of an abstract domain into a string.
+     */
+    static toString(this: void, value: AnyAbstractDomain | unknown): string;
 }
 /**
  * A type representing any abstract domain without additional information.
  */
 export type AnyAbstractDomain = AbstractDomain<unknown, unknown, unknown, unknown>;
-/**
- * The type of the concrete domain of an abstract domain.
- * @template Domain - The abstract domain to get the concrete domain type for
- */
-export type ConcreteDomain<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<infer Concrete, unknown, unknown, unknown> ? Concrete : never;
 /**
  * The type of the abstract values of an abstract domain (including the Top and Bottom element).
  * @template Domain - The abstract domain to get the abstract value type for
  */
-export type AbstractDomainValue<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<unknown, infer Value, infer Top, infer Bot> ? Value | Top | Bot : never;
+export type AbstractValue<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<unknown, infer Value, infer Top, infer Bot> ? Value | Top | Bot : never;
 /**
- * The type of the Top element (greatest element) of an abstract domain.
- * @template Domain - The abstract domain to get the Top element type for
+ * The type of the concrete domain of an abstract domain.
+ * @template Domain - The abstract domain to get the concrete domain type for
  */
-export type AbstractDomainTop<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<unknown, unknown, infer Top, unknown> ? Top : never;
+export type ConcreteDomain<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<infer Concrete, unknown, unknown, unknown> ? Concrete : never;
 /**
- * The type of the Bottom element (least element) of an abstract domain.
- * @template Domain - The abstract domain to get the Bottom element type for
+ * The type of an abstract domain holding an abstract value of the domain.
+ * @template Domain - The abstract domain abstract domain value type for
  */
-export type AbstractDomainBottom<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<unknown, unknown, unknown, infer Bot> ? Bot : never;
+export type AbstractDomainValue<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<infer Concrete, infer Value, infer Top, infer Bot> ? Domain & AbstractDomain<Concrete, Value, Top, Bot, Value> : never;
 /**
- * Converts an element of an abstract domain into a string.
+ * The type an abstract domain holding the Top element (greatest element) of the domain.
+ * @template Domain - The abstract domain to get the abstract domain top for
  */
-export declare function domainElementToString(value: AnyAbstractDomain | unknown): string;
+export type AbstractDomainTop<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<infer Concrete, infer Value, infer Top, infer Bot> ? Domain & AbstractDomain<Concrete, Value, Top, Bot, Top> : never;
 /**
- * Checks whether a value is an abstract domain.
+ * The type an abstract domain holding the Bottom element (least element) of the domain.
+ * @template Domain - The abstract domain to get the abstract domain bottom for
  */
-export declare function isAbstractDomain(value: unknown): value is AnyAbstractDomain;
+export type AbstractDomainBottom<Domain extends AnyAbstractDomain> = Domain extends AbstractDomain<infer Concrete, infer Value, infer Top, infer Bot> ? Domain & AbstractDomain<Concrete, Value, Top, Bot, Bot> : never;