arkanalyzer 1.0.5

package/lib/callgraph/pointerAnalysis/PagBuilder.js

@@ -0,0 +1,821 @@
+"use strict";
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PagBuilder = exports.CSFuncID = void 0;
+const CallGraph_1 = require("../model/CallGraph");
+const Stmt_1 = require("../../core/base/Stmt");
+const Expr_1 = require("../../core/base/Expr");
+const Ref_1 = require("../../core/base/Ref");
+const logger_1 = __importStar(require("../../utils/logger"));
+const Local_1 = require("../../core/base/Local");
+const Type_1 = require("../../core/base/Type");
+const Constant_1 = require("../../core/base/Constant");
+const Statistics_1 = require("../common/Statistics");
+const Context_1 = require("./Context");
+const Pag_1 = require("./Pag");
+const PtsDS_1 = require("./PtsDS");
+const TSConst_1 = require("../../core/common/TSConst");
+const logger = logger_1.default.getLogger(logger_1.LOG_MODULE_TYPE.ARKANALYZER, 'PTA');
+class CSFuncID {
+    constructor(cid, fid) {
+        this.cid = cid;
+        this.funcID = fid;
+    }
+}
+exports.CSFuncID = CSFuncID;
+class PagBuilder {
+    constructor(p, cg, s, kLimit) {
+        this.handledFunc = new Set();
+        this.worklist = [];
+        // TODO: change string to hash value
+        this.staticField2UniqInstanceMap = new Map();
+        this.instanceField2UniqInstanceMap = new Map();
+        this.cid2ThisRefPtMap = new Map();
+        this.cid2ThisRefMap = new Map();
+        this.cid2ThisLocalMap = new Map();
+        this.sdkMethodReturnValueMap = new Map();
+        this.funcHandledThisRound = new Set();
+        this.updatedNodesThisRound = new Map();
+        this.singletonFuncMap = new Map();
+        this.pag = p;
+        this.cg = cg;
+        this.funcPags = new Map;
+        this.ctx = new Context_1.KLimitedContextSensitive(kLimit);
+        this.scene = s;
+        this.pagStat = new Statistics_1.PAGStat();
+    }
+    buildFuncPagAndAddToWorklist(cs) {
+        if (this.worklist.includes(cs)) {
+            return cs;
+        }
+        this.buildFuncPag(cs.funcID);
+        if (this.isSingletonFunction(cs.funcID)) {
+            cs.cid = Context_1.DUMMY_CID;
+        }
+        this.worklist.push(cs);
+        return cs;
+    }
+    addToFuncHandledListThisRound(id) {
+        if (this.funcHandledThisRound.has(id)) {
+            return;
+        }
+        this.funcHandledThisRound.add(id);
+    }
+    buildForEntries(funcIDs) {
+        this.worklist = [];
+        funcIDs.forEach(funcID => {
+            let cid = this.ctx.getNewContextID(funcID);
+            let csFuncID = new CSFuncID(cid, funcID);
+            this.buildFuncPagAndAddToWorklist(csFuncID);
+        });
+        this.handleReachable();
+    }
+    handleReachable() {
+        if (this.worklist.length == 0) {
+            return false;
+        }
+        this.funcHandledThisRound.clear();
+        while (this.worklist.length > 0) {
+            let csFunc = this.worklist.shift();
+            this.buildPagFromFuncPag(csFunc.funcID, csFunc.cid);
+            this.addToFuncHandledListThisRound(csFunc.funcID);
+        }
+        return true;
+    }
+    build() {
+        for (let funcID of this.cg.getEntries()) {
+            let cid = this.ctx.getNewContextID(funcID);
+            let csFuncID = new CSFuncID(cid, funcID);
+            this.buildFuncPagAndAddToWorklist(csFuncID);
+            this.handleReachable();
+        }
+    }
+    buildFuncPag(funcID) {
+        if (this.funcPags.has(funcID)) {
+            return false;
+        }
+        let fpag = new Pag_1.FuncPag();
+        let arkMethod = this.cg.getArkMethodByFuncID(funcID);
+        if (arkMethod == null) {
+            //throw new Error("function ID");
+            return false;
+        }
+        let cfg = arkMethod.getCfg();
+        if (!cfg) {
+            return false;
+        }
+        logger.trace(`[build FuncPag] ${arkMethod.getSignature().toString()}`);
+        for (let stmt of cfg.getStmts()) {
+            if (stmt instanceof Stmt_1.ArkAssignStmt) {
+                // Add non-call edges
+                let kind = this.getEdgeKindForAssignStmt(stmt);
+                if (kind != Pag_1.PagEdgeKind.Unknown) {
+                    fpag.addInternalEdge(stmt, kind);
+                    continue;
+                }
+                // handle call
+                let inkExpr = stmt.getInvokeExpr();
+                if (inkExpr instanceof Expr_1.ArkStaticInvokeExpr) {
+                    let cs = this.cg.getCallSiteByStmt(stmt);
+                    if (cs) {
+                        // direct call is already existing in CG
+                        fpag.addNormalCallSite(cs);
+                    }
+                    else {
+                        throw new Error('Can not find static callsite');
+                    }
+                }
+                else if (inkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
+                    let ptcs = this.cg.getDynCallsiteByStmt(stmt);
+                    if (ptcs) {
+                        this.addToDynamicCallSite(fpag, ptcs);
+                    }
+                }
+            }
+            else if (stmt instanceof Stmt_1.ArkInvokeStmt) {
+                // TODO: discuss if we need a invokeStmt
+                let cs = this.cg.getCallSiteByStmt(stmt);
+                if (cs) {
+                    // direct call or constructor call is already existing in CG
+                    fpag.addNormalCallSite(cs);
+                    continue;
+                }
+                let dycs = this.cg.getDynCallsiteByStmt(stmt);
+                if (dycs) {
+                    this.addToDynamicCallSite(fpag, dycs);
+                }
+                else {
+                    throw new Error('Can not find callsite by stmt');
+                }
+            }
+            else {
+                // TODO: need handle other type of stmt?
+            }
+        }
+        this.funcPags.set(funcID, fpag);
+        this.pagStat.numTotalFunction++;
+        return true;
+    }
+    buildPagFromFuncPag(funcID, cid) {
+        let funcPag = this.funcPags.get(funcID);
+        if (funcPag == undefined) {
+            //throw new Error("No Func PAG is found for #" + funcID);
+            return;
+        }
+        if (this.handledFunc.has(`${cid}-${funcID}`)) {
+            return;
+        }
+        this.addEdgesFromFuncPag(funcPag, cid);
+        this.addCallsEdgesFromFuncPag(funcPag, cid);
+        this.addDynamicCallSite(funcPag);
+        this.handledFunc.add(`${cid}-${funcID}`);
+    }
+    /// Add Pag Nodes and Edges in function
+    addEdgesFromFuncPag(funcPag, cid) {
+        let inEdges = funcPag.getInternalEdges();
+        if (inEdges == undefined) {
+            return false;
+        }
+        for (let e of inEdges) {
+            let srcPagNode = this.getOrNewPagNode(cid, e.src, e.stmt);
+            let dstPagNode = this.getOrNewPagNode(cid, e.dst, e.stmt);
+            this.pag.addPagEdge(srcPagNode, dstPagNode, e.kind, e.stmt);
+            // Take place of the real stmt for return
+            if (dstPagNode.getStmt() instanceof Stmt_1.ArkReturnStmt) {
+                dstPagNode.setStmt(e.stmt);
+            }
+        }
+        return true;
+    }
+    /// add Copy edges interprocedural
+    addCallsEdgesFromFuncPag(funcPag, cid) {
+        for (let cs of funcPag.getNormalCallSites()) {
+            let calleeCid = this.ctx.getOrNewContext(cid, cs.calleeFuncID, true);
+            this.addStaticPagCallEdge(cs, cid, calleeCid);
+            // Add edge to thisRef for special calls
+            let calleeCGNode = this.cg.getNode(cs.calleeFuncID);
+            let ivkExpr = cs.callStmt.getInvokeExpr();
+            if (calleeCGNode.getKind() == CallGraph_1.CallGraphNodeKind.constructor ||
+                calleeCGNode.getKind() == CallGraph_1.CallGraphNodeKind.intrinsic) {
+                let callee = this.scene.getMethod(this.cg.getMethodByFuncID(cs.calleeFuncID));
+                if (ivkExpr instanceof Expr_1.ArkInstanceInvokeExpr) {
+                    let baseNode = this.getOrNewPagNode(cid, ivkExpr.getBase());
+                    let baseNodeID = baseNode.getID();
+                    this.addThisRefCallEdge(baseNodeID, cid, ivkExpr, callee, calleeCid, cs.callerFuncID);
+                }
+                else {
+                    logger.error(`constructor or intrinsic func is static ${ivkExpr.toString()}`);
+                }
+            }
+        }
+        return true;
+    }
+    addDynamicCallSite(funcPag) {
+        // add dyn callsite in funcpag to base node
+        for (let cs of funcPag.getDynamicCallSites()) {
+            let base = cs.callStmt.getInvokeExpr().getBase();
+            // TODO: check base under different cid
+            let baseNodeIDs = this.pag.getNodesByValue(base);
+            if (!baseNodeIDs) {
+                logger.warn(`[build dynamic call site] can not handle call site with base ${base.toString()}`);
+                continue;
+            }
+            for (let nodeID of baseNodeIDs.values()) {
+                let node = this.pag.getNode(nodeID);
+                if (!(node instanceof Pag_1.PagLocalNode)) {
+                    continue;
+                }
+                node.addRelatedDynCallSite(cs);
+            }
+        }
+    }
+    addDynamicCallEdge(cs, baseClassPTNode, cid) {
+        let srcNodes = [];
+        let ivkExpr = cs.callStmt.getInvokeExpr();
+        let calleeName = ivkExpr.getMethodSignature().getMethodSubSignature().getMethodName();
+        let ptNode = this.pag.getNode(baseClassPTNode);
+        let value = ptNode.getValue();
+        if (!(value instanceof Expr_1.ArkNewExpr || value instanceof Expr_1.ArkNewArrayExpr)) {
+            return srcNodes;
+        }
+        let callee = null;
+        if (value instanceof Expr_1.ArkNewExpr) {
+            // get class signature
+            let clsSig = value.getType().getClassSignature();
+            let cls;
+            cls = this.scene.getClass(clsSig);
+            while (!callee && cls) {
+                callee = cls.getMethodWithName(calleeName);
+                cls = cls.getSuperClass();
+            }
+            if (!callee) {
+                callee = this.scene.getMethod(ivkExpr.getMethodSignature());
+            }
+        }
+        // anonymous method
+        if (!callee) {
+            // try to change callee to param anonymous method
+            // TODO: anonymous method param and return value pointer pass
+            let args = cs.args;
+            if ((args === null || args === void 0 ? void 0 : args.length) == 1 && args[0].getType() instanceof Type_1.FunctionType) {
+                callee = this.scene.getMethod(args[0].getType().getMethodSignature());
+            }
+        }
+        if (!callee) {
+            // while pts has {o_1, o_2} and invoke expr represents a method that only {o_1} has
+            // return empty node when {o_2} come in
+            return [];
+        }
+        let dstCGNode = this.cg.getCallGraphNodeByMethod(callee.getSignature());
+        let callerNode = this.cg.getNode(cs.callerFuncID);
+        if (!callerNode) {
+            throw new Error("Can not get caller method node");
+        }
+        // update call graph
+        // TODO: movo to cgbuilder
+        this.cg.addDynamicCallEdge(callerNode.getID(), dstCGNode.getID(), cs.callStmt);
+        if (!this.cg.detectReachable(dstCGNode.getID(), callerNode.getID())) {
+            let calleeCid = this.ctx.getOrNewContext(cid, dstCGNode.getID(), true);
+            let staticCS = new CallGraph_1.CallSite(cs.callStmt, cs.args, dstCGNode.getID(), cs.callerFuncID);
+            let staticSrcNodes = this.addStaticPagCallEdge(staticCS, cid, calleeCid);
+            srcNodes.push(...staticSrcNodes);
+            // Pass base's pts to callee's this pointer
+            if (!dstCGNode.getIsSdkMethod()) {
+                let srcBaseNode = this.addThisRefCallEdge(baseClassPTNode, cid, ivkExpr, callee, calleeCid, cs.callerFuncID);
+                srcNodes.push(srcBaseNode);
+            }
+        }
+        return srcNodes;
+    }
+    addUpdatedNode(nodeID, diffPT) {
+        var _a;
+        let updatedNode = (_a = this.updatedNodesThisRound.get(nodeID)) !== null && _a !== void 0 ? _a : new PtsDS_1.PtsSet();
+        updatedNode.union(diffPT);
+        this.updatedNodesThisRound.set(nodeID, updatedNode);
+    }
+    getUpdatedNodes() {
+        return this.updatedNodesThisRound;
+    }
+    resetUpdatedNodes() {
+        this.updatedNodesThisRound.clear();
+    }
+    handleUnkownDynamicCall(cs, cid) {
+        var _a;
+        let srcNodes = [];
+        let callerNode = this.cg.getNode(cs.callerFuncID);
+        let ivkExpr = cs.callStmt.getInvokeExpr();
+        logger.warn("Handling unknown dyn call site : \n  " + callerNode.getMethod().toString()
+            + '\n  --> ' + ivkExpr.toString() + '\n  CID: ' + cid);
+        let callees = [];
+        let callee = null;
+        callee = this.scene.getMethod(ivkExpr.getMethodSignature());
+        if (!callee) {
+            (_a = cs.args) === null || _a === void 0 ? void 0 : _a.forEach(arg => {
+                if (arg.getType() instanceof Type_1.FunctionType) {
+                    callee = this.scene.getMethod(arg.getType().getMethodSignature());
+                    if (callee) {
+                        callees.push(callee);
+                    }
+                }
+            });
+        }
+        else {
+            callees.push(callee);
+        }
+        if (callees.length == 0) {
+            return srcNodes;
+        }
+        callees.forEach(callee => {
+            let dstCGNode = this.cg.getCallGraphNodeByMethod(callee.getSignature());
+            if (!callerNode) {
+                throw new Error("Can not get caller method node");
+            }
+            logger.warn(`\tAdd call edge of unknown call ${callee.getSignature().toString()}`);
+            this.cg.addDynamicCallEdge(callerNode.getID(), dstCGNode.getID(), cs.callStmt);
+            if (!this.cg.detectReachable(dstCGNode.getID(), callerNode.getID())) {
+                let calleeCid = this.ctx.getOrNewContext(cid, dstCGNode.getID(), true);
+                let staticCS = new CallGraph_1.CallSite(cs.callStmt, cs.args, dstCGNode.getID(), cs.callerFuncID);
+                let staticSrcNodes = this.addStaticPagCallEdge(staticCS, cid, calleeCid);
+                srcNodes.push(...staticSrcNodes);
+            }
+        });
+        return srcNodes;
+    }
+    handleUnprocessedCallSites(processedCallSites) {
+        for (let funcID of this.funcHandledThisRound) {
+            let funcPag = this.funcPags.get(funcID);
+            if (!funcPag) {
+                logger.error(`can not find funcPag of handled func ${funcID}`);
+                continue;
+            }
+            let callSites = funcPag.getDynamicCallSites();
+            const diffCallSites = new Set(Array.from(callSites).filter(item => !processedCallSites.has(item)));
+            diffCallSites.forEach((cs) => {
+                let ivkExpr = cs.callStmt.getInvokeExpr();
+                // Get local of base class
+                let base = ivkExpr.getBase();
+                // TODO: remove this after multiple this local fixed
+                base = this.getRealThisLocal(base, cs.callerFuncID);
+                // Get PAG nodes for this base's local
+                let ctx2NdMap = this.pag.getNodesByValue(base);
+                if (ctx2NdMap) {
+                    for (let [cid] of ctx2NdMap.entries()) {
+                        this.handleUnkownDynamicCall(cs, cid);
+                    }
+                }
+            });
+        }
+    }
+    addThisRefCallEdge(baseClassPTNode, cid, ivkExpr, callee, calleeCid, callerFunID) {
+        //let thisPtr = callee.getThisInstance();
+        var _a;
+        if (!callee || !callee.getCfg()) {
+            console.log("callee is null");
+            return -1;
+        }
+        let thisAssignStmt = (_a = callee.getCfg()) === null || _a === void 0 ? void 0 : _a.getStmts().filter(s => s instanceof Stmt_1.ArkAssignStmt && s.getRightOp() instanceof Ref_1.ArkThisRef);
+        let thisPtr = (thisAssignStmt === null || thisAssignStmt === void 0 ? void 0 : thisAssignStmt.at(0)).getRightOp();
+        if (!thisPtr) {
+            throw new Error('Can not get this ptr');
+        }
+        // IMPORTANT: set cid 2 base Pt info firstly
+        this.cid2ThisRefPtMap.set(calleeCid, baseClassPTNode);
+        let thisRefNode = this.getOrNewThisRefNode(calleeCid, thisPtr);
+        thisRefNode.addPTNode(baseClassPTNode);
+        let srcBaseLocal = ivkExpr.getBase();
+        srcBaseLocal = this.getRealThisLocal(srcBaseLocal, callerFunID);
+        let srcNodeId = this.pag.hasCtxNode(cid, srcBaseLocal);
+        if (!srcNodeId) {
+            throw new Error('Can not get base node');
+        }
+        this.pag.addPagEdge(this.pag.getNode(srcNodeId), thisRefNode, Pag_1.PagEdgeKind.This);
+        return srcNodeId;
+    }
+    /*
+     * Add copy edges from arguments to parameters
+     *     ret edges from return values to callsite
+     * Return src node
+     */
+    addStaticPagCallEdge(cs, callerCid, calleeCid) {
+        var _a, _b;
+        if (!calleeCid) {
+            calleeCid = this.ctx.getOrNewContext(callerCid, cs.calleeFuncID, true);
+        }
+        let srcNodes = [];
+        // Add reachable
+        let calleeNode = this.cg.getNode(cs.calleeFuncID);
+        let calleeMethod = this.scene.getMethod(calleeNode.getMethod());
+        if (!calleeMethod) {
+            // TODO: check if nodes need to delete
+            // this.cg.removeCallGraphNode(cs.calleeFuncID)
+            return srcNodes;
+        }
+        if (calleeNode.getIsSdkMethod()) {
+            let returnType = calleeMethod.getReturnType();
+            // TODO: add new array type
+            if (!(returnType instanceof Type_1.ClassType) || !(cs.callStmt instanceof Stmt_1.ArkAssignStmt)) {
+                return srcNodes;
+            }
+            // check fake heap object exists or not
+            let cidMap = this.sdkMethodReturnValueMap.get(calleeMethod);
+            if (!cidMap) {
+                cidMap = new Map();
+            }
+            let newExpr = cidMap.get(calleeCid);
+            if (!newExpr) {
+                if (returnType instanceof Type_1.ClassType) {
+                    newExpr = new Expr_1.ArkNewExpr(returnType);
+                }
+                // } else if (returnType instanceof ArrayType) {
+                // TODO: check how to transform array type 2 newArrayExpr
+                // newExpr = new ArkNewArrayExpr(returnType.getBaseType(), )
+                // }
+            }
+            cidMap.set(calleeCid, newExpr);
+            this.sdkMethodReturnValueMap.set(calleeMethod, cidMap);
+            let srcPagNode = this.getOrNewPagNode(calleeCid, newExpr);
+            let dstPagNode = this.getOrNewPagNode(callerCid, cs.callStmt.getLeftOp(), cs.callStmt);
+            this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Address, cs.callStmt);
+            return srcNodes;
+        }
+        if (!calleeMethod.getCfg()) {
+            // method have no cfg body
+            return srcNodes;
+        }
+        let calleeCS = this.buildFuncPagAndAddToWorklist(new CSFuncID(calleeCid, cs.calleeFuncID));
+        // callee cid will updated if callee is singleton
+        calleeCid = calleeCS.cid;
+        // TODO: getParameterInstances's performance is not good. Need to refactor 
+        //let params = calleeMethod.getParameterInstances();
+        let params = calleeMethod.getCfg().getStmts()
+            .filter(stmt => stmt instanceof Stmt_1.ArkAssignStmt && stmt.getRightOp() instanceof Ref_1.ArkParameterRef)
+            .map(stmt => stmt.getRightOp());
+        let argNum = (_a = cs.args) === null || _a === void 0 ? void 0 : _a.length;
+        if (argNum) {
+            // add args to parameters edges
+            for (let i = 0; i < argNum; i++) {
+                let arg = (_b = cs.args) === null || _b === void 0 ? void 0 : _b.at(i);
+                let param = params.at(i);
+                // TODO: param type should be ArkParameterRef?
+                //if (arg && param && param instanceof ArkParameterRef) {
+                if (arg && param) {
+                    if (arg instanceof Constant_1.Constant) {
+                        continue;
+                    }
+                    if (arg instanceof Expr_1.AbstractExpr) {
+                        // TODO: handle this
+                        continue;
+                    }
+                    // Get or create new PAG node for argument and parameter
+                    let srcPagNode = this.getOrNewPagNode(callerCid, arg, cs.callStmt);
+                    let dstPagNode = this.getOrNewPagNode(calleeCid, param, cs.callStmt);
+                    this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, cs.callStmt);
+                    srcNodes.push(srcPagNode.getID());
+                }
+                // TODO: handle other types of parmeters
+            }
+        }
+        // add ret to caller edges
+        let retStmts = calleeMethod.getReturnStmt();
+        // TODO: call statement must be a assignment state
+        if (cs.callStmt instanceof Stmt_1.ArkAssignStmt) {
+            let retDst = cs.callStmt.getLeftOp();
+            for (let retStmt of retStmts) {
+                let retValue = retStmt.getOp();
+                if (retValue instanceof Local_1.Local) {
+                    let srcPagNode = this.getOrNewPagNode(calleeCid, retValue, retStmt);
+                    let dstPagNode = this.getOrNewPagNode(callerCid, retDst, cs.callStmt);
+                    this.pag.addPagEdge(srcPagNode, dstPagNode, Pag_1.PagEdgeKind.Copy, retStmt);
+                }
+                else if (retValue instanceof Constant_1.Constant) {
+                    continue;
+                }
+                else if (retValue instanceof Expr_1.AbstractExpr) {
+                    console.log(retValue);
+                    continue;
+                }
+                else {
+                    throw new Error('return dst not a local or constant, but: ' + retValue.getType().toString());
+                }
+            }
+        }
+        return srcNodes;
+    }
+    getOrNewPagNode(cid, v, s) {
+        if (v instanceof Ref_1.ArkThisRef) {
+            return this.getOrNewThisRefNode(cid, v);
+        }
+        // this local is also not uniq!!!
+        // remove below block once this issue fixed
+        // globalThis process can not be removed while all `globalThis` ref is the same Value
+        if (v instanceof Local_1.Local) {
+            if (v.getName() == "this") {
+                return this.getOrNewThisLoalNode(cid, v, s);
+            }
+            else if (v.getName() == Pag_1.GLOBAL_THIS && v.getDeclaringStmt() == null) {
+                // globalThis node has no cid
+                return this.getOrNewGlobalThisNode(0);
+            }
+        }
+        v = this.getRealInstanceRef(v);
+        return this.pag.getOrNewNode(cid, v, s);
+    }
+    /**
+     * return ThisRef PAG node according to cid, a cid has a unique ThisRef node
+     * @param cid: current contextID
+     */
+    getOrNewThisRefNode(cid, v) {
+        let thisRefNodeID = this.cid2ThisRefMap.get(cid);
+        if (!thisRefNodeID) {
+            thisRefNodeID = -1;
+        }
+        let thisRefNode = this.pag.getOrNewThisRefNode(thisRefNodeID, v);
+        this.cid2ThisRefMap.set(cid, thisRefNode.getID());
+        return thisRefNode;
+    }
+    // TODO: remove it once this local not uniq issue is fixed
+    getOrNewThisLoalNode(cid, v, s) {
+        let thisLocalNodeID = this.cid2ThisLocalMap.get(cid);
+        if (thisLocalNodeID) {
+            return this.pag.getNode(thisLocalNodeID);
+        }
+        let thisNode = this.pag.getOrNewNode(cid, v, s);
+        this.cid2ThisLocalMap.set(cid, thisNode.getID());
+        return thisNode;
+    }
+    getOrNewGlobalThisNode(cid) {
+        return this.pag.getOrNewNode(cid, this.getGlobalThisValue());
+    }
+    getUniqThisLocalNode(cid) {
+        return this.cid2ThisLocalMap.get(cid);
+    }
+    /*
+     * In ArkIR, ArkField has multiple instances for each stmt which use it
+     * But the unique one is needed for pointer analysis
+     * This is a temp solution to use a ArkField->(first instance)
+     *  as the unique instance
+     *
+     * node merge condition:
+     * instance field: value and ArkField
+     * static field: ArkField
+     */
+    getRealInstanceRef(v) {
+        if (!(v instanceof Ref_1.ArkInstanceFieldRef || v instanceof Ref_1.ArkStaticFieldRef)) {
+            return v;
+        }
+        let sig = v.getFieldSignature();
+        let sigStr = sig.toString();
+        let base;
+        let real;
+        if (v instanceof Ref_1.ArkInstanceFieldRef) {
+            base = v.getBase();
+            if (base instanceof Local_1.Local && base.getName() == Pag_1.GLOBAL_THIS && base.getDeclaringStmt() == null) {
+                // replace the base in fieldRef
+                base = this.getGlobalThisValue();
+                v.setBase(base);
+            }
+            real = this.instanceField2UniqInstanceMap.get([sigStr, base]);
+            if (!real) {
+                this.instanceField2UniqInstanceMap.set([sigStr, base], v);
+                real = v;
+            }
+        }
+        else {
+            real = this.staticField2UniqInstanceMap.get(sigStr);
+            if (!real) {
+                this.staticField2UniqInstanceMap.set(sigStr, v);
+                real = v;
+            }
+        }
+        return real;
+    }
+    /**
+     * check if a method is singleton function
+     * rule: static method, assign heap obj to global var or static field, return the receiver
+     */
+    isSingletonFunction(funcID) {
+        if (this.singletonFuncMap.has(funcID)) {
+            return this.singletonFuncMap.get(funcID);
+        }
+        let arkMethod = this.cg.getArkMethodByFuncID(funcID);
+        if (!arkMethod) {
+            this.singletonFuncMap.set(funcID, false);
+            return false;
+        }
+        if (!arkMethod.getModifiers().has(TSConst_1.STATIC_KEYWORD)) {
+            this.singletonFuncMap.set(funcID, false);
+            return false;
+        }
+        let funcPag = this.funcPags.get(funcID);
+        let heapObjects = [...funcPag.getInternalEdges()]
+            .filter(edge => edge.kind == Pag_1.PagEdgeKind.Address)
+            .map(edge => edge.dst);
+        let returnValues = arkMethod.getReturnValues();
+        let result = this.isValueConnected([...funcPag.getInternalEdges()], heapObjects, returnValues);
+        this.singletonFuncMap.set(funcID, result);
+        if (result) {
+            logger.info(`function ${funcID} is marked as singleton function`);
+        }
+        return result;
+    }
+    isValueConnected(edges, leftNodes, targetNodes) {
+        // build funcPag graph
+        const graph = new Map();
+        let hasStaticFieldOrGlobalVar = false;
+        for (const edge of edges) {
+            let dst = this.getRealInstanceRef(edge.dst);
+            let src = this.getRealInstanceRef(edge.src);
+            if (!graph.has(dst)) {
+                graph.set(dst, []);
+            }
+            if (!graph.has(src)) {
+                graph.set(src, []);
+            }
+            if (dst instanceof Ref_1.ArkStaticFieldRef || src instanceof Ref_1.ArkStaticFieldRef) {
+                hasStaticFieldOrGlobalVar = true;
+            }
+            graph.get(src).push(dst);
+        }
+        if (!hasStaticFieldOrGlobalVar) {
+            return false;
+        }
+        for (const targetNode of targetNodes) {
+            for (const leftNode of leftNodes) {
+                const visited = new Set();
+                let meetStaticField = false;
+                if (this.funcPagDfs(graph, visited, leftNode, targetNode, meetStaticField)) {
+                    return true; // a value pair that satisfy condition
+                }
+                if (!meetStaticField) {
+                    break; // heap obj will not deal any more
+                }
+            }
+        }
+        return false;
+    }
+    funcPagDfs(graph, visited, currentNode, targetNode, staticFieldFound) {
+        if (currentNode === targetNode) {
+            return staticFieldFound;
+        }
+        visited.add(currentNode);
+        for (const neighbor of graph.get(currentNode) || []) {
+            // TODO: add global variable
+            const isSpecialNode = neighbor instanceof Ref_1.ArkStaticFieldRef;
+            if (!visited.has(neighbor)) {
+                if (isSpecialNode) {
+                    staticFieldFound = true;
+                }
+                if (this.funcPagDfs(graph, visited, neighbor, targetNode, staticFieldFound)) {
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+    getGlobalThisValue() {
+        var _a;
+        return (_a = this.globalThisValue) !== null && _a !== void 0 ? _a : new Local_1.Local(Pag_1.GLOBAL_THIS);
+    }
+    getEdgeKindForAssignStmt(stmt) {
+        if (this.stmtIsCreateAddressObj(stmt)) {
+            return Pag_1.PagEdgeKind.Address;
+        }
+        if (this.stmtIsCopyKind(stmt)) {
+            return Pag_1.PagEdgeKind.Copy;
+        }
+        if (this.stmtIsReadKind(stmt)) {
+            return Pag_1.PagEdgeKind.Load;
+        }
+        if (this.stmtIsWriteKind(stmt)) {
+            return Pag_1.PagEdgeKind.Write;
+        }
+        return Pag_1.PagEdgeKind.Unknown;
+    }
+    /**\
+     * ArkNewExpr, ArkNewArrayExpr, function ptr, globalThis
+     */
+    stmtIsCreateAddressObj(stmt) {
+        let lhOp = stmt.getLeftOp();
+        let rhOp = stmt.getRightOp();
+        if ((rhOp instanceof Expr_1.ArkNewExpr || rhOp instanceof Expr_1.ArkNewArrayExpr) ||
+            (lhOp instanceof Local_1.Local && rhOp instanceof Local_1.Local &&
+                rhOp.getType() instanceof Type_1.FunctionType &&
+                rhOp.getDeclaringStmt() === null ||
+                (rhOp instanceof Local_1.Local && rhOp.getName() == Pag_1.GLOBAL_THIS && rhOp.getDeclaringStmt() == null))) {
+            return true;
+        }
+        // TODO: add other Address Obj creation
+        // like static object
+        return false;
+    }
+    stmtIsCopyKind(stmt) {
+        let lhOp = stmt.getLeftOp();
+        let rhOp = stmt.getRightOp();
+        let condition = (lhOp instanceof Local_1.Local && (rhOp instanceof Local_1.Local || rhOp instanceof Ref_1.ArkParameterRef ||
+            rhOp instanceof Ref_1.ArkThisRef || rhOp instanceof Ref_1.ArkStaticFieldRef)) ||
+            (lhOp instanceof Ref_1.ArkStaticFieldRef && rhOp instanceof Local_1.Local);
+        if (condition) {
+            return true;
+        }
+        return false;
+    }
+    stmtIsWriteKind(stmt) {
+        let lhOp = stmt.getLeftOp();
+        let rhOp = stmt.getRightOp();
+        if (rhOp instanceof Local_1.Local &&
+            (lhOp instanceof Ref_1.ArkInstanceFieldRef || lhOp instanceof Ref_1.ArkArrayRef)) {
+            return true;
+        }
+        return false;
+    }
+    stmtIsReadKind(stmt) {
+        let lhOp = stmt.getLeftOp();
+        let rhOp = stmt.getRightOp();
+        if (lhOp instanceof Local_1.Local &&
+            (rhOp instanceof Ref_1.ArkInstanceFieldRef || rhOp instanceof Ref_1.ArkArrayRef)) {
+            return true;
+        }
+        return false;
+    }
+    addToDynamicCallSite(funcPag, cs) {
+        var _a;
+        funcPag.addDynamicCallSite(cs);
+        this.pagStat.numDynamicCall++;
+        logger.trace("[add dynamic callsite] " + cs.callStmt.toString() + ":  " + ((_a = cs.callStmt.getCfg()) === null || _a === void 0 ? void 0 : _a.getDeclaringMethod().getSignature().toString()));
+    }
+    setPtForNode(node, pts) {
+        if (!pts) {
+            return;
+        }
+        this.pag.getNode(node).setPointTo(pts.getProtoPtsSet());
+    }
+    getRealThisLocal(input, funcId) {
+        var _a;
+        if (input.getName() != 'this')
+            return input;
+        let real = input;
+        let f = this.cg.getArkMethodByFuncID(funcId);
+        (_a = f === null || f === void 0 ? void 0 : f.getCfg()) === null || _a === void 0 ? void 0 : _a.getStmts().forEach(s => {
+            if (s instanceof Stmt_1.ArkAssignStmt && s.getLeftOp() instanceof Local_1.Local) {
+                if (s.getLeftOp().getName() === 'this') {
+                    real = s.getLeftOp();
+                    return;
+                }
+            }
+        });
+        return real;
+    }
+    doStat() {
+        this.pagStat.numTotalNode = this.pag.getNodeNum();
+    }
+    printStat() {
+        this.pagStat.printStat();
+    }
+    getUnhandledFuncs() {
+        let handledFuncs = this.getHandledFuncs();
+        let unhandleFuncs = Array.from(this.cg.getNodesIter())
+            .filter(f => !handledFuncs.includes(f.getID()))
+            .map(f => f.getID());
+        return unhandleFuncs;
+    }
+    getHandledFuncs() {
+        return Array.from(this.funcPags.keys());
+    }
+}
+exports.PagBuilder = PagBuilder;