svf-lib 1.0.2674 → 1.0.2676

package/SVF-osx/include/MTA/MTA.h

@@ -26,25 +26,58 @@
  *  Created on: May 14, 2014
  *      Author: Yulei Sui, Peng Di
  *
- * The implementation is based on
+ * The base data race detector is based on
  * Yulei Sui, Peng Di, and Jingling Xue. "Sparse Flow-Sensitive Pointer Analysis for Multithreaded Programs".
  * 2016 International Symposium on Code Generation and Optimization (CGO'16)
+ *
+ * This file also declares SlicedMTA, the multi-stage on-demand program slicing
+ * pipeline (MSli) introduced in "Multi-Stage On-Demand Program Slicing for
+ * Modular Analysis of Multi-Threaded Programs" (ISSTA 2026).
  */
 
 #ifndef MTA_H_
 #define MTA_H_
 
+#include <set>
+#include <string>
+#include <vector>
+#include <functional>
+#include <memory>
+#include <utility>
+#include "SVFIR/SVFIR.h"
+#include "SVFIR/SVFValue.h"
+#include "SVFIR/SVFStatements.h"
+#include "SVFIR/SVFVariables.h"
+#include "MemoryModel/PointsTo.h"
+#include "MTA/MHP.h"
+#include "MTA/LockAnalysis.h"
+#include "WPA/Andersen.h"
+#include "Graphs/CallGraph.h"
+
 namespace SVF
 {
 
 class PointerAnalysis;
 class AndersenWaveDiff;
+class AndersenBase;
 class ThreadCallGraph;
+class CallGraph;
 class MTAStat;
 class TCT;
 class MHP;
 class LockAnalysis;
+class SVFStmt;
 class SVFIR;
+class ICFGNode;
+// Forward declarations for the SlicedMTA slicing pipeline (see SlicedMTA impl).
+class MTASVFGBuilder;
+class SVFG;
+class FlowSensitive;
+class SlicedSVFGView;
+class MultiStageSlicer;
+class SingleSlicer;
+class SlicedSVFIRView;
+class SlicedTCT;
 
 /*!
  * Base data race detector
@@ -66,8 +99,8 @@ public:
     virtual MHP* computeMHP(TCT* tct);
     /// Compute locksets
     virtual LockAnalysis* computeLocksets(TCT* tct);
-    /// Perform detection
-    virtual void detect();
+    /// Run the shared detector and print a race report
+    virtual void reportRaces();
 
     // Not implemented for now
     // void dump(Module &module, MHP *mhp, LockAnalysis *lsa);
@@ -81,7 +114,53 @@ public:
     {
         return lsa;
     }
+
+    /// A race pair: two statements that may race.
+    struct RacePair
+    {
+        const SVFStmt* stmt1;
+        const SVFStmt* stmt2;
+        RacePair(const SVFStmt* s1, const SVFStmt* s2) : stmt1(s1), stmt2(s2) {}
+        bool operator<(const RacePair& other) const
+        {
+            if (stmt1 != other.stmt1) return stmt1 < other.stmt1;
+            return stmt2 < other.stmt2;
+        }
+    };
+
+    /// Shared equivalence-class race detector (used by both MTA::reportRaces and
+    /// the SlicedMTA pipeline). Returns the racy statements and fills outRacePairs.
+    static std::set<const SVFStmt*> detectRace(
+        SVFIR* svfIr, AndersenBase* pta, MHP* mhp, LockAnalysis* lockAnalysis,
+        CallGraph* callGraph, std::set<RacePair>& outRacePairs);
+
+    /// Escape/points-to helpers for the shared detector.
+    static PointsTo getGlobalObjectVariables(SVFIR* svfIr);
+    static PointsTo getPointsToClosure(AndersenBase* pta, const PointsTo& pts);
+
+    /// Whether the program has any thread (fork-target) function reachable via a
+    /// fork edge.
+    static bool hasThreadFunctions(CallGraph* callGraph);
+
 private:
+    /// One occurrence of a memory access under one thread instance.
+    struct RaceOccurrence
+    {
+        const SVFStmt* stmt;
+        const ICFGNode* node;
+        bool isStore;
+        NodeID tid;
+        NodeBS interleav;
+        bool locked;
+    };
+
+    /// Helpers for the equivalence-class race detector.
+    //@{
+    static bool occurrencesRace(MHP* mhp, const RaceOccurrence& first, const RaceOccurrence& second);
+    static void commitRacePair(std::set<RacePair>& out,
+                               const RaceOccurrence& first, const RaceOccurrence& second);
+    //@}
+
     ThreadCallGraph* tcg;
     std::unique_ptr<TCT> tct;
     std::unique_ptr<MTAStat> stat;
@@ -89,6 +168,110 @@ private:
     LockAnalysis* lsa;
 };
 
+/*!
+ * Multi-stage on-demand slicing race detection pipeline (MSli).
+ *
+ * runOnModule drives five stages on a pre-built SVFIR:
+ *   1. (caller) build SVFIR + resolve indirect calls into the PAG
+ *   2. pre-analysis: Andersen, TCT, MHP, lock, candidate race pairs, VFG_pre
+ *   3. MTA slicing: slice the thread-aware graph, build the sliced MHP/lock
+ *   4. PTA slicing + main flow-sensitive FSAM (FSMPTA) on the slice
+ *   5. final race detection on the sliced graph using FSAM points-to
+ *
+ * It operates entirely on the SVFIR (LLVM-free). The single LLVM-dependent step --
+ * materialising resolved indirect calls into the PAG -- is injected by the caller
+ * as a callback (see runOnModule).
+ *
+ * Behaviour is controlled by Options (MTFlowSensitive, EnableSlicing,
+ * SlicingSingle, SlicedDumpDot).
+ */
+class SlicedMTA
+{
+public:
+    /// The one LLVM-dependent step of the pipeline: resolve the indirect-call
+    /// edges discovered by Andersen into PAG copy/call edges. The caller (the
+    /// LLVM-aware tool) supplies it via SVFIRBuilder::updateCallGraph.
+    using ResolveIndirectCalls = std::function<void(CallGraph*)>;
+
+    /// The shared race detector lives in MTA; reuse its race-pair type.
+    using RacePair = MTA::RacePair;
+
+    // Out-of-line (defined where the member types are complete) so callers that
+    // only see the forward-declared unique_ptr member types need not be complete.
+    SlicedMTA();
+    ~SlicedMTA();
+
+    SlicedMTA(const SlicedMTA&) = delete;
+    SlicedMTA& operator=(const SlicedMTA&) = delete;
+
+    /// Run the slicing pipeline on a pre-built SVFIR.
+    void runOnModule(SVFIR* pag, const ResolveIndirectCalls& resolveIndirectCalls);
+
+private:
+    // --- pipeline stages ---
+    bool runPreAnalysis(const ResolveIndirectCalls& resolveIndirectCalls);
+    bool runMTASlicingAndAnalysis();
+    bool runPTASlicingAndAnalysis();
+    bool runFinalRaceDetection();
+    void buildVFGPre();
+
+    /// No-slice A/B baseline: run the FSAM detection on the whole program (no
+    /// slicing), so its time and race set can be compared against the sliced run.
+    void runWholeProgramDetection();
+
+    /// Main pointer-analysis instance feeding final race detection (the
+    /// flow-sensitive FSAM, a BVDataPTAImpl queried polymorphically).
+    BVDataPTAImpl* getMainPTA() const;
+
+    /// Union of both statements of every candidate race pair (the slice targets).
+    std::set<const SVFStmt*> getVulnerableStmts() const;
+
+    // --- race detection ---
+    /// Re-check the candidate race pairs on the sliced graph using FSAM points-to.
+    std::set<RacePair> detectRacePairsOnSlicedGraph(
+        BVDataPTAImpl* slicedPTA, MHP* slicedMHP, LockAnalysis* slicedLockAnalysis);
+
+    // Lock analysis over the WHOLE ICFG (real control flow, no bridging) for the
+    // final detection's lock signature. The sliced lock analysis walks bridged
+    // edges, which fabricate lock-carrying paths the whole program lacks (a
+    // query-preservation break); lock-span is control-flow-sensitive, so it must
+    // see real edges. Built lazily, cheap (no FSAM/MHP) next to the slicing win.
+    LockAnalysis* buildFullLockAnalysis();
+
+    // --- pipeline state (owned unless noted) ---
+    SVFIR* svfIr = nullptr;
+    // Main-phase context depth, set by runOnModule; the pre-analysis uses it
+    // to reconcile context-truncation-merged thread instances.
+    u32_t mainCxtDepth = 2;
+    std::unique_ptr<TCT> tct;
+    std::unique_ptr<MHP> mhp;
+    std::unique_ptr<LockAnalysis> lockAnalysis;
+    // Inclusion-based Andersen's pre-analysis (a shared singleton, not owned
+    // here -- released once in the destructor). Feeds the TCT / MHP / lock /
+    // race pre-analysis, the thread-aware VFG_pre, and the main FSMPTA.
+    AndersenWaveDiff* preAnder = nullptr;
+    std::unique_ptr<MTASVFGBuilder> vfgPreBuilder; // owns vfgPre
+    SVFG* vfgPre = nullptr;
+    std::unique_ptr<MultiStageSlicer> multiStageSlicer;
+    std::unique_ptr<SingleSlicer> singleSlicer;
+    // -mta-slicing-single: the one unified slice, computed in MTA slicing and reused
+    // (not recomputed) for PTA slicing so both stages share V_Single.
+    std::set<const ICFGNode*> singleSlicedNodes;
+    std::unique_ptr<SlicedSVFIRView> mtaSlicedView;
+    std::unique_ptr<SlicedSVFIRView> ptaSlicedView;
+    std::unique_ptr<SlicedSVFGView> slicedSVFGView;
+    std::unique_ptr<FlowSensitive> mtaFSMPTA;
+    std::unique_ptr<SlicedTCT> slicedTCT;
+    std::unique_ptr<MHP> slicedMhp;
+    std::unique_ptr<LockAnalysis> slicedLockAnalysis;
+    // Whole-ICFG lock analysis for the final detection (see buildFullLockAnalysis).
+    std::unique_ptr<SlicedSVFIRView> fullLockView;
+    std::unique_ptr<SlicedTCT> fullLockTCT;
+    std::unique_ptr<LockAnalysis> fullLockAnalysis;
+    bool hasThreadFunctions = false;
+    std::set<RacePair> racePairs;
+};
+
 } // End namespace SVF
 
 #endif /* MTA_H_ */

package/SVF-osx/include/MTA/MTASVFGBuilder.h

@@ -0,0 +1,176 @@
+//===- MTASVFGBuilder.h -- Thread-aware SVFG builder for FSAM -----------===//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * MTASVFGBuilder.h
+ *
+ *      Author: Jiawei Yang
+ *
+ * Builds a *thread-aware* Sparse Value-Flow Graph (SVFG) for the FSAM
+ * flow-sensitive multithreaded pointer analysis (Sui, Di, Xue, CGO'16).
+ *
+ * On top of the stock thread-oblivious SVFG, it adds inter-thread (interference)
+ * indirect value-flow edges between store/load and store/store statements that
+ *   (1) may-happen-in-parallel (MHP), and
+ *   (2) may-alias on the address-taken object, and
+ *   (3) are not excluded by a common lock (non-interference lock-pair pruning).
+ */
+
+#ifndef INCLUDE_MTA_MTASVFGBUILDER_H_
+#define INCLUDE_MTA_MTASVFGBUILDER_H_
+
+#include "MSSA/SVFGBuilder.h"
+#include "Graphs/SVFG.h"
+#include "Graphs/SVFGEdge.h"
+#include "MTA/MHP.h"
+#include "MTA/LockAnalysis.h"
+#include "MemoryModel/PointsTo.h"
+#include <map>
+#include <set>
+#include <utility>
+
+namespace SVF
+{
+
+class SlicedICFGView;
+
+class MTASVFGBuilder : public SVFGBuilder
+{
+public:
+    typedef Set<const StmtSVFGNode*> SVFGNodeSet;
+    typedef NodeBS SVFGNodeIDSet;
+
+    /// Constructor: driven by the interleaving (MHP) and lock analyses.
+    MTASVFGBuilder(MHP* m, LockAnalysis* la) : SVFGBuilder(), mhp(m), lockana(la) {}
+    ~MTASVFGBuilder() override = default;
+
+    /// Number of thread-aware (interference) SVFG edges added.
+    static u32_t numOfNewSVFGEdges;
+
+    /// Configure the builder for the main (post-slicing) FSAM solve rather than
+    /// the pre-analysis VFG_pre:
+    ///  - slice != null restricts the interference-edge construction to kept
+    ///    store/load nodes (a sliced-out endpoint's edge is inert in the gated
+    ///    solve, so it need not be built);
+    ///  - the [THREAD-VF] query map is skipped, as only VFG_pre slicing reads it.
+    /// The pre-analysis build leaves this unset (whole program, query map built).
+    void configureForMainSolve(const SlicedICFGView* slice)
+    {
+        icfgSlice = slice;
+        recordThreadVF = false;
+    }
+
+    /// A candidate thread-aware value-flow edge s --o--> s' (src store, dst
+    /// load/store), keyed by its endpoint SVFG nodes.
+    typedef std::pair<const StmtSVFGNode*, const StmtSVFGNode*> ThreadVFEdge;
+
+    /// [THREAD-VF] per-edge query map (MSli §4.2, Fig. 6 rule [THREAD-VF]).
+    ///
+    /// While building VFG_pre we record, for every candidate thread-aware
+    /// value-flow edge (s,s') the construction evaluates, its Query(s --o--> s')
+    /// set: the endpoints {s,s'} plus — under a common lock — the in-span
+    /// witnesses Succ_spl(s) / Pred_spl'(s') that decide TL/HD membership, i.e.
+    /// whether the edge survives the non-interference test (Def. 2). The query is
+    /// kept *per edge* (not pre-unioned) so ILA slicing can restrict the sources
+    /// to the edges that survive the FSPTA slice — ThreadVF(VFG'_pre) — rather
+    /// than every candidate pair. Feeding the retained edges' queries into ILA
+    /// slicing makes the sliced MHP/lock reproduce the same value-flow decisions
+    /// the main phase makes, while keeping the slice minimal.
+    ///
+    /// The value stores only the additional lock-span witnesses; the endpoint
+    /// ICFG nodes are implicit in the key and consumers must add them back.
+    const std::map<ThreadVFEdge, std::set<const ICFGNode*>>& getThreadVFQueryMap() const
+    {
+        return threadVFQueryMap;
+    }
+
+protected:
+    /// Rewrite the SVFG build hook: build the stock SVFG, then add MHP edges.
+    void buildSVFG() override;
+
+    /// Inject a thread-aware MRGenerator so the MemSSA mod-ref carries the FSAM
+    /// fork/join side effects (relocated here from core MemRegion).
+    std::unique_ptr<MRGenerator> createMRGenerator(BVDataPTAImpl* pta, bool ptrOnlyMSSA) override;
+
+private:
+    /// Main-solve configuration (see configureForMainSolve); defaults suit VFG_pre.
+    const SlicedICFGView* icfgSlice = nullptr; ///< null = whole program
+    bool recordThreadVF = true;                ///< false = skip [THREAD-VF] recording
+
+    /// Collect the store/load SVFG nodes to pair for interference edges (all of
+    /// them, or -- when a slice is set -- only the kept ones).
+    void collectLoadStoreSVFGNodes();
+
+    /// FSAM join-related thread-oblivious value flow (the "return" half of
+    /// treating a join as a call without a forward): connect each start
+    /// routine's exit defs (FormalOUT) to the ActualOUT at every site that joins
+    /// it (FormalOUT -> ActualOUT ret edge). Done here as a post-pass over the
+    /// stock SVFG, so core SVFG.cpp stays unmodified.
+    void connectThreadJoinEdges();
+
+    /// Add a FormalOUT -> ActualOUT inter-procedural indirect ret edge for a
+    /// join, mirroring SVFG::addInterIndirectVFRetEdge using the public SVFG API
+    /// (points-to intersection + dedup via hasInterVFGEdge + addSVFGEdge).
+    void addJoinRetEdge(const FormalOUTSVFGNode* formalOut,
+                        const ActualOUTSVFGNode* actualOut, CallSiteID csId);
+
+    /// Connect inter-thread (interference) value-flow edges for MHP pairs.
+    void connectMHPEdges(PointerAnalysis* pta);
+
+    void handleStoreLoad(const StmtSVFGNode* n1, const StmtSVFGNode* n2, PointerAnalysis* pta);
+    void handleStoreStore(const StmtSVFGNode* n1, const StmtSVFGNode* n2, PointerAnalysis* pta);
+
+    /// Record the [THREAD-VF] slicing sources for one candidate pair s --o--> s'
+    /// (s = src store, sp = dst load/store). Adds the endpoints, and — when the
+    /// pair is protected by a common lock — the in-span successor/predecessor
+    /// witnesses needed to re-decide the non-interference (tail/head) test.
+    void recordThreadVFSource(const StmtSVFGNode* s, const StmtSVFGNode* sp, bool commonLock);
+
+    /// Add a thread-MHP indirect value-flow edge srcId -> dstId carrying pts.
+    SVFGEdge* addTDEdge(NodeID srcId, NodeID dstId, const PointsTo& pts);
+
+    /// Lock-span head/tail tests (non-interference lock-pair pruning).
+    //@{
+    SVFGNodeIDSet getPrevNodes(const StmtSVFGNode* n);
+    SVFGNodeIDSet getSuccNodes(const StmtSVFGNode* n);
+    bool isHeadOfSpan(const StmtSVFGNode* n);
+    bool isTailOfSpan(const StmtSVFGNode* n);
+    //@}
+
+    SVFGNodeSet stnodeSet;  ///< all store SVFG nodes
+    SVFGNodeSet ldnodeSet;  ///< all load SVFG nodes
+
+    /// [THREAD-VF] per-edge query map (see getThreadVFQueryMap).
+    std::map<ThreadVFEdge, std::set<const ICFGNode*>> threadVFQueryMap;
+
+    MHP* mhp;
+    LockAnalysis* lockana;
+
+    Map<const StmtSVFGNode*, SVFGNodeIDSet> prevset;
+    Map<const StmtSVFGNode*, SVFGNodeIDSet> succset;
+    Map<const StmtSVFGNode*, bool> headmap;
+    Map<const StmtSVFGNode*, bool> tailmap;
+};
+
+} // End namespace SVF
+
+#endif /* INCLUDE_MTA_MTASVFGBUILDER_H_ */

package/SVF-osx/include/MTA/MTASlicer.h

@@ -0,0 +1,275 @@
+//===- MTASlicer.h -- Multi-stage on-demand program slicers ---------------===//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * MTASlicer.h
+ *
+ *      Author: Jiawei Yang
+ *
+ * The program slicers of "Multi-Stage On-Demand Program Slicing for Modular
+ * Analysis of Multi-Threaded Programs" (ISSTA 2026): a shared MTASlicerBase plus
+ * three concrete slicers.
+ *   - MultiStageSlicer   : ILA (sync + dual + call) slice for the thread-aware analysis
+ *   (its FSPTA stage: data-dependence slice over the thread-aware VFG_pre)
+ *   - SingleSlicer: one unified slice combining all three dependence kinds, shared
+ *                   by both ILA and FSPTA (the single-pass baseline, MSli §3/§5.4)
+ */
+
+#ifndef MTA_MTASLICER_H
+#define MTA_MTASLICER_H
+
+#include "SVFIR/SVFIR.h"
+#include "SVFIR/SVFStatements.h"
+#include "SVFIR/SVFVariables.h"
+#include "WPA/Andersen.h"
+#include "MTA/MHP.h"
+#include "MTA/LockAnalysis.h"
+#include "MTA/TCT.h"
+#include "Graphs/SlicedGraphs.h"
+#include "Graphs/ThreadCallGraph.h"
+#include "Graphs/ICFG.h"
+#include "Graphs/ICFGNode.h"
+#include <fstream>
+#include "Graphs/ICFGEdge.h"
+#include "Graphs/CallGraph.h"
+#include "Util/WorkList.h"
+#include <memory>
+#include <set>
+#include <string>
+#include <unordered_map>
+#include <unordered_set>
+#include <vector>
+#include <utility>
+
+namespace SVF
+{
+
+// Forward declarations
+class SVFG;
+class VFGNode;          // SVFGNode is a typedef for VFGNode
+class PointerAnalysis;
+
+
+//===----------------------------------------------------------------------===//
+// SlicedTCT - the Thread-Create-Tree rebuilt over a SlicedThreadCallGraphView.
+//
+// Inherits TCT and overrides the ThreadCallGraph-traversing steps to use the
+// sliced view. It sits at the sliced-representation layer (built from the view,
+// consumed by the sliced MHP/LockAnalysis graph-access), which is why it lives
+// here with the views rather than beside the analyses.
+//===----------------------------------------------------------------------===//
+class SlicedTCT : public TCT
+{
+public:
+    /// @param p PointerAnalysis (the shared Andersen pre-analysis)
+    /// @param slicedView SlicedSVFIRView containing a SlicedThreadCallGraphView
+    /// @param maxContextLen Max context length (0 = use Options::MaxContextLen())
+    SlicedTCT(PointerAnalysis* p, const SlicedSVFIRView* slicedView, u32_t maxContextLen = 0);
+
+    ~SlicedTCT() override = default;
+
+    /// Override pushCxt to use the custom maxContextLen
+    void pushCxt(CallStrCxt& cxt, const CallICFGNode* call, const FunObjVar* callee) override;
+
+protected:
+    void build() override;
+    void markRelProcs() override;
+    void markRelProcs(const FunObjVar* fun) override;
+    void collectLoopInfoForJoin() override;
+    void handleCallRelation(CxtThreadProc& ctp, const CallGraphEdge* cgEdge, const CallICFGNode* cs) override;
+
+private:
+    void collectEntryFunInCallGraph() override;
+
+    const SlicedThreadCallGraphView* tcgView; // ThreadCallGraph view (from the sliced view)
+    u32_t maxContextLen; // 0 means use Options::MaxContextLen()
+
+    bool isKeptNode(const CallGraphNode* node) const;
+    bool isKeptEdge(const CallGraphEdge* edge) const;
+    void getKeptForkSites(std::vector<const ICFGNode*>& out) const;
+    void getKeptJoinSites(std::vector<const ICFGNode*>& out) const;
+};
+
+
+/**
+ * MTASlicerBase - Base class for program slicing.
+ *
+ * Holds the shared helper methods and data members used by both concrete slicers
+ * (the ILA and FSPTA stages of MultiStageSlicer).
+ */
+class MTASlicerBase
+{
+public:
+    MTASlicerBase(SVFIR* svfIr, AndersenBase* pta, MHP* mhp,
+                  LockAnalysis* lockAnalysis, SVFG* vfg = nullptr);
+    virtual ~MTASlicerBase();
+
+protected:
+    SVFIR* svfIr;
+    AndersenBase* pta;
+    MHP* mhp;
+    LockAnalysis* lockAnalysis;
+    CallGraph* callGraph;
+    SVFG* vfg;   ///< thread-aware VFG_pre (PTA/Single slicers; null for MTA)
+
+    // === Data flow analysis helper ===
+    /**
+     * Paper-faithful (§4.3) data-dependence slice over the thread-aware SVFG
+     * (VFG_pre): seed from the value-flow nodes of the given statements and
+     * backward-traverse every value-flow edge -- direct (top-level def-use),
+     * indirect (address-taken / MemSSA def-use), and thread-aware interference.
+     * Returns the kept ICFG nodes. This is the single dependence model used
+     * by the FSPTA stage.
+     */
+    OrderedSet<const ICFGNode*> sliceDataDependenceOverVFG(
+        const OrderedSet<const SVFStmt*>& seeds, SVFG* vfg);
+
+    /// The SVFG-node granularity of the data-dependence slice above: the set of
+    /// VFG nodes reachable backward from the seeds. ThreadVF(VFG'_pre) is exactly
+    /// the thread-aware edges whose *both* endpoints lie in this set, so ILA
+    /// slicing uses it to restrict the [THREAD-VF] sources to surviving edges.
+    OrderedSet<const VFGNode*> computeDataDependenceSVFGNodes(
+        const OrderedSet<const SVFStmt*>& seeds, SVFG* vfg);
+
+    /// Project the retained VFG nodes (plus the seeds) onto their ICFG nodes.
+    OrderedSet<const ICFGNode*> svfgNodesToICFGNodes(
+        const OrderedSet<const VFGNode*>& nodes, const OrderedSet<const SVFStmt*>& seeds);
+
+    // === Thread analysis helpers ===
+    OrderedSet<const SVFStmt*> getDependentThreadCreate(const SVFStmt* stmt);
+    OrderedSet<const TCTNode*> getTCTNodeSetFromNode(const ICFGNode* node);
+
+    // === Lock analysis helpers ===
+    OrderedSet<const ICFGNode*> getLockSet(const ICFGNode* node);
+    OrderedSet<const CallICFGNode*> collectPthreadStatements(const OrderedSet<const SVFStmt*>& vulnerableStmts);
+    OrderedSet<const CallICFGNode*> collectMutexStatements(const OrderedSet<const SVFStmt*>& vulnerableStmts);
+
+    // === Common slicing helpers ===
+    /**
+     * Collect common pthread and mutex statements (shared by PTA and MTA slicing).
+     * @param vulnerableStatements Set of vulnerable statements
+     * @return Pair of (pthreadCallNodes, mutexCallNodes)
+     */
+    std::pair<OrderedSet<const CallICFGNode*>, OrderedSet<const CallICFGNode*>>
+    collectCommonThreadStatements(const OrderedSet<const SVFStmt*>& vulnerableStatements);
+
+    // === ICFG analysis helpers ===
+    OrderedSet<const ICFGNode*> buildBackwardICFGNodeSet(const OrderedSet<const ICFGNode*>& vulnerableNodes);
+
+    /**
+     * Call-dependence expansion (used by MultiStageSlicer): take the
+     * kept functions of the given nodes, close upward over the call graph
+     * (every transitive caller), then add each kept function's entry/exit nodes
+     * and the call/ret nodes of every call site targeting it.
+     * @param nodes Current set of ICFG nodes
+     * @return The input nodes plus the call/ret and entry/exit nodes above
+     */
+    OrderedSet<const ICFGNode*> expandCallDependence(const OrderedSet<const ICFGNode*>& nodes);
+
+    /**
+     * Perform dual slicing (temporal slicing): filter statements based on control flow and parallel execution.
+     * This is shared by both PTA and MTA slicing.
+     * @param slicedNodes Set of statements from statement-level slicing
+     * @return Set of ICFG nodes in the dual slice
+     */
+    OrderedSet<const ICFGNode*> runDualSlicing(
+        const OrderedSet<const ICFGNode*>& slicedNodes);
+};
+
+/**
+ * MultiStageSlicer - the multi-stage (differential) slicer of MSli: one class,
+ * two stages sharing one memoised data-dependence closure over VFG_pre.
+ *   Stage 1 (ILA):  runILASlicing  -- synchronization/dual slicing + function
+ *                                     expansion, feeding the sliced MHP/lock.
+ *   Stage 2 (FSPTA): runPTASlicing -- backward data-dependence slice feeding
+ *                                     the sliced flow-sensitive solve.
+ * Contrast: SingleSlicer below folds everything into ONE unified slice.
+ */
+class MultiStageSlicer : public MTASlicerBase
+{
+public:
+    MultiStageSlicer(SVFIR* svfIr, AndersenBase* pta, MHP* mhp,
+                     LockAnalysis* lockAnalysis, SVFG* vfg = nullptr);
+
+    /**
+     * Stage 1: the ILA slice (dual slicing + function expansion for the IRView).
+     * @param vulnerableStatements Set of vulnerable statements to start slicing from
+     *        (the [INIT] rule: pre-analysis race statements).
+     * @param threadVFSources Extra ILA slicing sources from the [THREAD-VF] rule
+     *        (MSli 4.2): statements whose MHP/lock-span results are queried during
+     *        the main-phase thread-aware value-flow construction (endpoints and
+     *        in-span non-interference witnesses collected while building VFG_pre).
+     * @return Set of ICFG nodes in the slice (including call/ret and entry/exit nodes)
+     */
+    OrderedSet<const ICFGNode*> runILASlicing(
+        const OrderedSet<const SVFStmt*>& vulnerableStatements,
+        const OrderedSet<const ICFGNode*>& threadVFSources = {});
+
+    /**
+     * Stage 2: the FSPTA slice (backward data dependence over the thread-aware
+     * VFG_pre; node set only, no function expansion).
+     */
+    OrderedSet<const ICFGNode*> runPTASlicing(
+        const OrderedSet<const SVFStmt*>& vulnerableStatements);
+
+    /**
+     * The FSPTA data-dependence slice at SVFG-node granularity (memoised). The
+     * ILA stage queries this first, to restrict the [THREAD-VF] sources to
+     * ThreadVF(VFG'_pre); runPTASlicing reuses the same set, so the backward
+     * closure over VFG_pre is computed once and shared across both stages.
+     */
+    const OrderedSet<const VFGNode*>& getRetainedSVFGNodes(
+        const OrderedSet<const SVFStmt*>& vulnerableStatements);
+
+private:
+    OrderedSet<const VFGNode*> retainedSVFGNodes; ///< memoised data-dependence slice
+    bool retainedComputed = false;
+};
+
+/**
+ * SingleSlicer - Unified slicer combining synchronization, data, and call
+ * dependence into ONE slice (the single-pass baseline, MSli §3/§5.4: the
+ * transitive closure of the target statements under the combined dependence
+ * graph). Both ILA and FSPTA run on this single slice, so V_ILA, V_PTA subset
+ * V_Single. Used by the differential-slicing ablation (-mta-slicing-single).
+ *
+ * Iteratively applies data dependence (over the thread-aware VFG_pre) and call
+ * dependence until convergence, then a single dual-slicing pass.
+ */
+class SingleSlicer : public MTASlicerBase
+{
+public:
+    SingleSlicer(SVFIR* svfIr, AndersenBase* pta, MHP* mhp,
+                 LockAnalysis* lockAnalysis, SVFG* vfg = nullptr);
+
+    /**
+     * Perform unified slicing combining synchronization, data, and call dependence.
+     * @param vulnerableStatements Set of vulnerable statements to start slicing from
+     * @return Set of ICFG nodes in the slice (including call/ret and entry/exit nodes)
+     */
+    OrderedSet<const ICFGNode*> runSlicing(
+        const OrderedSet<const SVFStmt*>& vulnerableStatements);
+};
+
+} // End namespace SVF
+
+#endif // MTA_MTASLICER_H