svf-lib 1.0.2680 → 1.0.2682

package/SVF-linux-aarch64/include/MTA/FSMPTA.h

@@ -36,56 +36,72 @@
 #define INCLUDE_MTA_FSMPTA_H_
 
 #include "WPA/FlowSensitive.h"
-#include "MTA/MHP.h"
-#include "MTA/LockAnalysis.h"
-#include "MTA/MTASVFGBuilder.h"
-#include "MTA/MTASlicer.h"
-#include <unordered_set>
+#include "Graphs/SlicedGraphs.h"
+
+#include <deque>
 
 namespace SVF
 {
 
-/// One solver for the whole and the sliced SVFG: SVFGGraph is SVFG* (whole;
-/// every node processed) or const SlicedSVFGView* (sliced; nodes outside the
-/// view are propagation barriers). Restriction is answered by
-/// GenericGraphTraits<SVFGGraph>::containsNode, resolved at compile time; the
-/// stock FlowSensitive transfer semantics are untouched.
+class AndersenBase;
+class AndersenWaveDiff;
+
+/// Flow-sensitive solver over an already-built thread-aware SVFG. SVFGGraph is
+/// either SVFG* for the whole graph or const SlicedSVFGView* for an exact slice.
+/// The backing SVFG is owned by MTASVFGBuilder; this class owns only the
+/// analysis state and the SCC detector for its solve graph.
 template<class SVFGGraph>
-class FSMPTA : public FlowSensitive
+class FSMPTA final : public FlowSensitive
 {
 public:
-    /// Constructor.
-    ///  - graph: gates the per-node transfer (the solver runs over the whole
-    ///    thread-aware SVFG). For SVFGGraph == SVFG* it may be null (every node
-    ///    is processed). A SlicedSVFGView needs only its ICFG view for membership,
-    ///    so it can be created before the SVFG itself is built here.
-    FSMPTA(MHP* m, LockAnalysis* la, SVFGGraph graph)
-        : FlowSensitive(m->getTCT()->getPTA()->getPAG()),
-          mhp(m), mtaSVFGBuilder(m, la), graph(graph)
-    {
-    }
-
+    FSMPTA(AndersenWaveDiff& preAnalysis, SVFG& backingGraph,
+           SVFGGraph solveGraph);
     ~FSMPTA() override = default;
 
-    /// Initialise: build the thread-aware SVFG, then solve sparsely on it.
     void initialize() override;
+    void finalize() override;
 
-    /// Restrict the solve to the graph's nodes (whole: no restriction).
-    void processNode(NodeID nodeId) override;
+    static bool supportsCurrentConfiguration();
 
-    inline MHP* getMHP() const
-    {
-        return mhp;
-    }
+    /// Close a backward value-flow slice over FlowSensitive's execution
+    /// dependencies. Besides explicit SVFG predecessors, this follows the
+    /// definition of every top-level pointer read through the solver-global
+    /// points-to map, closes future indirect-call boundary edges, and retains
+    /// variant-GEP transfers whose field-sensitivity side effect is global.
+    static NodeBS buildExecutionDependencyClosure(
+        SVFG* graph, AndersenBase* preAnalysis, NodeBS dependencyNodes);
+
+protected:
+    NodeStack& SCCDetect() override;
+    void processNode(NodeID nodeId) override;
+    void updateConnectedNodes(const SVFGEdgeSetTy& edges) override;
 
 private:
-    MHP* mhp;
-    /// Owns the thread-aware SVFG used by the FS solver (must outlive `svfg`).
-    MTASVFGBuilder mtaSVFGBuilder;
-    /// The graph the solve is restricted to (see the constructor).
-    SVFGGraph graph;
+    using SolveGraphTraits = GenericGraphTraits<SVFGGraph>;
+
+    static void enqueueSVFGNode(const SVFGNode* node, NodeBS& retained,
+                                std::deque<NodeID>& worklist);
+    static void demandTopLevelPointer(const SVFVar* var, SVFG* graph,
+                                      NodeBS& demandedVars, NodeBS& retained,
+                                      std::deque<NodeID>& worklist);
+    static void collectNodeInputDependencies(
+        const SVFGNode* node, SVFG* graph, NodeBS& demandedVars,
+        NodeBS& retained, std::deque<NodeID>& worklist);
+    void buildRetainedAdjacency();
+    void cacheRetainedEdge(SVFGEdge* edge);
+
+    AndersenWaveDiff* preAnalysis;
+    SVFG* backingGraph;
+    SVFGGraph solveGraph;
+    std::unique_ptr<SCCDetection<SVFGGraph>> solveSCC;
+    NodeStack solveNodeStack;
+    Map<NodeID, std::vector<SVFGEdge*>> retainedOutEdges;
+    Set<const SVFGEdge*> retainedEdgeSet;
 };
 
+extern template class FSMPTA<SVFG*>;
+extern template class FSMPTA<const SlicedSVFGView*>;
+
 } // End namespace SVF
 
 #endif /* INCLUDE_MTA_FSMPTA_H_ */

package/SVF-linux-aarch64/include/MTA/LockAnalysis.h

@@ -25,11 +25,6 @@
  *
  *  Created on: 26 Aug 2015
  *      Author: pengd
- *
- * Lock analysis. One implementation runs on the whole program or a slice:
- * analyze() is templated on the graph handle (SVFIR* or const SlicedSVFIRView*),
- * as used by "Multi-Stage On-Demand Program Slicing for Modular Analysis of
- * Multi-Threaded Programs" (ISSTA 2026).
  */
 
 #ifndef INCLUDE_MTA_LockAnalysis_H_
@@ -79,6 +74,9 @@ public:
     typedef Set<CxtStmt> LockSpan;
     typedef Set<CxtStmt> CxtStmtSet;
     typedef Set<CxtLock> CxtLockSet;
+    typedef Set<CallStrCxt> CallStrCxtSet;
+    typedef Map<CallStrCxt, CallStrCxtSet> ContextSuffixToContexts;
+    typedef Map<const ICFGNode*, ContextSuffixToContexts> InstToContextSuffixMap;
 
     typedef Map<CxtLock, LockSpan> CxtLockToSpan;
     typedef Map<CxtLock, NodeBS> CxtLockToLockSet;
@@ -97,27 +95,31 @@ public:
     /// context-sensitive forward traversal from each lock site. Generate following results
     /// (1) context-sensitive lock site,
     /// (2) maps a context-sensitive lock site to its corresponding lock span.
-    /// One implementation for the whole program and a slice: GraphT is SVFIR*
-    /// (whole) or const SlicedSVFIRView* (sliced). Per-graph queries resolve at
-    /// compile time via the graph* overloads in Graphs/SlicedGraphs.h.
+    /// The same implementation runs over full and sliced ICFG/CallGraph traits.
     template<class ICFGGraph, class CGGraph> void analyze(ICFGGraph icfg, CGGraph cg);
-    template<class ICFGGraph, class CGGraph> void analyzeIntraProcedualLock(ICFGGraph icfg, CGGraph cg);
-    template<class ICFGGraph, class CGGraph> bool intraForwardTraverse(ICFGGraph icfg, CGGraph cg, const ICFGNode* lock, InstSet& unlockset, InstSet& forwardInsts);
-    template<class ICFGGraph, class CGGraph> bool intraBackwardTraverse(ICFGGraph icfg, CGGraph cg, const InstSet& unlockset, InstSet& backwardInsts);
+    template<class ICFGGraph>
+    void analyzeIntraProceduralLock(ICFGGraph icfg);
+    template<class ICFGGraph>
+    bool intraForwardTraverse(ICFGGraph icfg, const ICFGNode* lock,
+                              InstSet& unlockSet, InstSet& forwardInsts);
+    template<class ICFGGraph>
+    bool intraBackwardTraverse(ICFGGraph icfg, const InstSet& unlockSet,
+                               InstSet& backwardInsts);
 
     template<class ICFGGraph, class CGGraph> void collectCxtLock(ICFGGraph icfg, CGGraph cg);
     template<class ICFGGraph, class CGGraph> void analyzeLockSpanCxtStmt(ICFGGraph icfg, CGGraph cg);
 
-    template<class ICFGGraph, class CGGraph> void collectLockUnlocksites(ICFGGraph icfg, CGGraph cg);
-    void buildCandidateFuncSetforLock();
+    template<class ICFGGraph, class CGGraph> void collectLockUnlockSites(ICFGGraph icfg, CGGraph cg);
+    template<class CGGraph>
+    void buildCandidateFuncSetForLock(CGGraph cg);
 
     /// Intraprocedural locks
     //@{
     /// Return true if the lock is an intra-procedural lock
     inline bool isIntraLock(const ICFGNode* lock) const
     {
-        assert(locksites.find(lock)!=locksites.end() && "not a lock site?");
-        return ciLocktoSpan.find(lock)!=ciLocktoSpan.end();
+        assert(lockSites.find(lock)!=lockSites.end() && "not a lock site?");
+        return ciLockToSpan.find(lock)!=ciLockToSpan.end();
     }
 
     /// Add intra-procedural lock
@@ -126,7 +128,7 @@ public:
         for(InstSet::const_iterator it = stmts.begin(), eit = stmts.end(); it!=eit; ++it)
         {
             instCILocksMap[*it].insert(lockSite);
-            ciLocktoSpan[lockSite].insert(*it);
+            ciLockToSpan[lockSite].insert(*it);
         }
     }
 
@@ -135,7 +137,7 @@ public:
     {
         for(InstSet::const_iterator it = stmts.begin(), eit = stmts.end(); it!=eit; ++it)
         {
-            instTocondCILocksMap[*it].insert(lockSite);
+            instToCondCILocksMap[*it].insert(lockSite);
         }
     }
 
@@ -148,7 +150,7 @@ public:
     /// Return true if a statement is inside a partial lock/unlock pair (conditional lock with unconditional unlock)
     inline bool isInsideCondIntraLock(const ICFGNode* stmt) const
     {
-        return instTocondCILocksMap.find(stmt)!=instTocondCILocksMap.end();
+        return instToCondCILocksMap.find(stmt)!=instToCondCILocksMap.end();
     }
 
     /// Whether a statement has an (unconditional) intra-procedural lock set, i.e.
@@ -165,6 +167,16 @@ public:
         assert(it!=instCILocksMap.end() && "intralock not found!");
         return it->second;
     }
+
+    /// Return the conditional intra-procedural locks whose may-spans contain
+    /// stmt. Slicing needs these witnesses even though a conditional lock is
+    /// not strong enough to prove mutual exclusion at the client query.
+    inline const InstSet& getCondIntraLockSet(const ICFGNode* stmt) const
+    {
+        InstToInstSetMap::const_iterator it = instToCondCILocksMap.find(stmt);
+        assert(it!=instToCondCILocksMap.end() && "conditional intralock not found!");
+        return it->second;
+    }
     //@}
 
     /// Context-sensitive locks
@@ -173,14 +185,14 @@ public:
     inline void addCxtLock(const CallStrCxt& cxt,const ICFGNode* inst)
     {
         CxtLock cxtlock(cxt,inst);
-        cxtLockset.insert(cxtlock);
+        cxtLockSet.insert(cxtlock);
         DBOUT(DMTA, SVFUtil::outs() << "LockAnalysis Process new lock "; cxtlock.dump());
     }
 
     /// Get context-sensitive lock
     inline bool hasCxtLock(const CxtLock& cxtLock) const
     {
-        return cxtLockset.find(cxtLock)!=cxtLockset.end();
+        return cxtLockSet.find(cxtLock)!=cxtLockSet.end();
     }
 
     /// Return true if the intersection of two locksets is not empty
@@ -216,7 +228,7 @@ public:
     /// Return true if it is a candidate function
     inline bool isLockCandidateFun(const FunObjVar* fun) const
     {
-        return lockcandidateFuncSet.find(fun)!=lockcandidateFuncSet.end();
+        return lockCandidateFuncSet.find(fun)!=lockCandidateFuncSet.end();
     }
 
     /// Context-sensitive statement and lock spans
@@ -233,18 +245,39 @@ public:
         assert(it != instToCxtStmtSet.end());
         return it->second;
     }
-    inline bool hasCxtLockfromCxtStmt(const CxtStmt& cts) const
+    /// Index a callsite context by each of its suffixes (including itself and
+    /// the empty suffix). handleRet can then retrieve exactly the contexts
+    /// accepted by TCT::isContextSuffix without scanning every callsite state.
+    inline void indexCallsiteContext(const ICFGNode* inst, const CallStrCxt& cxt)
+    {
+        ContextSuffixToContexts& suffixIndex = callsiteContextSuffixIndex[inst];
+        for (size_t begin = 0; begin <= cxt.size(); ++begin)
+        {
+            CallStrCxt suffix(cxt.begin() + begin, cxt.end());
+            suffixIndex[suffix].insert(cxt);
+        }
+    }
+    inline const CallStrCxtSet* getCallsiteContextsWithSuffix(
+        const ICFGNode* inst, const CallStrCxt& suffix) const
+    {
+        InstToContextSuffixMap::const_iterator instIt = callsiteContextSuffixIndex.find(inst);
+        if (instIt == callsiteContextSuffixIndex.end())
+            return nullptr;
+        ContextSuffixToContexts::const_iterator suffixIt = instIt->second.find(suffix);
+        return suffixIt == instIt->second.end() ? nullptr : &suffixIt->second;
+    }
+    inline bool hasCxtLockFromCxtStmt(const CxtStmt& cts) const
     {
         CxtStmtToCxtLockSet::const_iterator it = cxtStmtToCxtLockSet.find(cts);
         return (it != cxtStmtToCxtLockSet.end());
     }
-    inline const CxtLockSet& getCxtLockfromCxtStmt(const CxtStmt& cts) const
+    inline const CxtLockSet& getCxtLockFromCxtStmt(const CxtStmt& cts) const
     {
         CxtStmtToCxtLockSet::const_iterator it = cxtStmtToCxtLockSet.find(cts);
         assert(it != cxtStmtToCxtLockSet.end());
         return it->second;
     }
-    inline CxtLockSet& getCxtLockfromCxtStmt(const CxtStmt& cts)
+    inline CxtLockSet& getCxtLockFromCxtStmt(const CxtStmt& cts)
     {
         CxtStmtToCxtLockSet::iterator it = cxtStmtToCxtLockSet.find(cts);
         assert(it != cxtStmtToCxtLockSet.end());
@@ -253,7 +286,7 @@ public:
     /// Add context-sensitive statement
     inline bool addCxtStmtToSpan(const CxtStmt& cts, const CxtLock& cl)
     {
-        cxtLocktoSpan[cl].insert(cts);
+        cxtLockToSpan[cl].insert(cts);
         return cxtStmtToCxtLockSet[cts].insert(cl).second;
     }
     /// Add context-sensitive statement
@@ -263,28 +296,24 @@ public:
         if(find)
         {
             cxtStmtToCxtLockSet[cts].erase(cl);
-            cxtLocktoSpan[cl].erase(cts);
+            cxtLockToSpan[cl].erase(cts);
         }
         return find;
     }
 
-    CxtStmtToCxtLockSet getCSTCLS()
-    {
-        return cxtStmtToCxtLockSet;
-    }
     /// Touch this context statement
     inline void touchCxtStmt(CxtStmt& cts)
     {
         cxtStmtToCxtLockSet[cts];
     }
-    inline bool hasSpanfromCxtLock(const CxtLock& cl)
+    inline bool hasSpanFromCxtLock(const CxtLock& cl)
     {
-        return cxtLocktoSpan.find(cl) != cxtLocktoSpan.end();
+        return cxtLockToSpan.find(cl) != cxtLockToSpan.end();
     }
-    inline LockSpan& getSpanfromCxtLock(const CxtLock& cl)
+    inline LockSpan& getSpanFromCxtLock(const CxtLock& cl)
     {
-        assert(cxtLocktoSpan.find(cl) != cxtLocktoSpan.end());
-        return cxtLocktoSpan[cl];
+        assert(cxtLockToSpan.find(cl) != cxtLockToSpan.end());
+        return cxtLockToSpan[cl];
     }
     //@}
 
@@ -334,7 +363,7 @@ public:
 
     inline u32_t getNumOfCxtLocks()
     {
-        return cxtLockset.size();
+        return cxtLockSet.size();
     }
     /// Print locks and spans
     void printLocks(const CxtStmt& cts);
@@ -354,6 +383,11 @@ protected:
     /// Handle return
     template<class ICFGGraph, class CGGraph> void handleRet(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
+    /// Propagate a callee-exit lock state to one matching callsite context.
+    void handleReturnAtCallsite(const CxtStmt& exitCxtStmt,
+                                const FunObjVar* callee, const ICFGNode* callsite,
+                                const std::vector<const ICFGNode*>& successors);
+
     /// Handle intra
     template<class ICFGGraph, class CGGraph> void handleIntra(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
@@ -372,8 +406,8 @@ protected:
     /// Transfer function for marking context-sensitive statement
     void markCxtStmtFlag(const CxtStmt& tgr, const CxtStmt& src)
     {
-        const CxtLockSet& srclockset = getCxtLockfromCxtStmt(src);
-        if(hasCxtLockfromCxtStmt(tgr)== false)
+        const CxtLockSet& srclockset = getCxtLockFromCxtStmt(src);
+        if(hasCxtLockFromCxtStmt(tgr)== false)
         {
             for(CxtLockSet::const_iterator it = srclockset.begin(), eit = srclockset.end(); it!=eit; ++it)
             {
@@ -383,23 +417,26 @@ protected:
         }
         else
         {
-            if(intersect(getCxtLockfromCxtStmt(tgr),srclockset))
+            if(intersect(getCxtLockFromCxtStmt(tgr),srclockset))
+            {
                 pushToCTSWorkList(tgr);
+            }
         }
     }
     bool intersect(CxtLockSet& tgrlockset, const CxtLockSet& srclockset)
     {
-        CxtLockSet toBeDeleted;
-        for(CxtLockSet::const_iterator it = tgrlockset.begin(), eit = tgrlockset.end(); it!=eit; ++it)
+        bool changed = false;
+        for (CxtLockSet::iterator it = tgrlockset.begin(); it != tgrlockset.end(); )
         {
-            if(srclockset.find(*it)==srclockset.end())
-                toBeDeleted.insert(*it);
-        }
-        for(CxtLockSet::const_iterator it = toBeDeleted.begin(), eit = toBeDeleted.end(); it!=eit; ++it)
-        {
-            tgrlockset.erase(*it);
+            if (srclockset.find(*it) == srclockset.end())
+            {
+                it = tgrlockset.erase(it);
+                changed = true;
+            }
+            else
+                ++it;
         }
-        return !toBeDeleted.empty();
+        return changed;
     }
 
     /// Clear flags
@@ -505,13 +542,16 @@ protected:
     /// Map a statement to all its context-sensitive statements
     InstToCxtStmtSet instToCxtStmtSet;
 
+    /// Incremental exact suffix index for contexts observed at callsites.
+    InstToContextSuffixMap callsiteContextSuffixIndex;
+
     /// Context-sensitive locks
-    CxtLockSet cxtLockset;
+    CxtLockSet cxtLockSet;
 
     /// Map a context-sensitive lock to its lock span statements
     /// Map a context-sensitive statement to its context-sensitive lock
     //@{
-    CxtLockToSpan cxtLocktoSpan;
+    CxtLockToSpan cxtLockToSpan;
     CxtStmtToCxtLockSet cxtStmtToCxtLockSet;
     //@}
 
@@ -523,20 +563,20 @@ protected:
 
     /// Collecting lock/unlock sites
     //@{
-    InstSet locksites;
-    InstSet unlocksites;
+    InstSet lockSites;
+    InstSet unlockSites;
     //@}
 
     /// Candidate functions which relevant to locks/unlocks
     //@{
-    FunSet lockcandidateFuncSet;
+    FunSet lockCandidateFuncSet;
     //@}
 
     /// Used for context-insensitive intra-procedural locks
     //@{
-    CILockToSpan ciLocktoSpan;
+    CILockToSpan ciLockToSpan;
     InstToInstSetMap instCILocksMap;
-    InstToInstSetMap instTocondCILocksMap;
+    InstToInstSetMap instToCondCILocksMap;
     //@}
 
 public:

package/SVF-linux-aarch64/include/MTA/MHP.h

@@ -25,11 +25,6 @@
  *
  *  Created on: Jan 21, 2014
  *      Author: Yulei Sui, Peng Di
- *
- * May-happen-in-parallel analysis. One implementation runs on the whole program
- * or a slice: analyze() is templated on the ICFG and CallGraph it traverses
- * (whole graphs or their sliced views), as used by "Multi-Stage On-Demand Program Slicing for
- * Modular Analysis of Multi-Threaded Programs" (ISSTA 2026).
  */
 
 #ifndef MHP_H_
@@ -62,6 +57,17 @@ public:
     typedef Set<CxtThreadStmt> CxtThreadStmtSet;
     typedef Map<CxtThreadStmt,NodeBS> ThreadStmtToThreadInterleav;
     typedef Map<const ICFGNode*,CxtThreadStmtSet> InstToThreadStmtSetMap;
+    /// Query-only exact compression of the context-sensitive fixed point.
+    /// For one ICFG node, interleavingByTid[t] is the union of the
+    /// interleaving sets of every calling context in which thread t reaches
+    /// the node. MHP's existential context-pair query factors exactly through
+    /// these per-tid unions (see mayHappenInParallelInst).
+    struct NodeThreadSummary
+    {
+        NodeBS tids;
+        Map<NodeID, NodeBS> interleavingByTid;
+    };
+    typedef Map<const ICFGNode*, NodeThreadSummary> InstToThreadSummaryMap;
     typedef SVFLoopAndDomInfo::LoopBBs LoopBBs;
 
     typedef Set<CxtStmt> LockSpan;
@@ -69,8 +75,17 @@ public:
     typedef std::pair<const FunObjVar*,const FunObjVar*> FuncPair;
     typedef Map<FuncPair, bool> FuncPairToBool;
 
-    /// Constructor
-    MHP(TCT* t);
+    enum class StateRepresentation
+    {
+        MaterializedContexts,
+        QuerySummaries
+    };
+
+    /// Construct MHP and initialize its graph-dependent ForkJoinAnalysis.
+    template<class ICFGGraph, class CGGraph>
+    static std::unique_ptr<MHP> create(
+        TCT* t, ICFGGraph icfg, CGGraph cg,
+        StateRepresentation representation = StateRepresentation::MaterializedContexts);
 
     /// Destructor
     virtual ~MHP();
@@ -100,13 +115,16 @@ public:
     /// Whether the function is connected from main function in thread call graph
     bool isConnectedfromMain(const FunObjVar* fun);
 
-//    LockSpan getSpanfromCxtLock(NodeID l);
     /// Interface to query whether two instructions may happen-in-parallel
     virtual bool mayHappenInParallel(const ICFGNode* i1, const ICFGNode* i2);
     virtual bool mayHappenInParallelCache(const ICFGNode* i1, const ICFGNode* i2);
     virtual bool mayHappenInParallelInst(const ICFGNode* i1, const ICFGNode* i2);
     virtual bool executedByTheSameThread(const ICFGNode* i1, const ICFGNode* i2);
 
+    /// Representation-independent per-thread summary used by MHP clients.
+    /// Available after analyze() in both materialized and summary-only modes.
+    const NodeThreadSummary* getThreadSummary(const ICFGNode* inst) const;
+
     /// Get interleaving thread for statement inst
     //@{
     inline const NodeBS& getInterleavingThreads(const CxtThreadStmt& cts)
@@ -137,16 +155,22 @@ public:
     void printInterleaving();
 
 protected:
+    /// Construction is paired with ForkJoinAnalysis initialization by create().
+    /// @param representation Keep per-context copies
+    /// for clients that enumerate raw states (the pre-analysis detector and
+    /// slicer). Main-phase clients issue only MHP queries and can use the exact
+    /// projected query summary instead.
+    explicit MHP(
+        TCT* t,
+        StateRepresentation representation = StateRepresentation::MaterializedContexts);
 
-    inline const CallGraph::FunctionSet& getCallee(const CallICFGNode* inst, CallGraph::FunctionSet& callees)
-    {
-        tcg->getCallees(inst, callees);
-        return callees;
-    }
     /// Update non-candidate functions' interleaving.
     /// Copy interleaving threads of the entry inst to other insts.
     template<class ICFGGraph, class CGGraph> void updateNonCandidateFunInterleaving(ICFGGraph icfg, CGGraph cg);
 
+    /// Build the exact, context-compressed representation used by repeated MHP
+    /// queries after the context-sensitive fixed point has converged.
+    template<class ICFGGraph, class CGGraph> void buildQuerySummaries(ICFGGraph icfg, CGGraph cg);
     /// Handle non-candidate function
     template<class ICFGGraph, class CGGraph> void handleNonCandidateFun(ICFGGraph icfg, CGGraph cg, const CxtThreadStmt& cts);
 
@@ -302,6 +326,9 @@ protected:
     BBToSymJoinsMap bbToSymJoins;   ///< loop block -> symmetric in-loop joins of that loop
     SymJoinToLoopMap symJoinLoop;   ///< symmetric in-loop join -> its loop's blocks
     InstToThreadStmtSetMap instToTSMap; ///< Map an instruction to its ThreadStmtSet
+    InstToThreadSummaryMap instToThreadSummary; ///< Exact per-node/per-tid query compression
+    Map<const ICFGNode*, const ICFGNode*> querySummaryOwner; ///< Non-candidate node -> entry summary
+    StateRepresentation stateRepresentation;
     FuncPairToBool nonCandidateFuncMHPRelMap;
 
 public:
@@ -347,7 +374,8 @@ public:
     /// context-sensitive forward traversal from each fork site. Generate following results
     /// (1) fork join pair, maps a context-sensitive join site to its corresponding thread ids
     /// (2) never happen-in-parallel thread pairs
-    void analyzeForkJoinPair();
+    template<class ICFGGraph, class CGGraph>
+    void analyzeForkJoinPair(ICFGGraph icfg, CGGraph cg);
 
     /// Get directly joined threadIDs based on a context-sensitive join site
     inline NodeBS& getDirectlyJoinedTid(const CxtStmt& cs)
@@ -401,19 +429,27 @@ public:
 private:
 
     /// Handle fork
-    void handleFork(const CxtStmt& cts,NodeID rootTid);
+    template<class ICFGGraph, class CGGraph>
+    void handleFork(ICFGGraph icfg, CGGraph cg,
+                    const CxtStmt& cts, NodeID rootTid);
 
     /// Handle join
-    void handleJoin(const CxtStmt& cts,NodeID rootTid);
+    template<class ICFGGraph, class CGGraph>
+    void handleJoin(ICFGGraph icfg, CGGraph cg,
+                    const CxtStmt& cts, NodeID rootTid);
 
     /// Handle call
-    void handleCall(const CxtStmt& cts,NodeID rootTid);
+    template<class ICFGGraph, class CGGraph>
+    void handleCall(ICFGGraph icfg, CGGraph cg,
+                    const CxtStmt& cts);
 
     /// Handle return
-    void handleRet(const CxtStmt& cts);
+    template<class ICFGGraph, class CGGraph>
+    void handleRet(ICFGGraph icfg, CGGraph cg, const CxtStmt& cts);
 
     /// Handle intra
-    void handleIntra(const CxtStmt& cts);
+    template<class ICFGGraph>
+    void handleIntra(ICFGGraph icfg, const CxtStmt& cts);
 
     /// Return true if the fork and join have the same SCEV
     bool isSameSCEV(const ICFGNode* forkSite, const ICFGNode* joinSite);
@@ -539,11 +575,6 @@ private:
     {
         return getTCG()->getThreadAPI()->getJoinedThread(call);
     }
-    inline const CallGraph::FunctionSet& getCallee(const ICFGNode* inst, CallGraph::FunctionSet& callees)
-    {
-        getTCG()->getCallees(SVFUtil::cast<CallICFGNode>(inst), callees);
-        return callees;
-    }
     /// ThreadCallGraph
     inline ThreadCallGraph* getTCG() const
     {
@@ -611,6 +642,16 @@ private:
     InstToCxtStmt instToCxtStmt;    ///<Map a statement to all its context-sensitive statements
 };
 
+template<class ICFGGraph, class CGGraph>
+std::unique_ptr<MHP> MHP::create(
+    TCT* t, ICFGGraph icfg, CGGraph cg, StateRepresentation representation)
+{
+    std::unique_ptr<MHP> mhp(new MHP(t, representation));
+    mhp->fja->analyzeForkJoinPair(icfg, cg);
+    mhp->buildSymJoinKillTables();
+    return mhp;
+}
+
 } // End namespace SVF
 
 #endif /* MHP_H_ */