svf-lib 1.0.736 → 1.0.737

package/SVF-linux/include/Graphs/CHG.h

@@ -0,0 +1,351 @@
+//===----- CHG.h -- Base class of pointer analyses ---------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013-2017>  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * CHG.h (previously CHA.h)
+ *
+ *  Created on: Apr 13, 2016
+ *      Author: Xiaokang Fan
+ * 
+ * Created on: Aug 24, 2019
+ *      Author: Mohamad Barbar
+ */
+
+#ifndef CHA_H_
+#define CHA_H_
+
+#include "Util/SVFModule.h"
+#include "Graphs/GenericGraph.h"
+#include "Util/WorkList.h"
+
+namespace SVF
+{
+
+class SVFModule;
+class CHNode;
+
+typedef Set<const GlobalValue*> VTableSet;
+typedef Set<const SVFFunction*> VFunSet;
+
+/// Common base for class hierarchy graph. Only implements what PointerAnalysis needs.
+class CommonCHGraph
+{
+public:
+    virtual ~CommonCHGraph() { };
+    enum CHGKind
+    {
+        Standard,
+        DI
+    };
+
+    virtual bool csHasVFnsBasedonCHA(CallSite cs) = 0;
+    virtual const VFunSet &getCSVFsBasedonCHA(CallSite cs) = 0;
+    virtual bool csHasVtblsBasedonCHA(CallSite cs) = 0;
+    virtual const VTableSet &getCSVtblsBasedonCHA(CallSite cs) = 0;
+    virtual void getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &virtualFunctions) = 0;
+
+    CHGKind getKind(void) const
+    {
+        return kind;
+    }
+
+protected:
+    CHGKind kind;
+};
+
+
+typedef GenericEdge<CHNode> GenericCHEdgeTy;
+class CHEdge: public GenericCHEdgeTy
+{
+public:
+    typedef enum
+    {
+        INHERITANCE = 0x1, // inheritance relation
+        INSTANTCE = 0x2 // template-instance relation
+    } CHEDGETYPE;
+
+    typedef GenericNode<CHNode,CHEdge>::GEdgeSetTy CHEdgeSetTy;
+
+    CHEdge(CHNode *s, CHNode *d, CHEDGETYPE et, GEdgeFlag k = 0):
+        GenericCHEdgeTy(s,d,k)
+    {
+        edgeType = et;
+    }
+
+    CHEDGETYPE getEdgeType() const
+    {
+        return edgeType;
+    }
+
+private:
+    CHEDGETYPE edgeType;
+};
+
+typedef GenericNode<CHNode,CHEdge> GenericCHNodeTy;
+class CHNode: public GenericCHNodeTy
+{
+public:
+    typedef enum
+    {
+        PURE_ABSTRACT = 0x1, // pure virtual abstract class
+        MULTI_INHERITANCE = 0x2, // multi inheritance class
+        TEMPLATE = 0x04 // template class
+    } CLASSATTR;
+
+    typedef std::vector<const SVFFunction*> FuncVector;
+
+    CHNode (const std::string name, NodeID i = 0, GNodeK k = 0):
+        GenericCHNodeTy(i, k), vtable(nullptr), className(name), flags(0)
+    {
+    }
+    ~CHNode()
+    {
+    }
+    std::string getName() const
+    {
+        return className;
+    }
+    /// Flags
+    //@{
+    inline void setFlag(CLASSATTR mask)
+    {
+        flags |= mask;
+    }
+    inline bool hasFlag(CLASSATTR mask) const
+    {
+        return (flags & mask) == mask;
+    }
+    //@}
+
+    /// Attribute
+    //@{
+    inline void setPureAbstract()
+    {
+        setFlag(PURE_ABSTRACT);
+    }
+    inline void setMultiInheritance()
+    {
+        setFlag(MULTI_INHERITANCE);
+    }
+    inline void setTemplate()
+    {
+        setFlag(TEMPLATE);
+    }
+    inline bool isPureAbstract() const
+    {
+        return hasFlag(PURE_ABSTRACT);
+    }
+    inline bool isMultiInheritance() const
+    {
+        return hasFlag(MULTI_INHERITANCE);
+    }
+    inline bool isTemplate() const
+    {
+        return hasFlag(TEMPLATE);
+    }
+    //@}
+
+    void addVirtualFunctionVector(FuncVector vfuncvec)
+    {
+        virtualFunctionVectors.push_back(vfuncvec);
+    }
+    const std::vector<FuncVector> &getVirtualFunctionVectors() const
+    {
+        return virtualFunctionVectors;
+    }
+    void getVirtualFunctions(u32_t idx, FuncVector &virtualFunctions) const;
+
+    const GlobalValue *getVTable() const
+    {
+        return vtable;
+    }
+
+    void setVTable(const GlobalValue *vtbl)
+    {
+        vtable = vtbl;
+    }
+
+private:
+    const GlobalValue* vtable;
+    std::string className;
+    size_t flags;
+    /*
+     * virtual functions inherited from different classes are separately stored
+     * to model different vtables inherited from different fathers.
+     *
+     * Example:
+     * class C: public A, public B
+     * vtableC = {Af1, Af2, ..., inttoptr, Bg1, Bg2, ...} ("inttoptr"
+     * instruction works as the delimiter for separating virtual functions
+     * inherited from different classes)
+     *
+     * virtualFunctionVectors = {{Af1, Af2, ...}, {Bg1, Bg2, ...}}
+     */
+    std::vector<FuncVector> virtualFunctionVectors;
+};
+
+/// class hierarchy graph
+typedef GenericGraph<CHNode,CHEdge> GenericCHGraphTy;
+class CHGraph: public CommonCHGraph, public GenericCHGraphTy
+{
+friend class CHGBuilder;
+
+public:
+    typedef Set<const CHNode*> CHNodeSetTy;
+    typedef FIFOWorkList<const CHNode*> WorkList;
+    typedef Map<std::string, CHNodeSetTy> NameToCHNodesMap;
+    typedef Map<CallSite, CHNodeSetTy> CallSiteToCHNodesMap;
+    typedef Map<CallSite, VTableSet> CallSiteToVTableSetMap;
+    typedef Map<CallSite, VFunSet> CallSiteToVFunSetMap;
+
+    typedef enum
+    {
+        CONSTRUCTOR = 0x1, // connect node based on constructor
+        DESTRUCTOR = 0x2 // connect node based on destructor
+    } RELATIONTYPE;
+
+    CHGraph(SVFModule* svfModule): svfMod(svfModule), classNum(0), vfID(0), buildingCHGTime(0)
+    {
+        this->kind = Standard;
+    }
+    ~CHGraph() override = default;
+
+    void addEdge(const std::string className,
+                 const std::string baseClassName,
+                 CHEdge::CHEDGETYPE edgeType);
+    CHNode *getNode(const std::string name) const;
+    void getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &virtualFunctions) override;
+    void dump(const std::string& filename);
+    void view();
+    void printCH();
+
+    inline s32_t getVirtualFunctionID(const SVFFunction* vfn) const
+    {
+        Map<const SVFFunction*, s32_t>::const_iterator it =
+            virtualFunctionToIDMap.find(vfn);
+        if (it != virtualFunctionToIDMap.end())
+            return it->second;
+        else
+            return -1;
+    }
+    inline const SVFFunction* getVirtualFunctionBasedonID(s32_t id) const
+    {
+        Map<const SVFFunction*, s32_t>::const_iterator it, eit;
+        for (it = virtualFunctionToIDMap.begin(), eit =
+                    virtualFunctionToIDMap.end(); it != eit; ++it)
+        {
+            if (it->second == id)
+                return it->first;
+        }
+        return nullptr;
+    }
+
+    inline void addInstances(const std::string templateName, CHNode* node)
+    {
+        NameToCHNodesMap::iterator it = templateNameToInstancesMap.find(
+                                            templateName);
+        if (it != templateNameToInstancesMap.end())
+            it->second.insert(node);
+        else
+            templateNameToInstancesMap[templateName].insert(node);
+    }
+    inline const CHNodeSetTy &getDescendants(const std::string className)
+    {
+        return classNameToDescendantsMap[className];
+    }
+    inline const CHNodeSetTy &getInstances(const std::string className)
+    {
+        return templateNameToInstancesMap[className];
+    }
+
+    inline bool csHasVtblsBasedonCHA(CallSite cs) override
+    {
+        CallSiteToVTableSetMap::const_iterator it = csToCHAVtblsMap.find(cs);
+        return it != csToCHAVtblsMap.end();
+    }
+    inline bool csHasVFnsBasedonCHA(CallSite cs) override
+    {
+        CallSiteToVFunSetMap::const_iterator it = csToCHAVFnsMap.find(cs);
+        return it != csToCHAVFnsMap.end();
+    }
+    inline const VTableSet &getCSVtblsBasedonCHA(CallSite cs) override
+    {
+        CallSiteToVTableSetMap::const_iterator it = csToCHAVtblsMap.find(cs);
+        assert(it != csToCHAVtblsMap.end() && "cs does not have vtabls based on CHA.");
+        return it->second;
+    }
+    inline const VFunSet &getCSVFsBasedonCHA(CallSite cs) override
+    {
+        CallSiteToVFunSetMap::const_iterator it = csToCHAVFnsMap.find(cs);
+        assert(it != csToCHAVFnsMap.end() && "cs does not have vfns based on CHA.");
+        return it->second;
+    }
+
+    static inline bool classof(const CommonCHGraph *chg)
+    {
+        return chg->getKind() == Standard;
+    }
+
+
+private:
+    SVFModule* svfMod;
+    u32_t classNum;
+    s32_t vfID;
+    double buildingCHGTime;
+    Map<std::string, CHNode *> classNameToNodeMap;
+    NameToCHNodesMap classNameToDescendantsMap;
+    NameToCHNodesMap classNameToAncestorsMap;
+    NameToCHNodesMap classNameToInstAndDescsMap;
+    NameToCHNodesMap templateNameToInstancesMap;
+    CallSiteToCHNodesMap csToClassesMap;
+
+    Map<const SVFFunction*, s32_t> virtualFunctionToIDMap;
+    CallSiteToVTableSetMap csToCHAVtblsMap;
+    CallSiteToVFunSetMap csToCHAVFnsMap;
+};
+
+} // End namespace SVF
+
+namespace llvm
+{
+/* !
+ * GraphTraits specializations for generic graph algorithms.
+ * Provide graph traits for traversing from a constraint node using standard graph traversals.
+ */
+template<> struct GraphTraits<SVF::CHNode*> : public GraphTraits<SVF::GenericNode<SVF::CHNode,SVF::CHEdge>*  >
+{
+};
+
+/// Inverse GraphTraits specializations for call graph node, it is used for inverse traversal.
+template<>
+struct GraphTraits<Inverse<SVF::CHNode*> > : public GraphTraits<Inverse<SVF::GenericNode<SVF::CHNode,SVF::CHEdge>* > >
+{
+};
+
+template<> struct GraphTraits<SVF::CHGraph*> : public GraphTraits<SVF::GenericGraph<SVF::CHNode,SVF::CHEdge>* >
+{
+    typedef SVF::CHNode *NodeRef;
+};
+
+} // End namespace llvm
+
+#endif /* CHA_H_ */

package/SVF-linux/include/Graphs/VFG.h

@@ -68,6 +68,7 @@ public:
     typedef Map<const PAGNode*, IntraPHIVFGNode*> PAGNodeToPHIVFGNodeMapTy;
     typedef Map<const PAGNode*, BinaryOPVFGNode*> PAGNodeToBinaryOPVFGNodeMapTy;
     typedef Map<const PAGNode*, UnaryOPVFGNode*> PAGNodeToUnaryOPVFGNodeMapTy;
+    typedef Map<const PAGNode*, BranchVFGNode*> PAGNodeToBranchVFGNodeMapTy;
     typedef Map<const PAGNode*, CmpVFGNode*> PAGNodeToCmpVFGNodeMapTy;
     typedef Map<const SVFFunction*, VFGNodeSet > FunToVFGNodesMapTy;
 
@@ -93,6 +94,7 @@ protected:
     PAGNodeToPHIVFGNodeMapTy PAGNodeToIntraPHIVFGNodeMap;	///< map a PAGNode to its PHIVFGNode
     PAGNodeToBinaryOPVFGNodeMapTy PAGNodeToBinaryOPVFGNodeMap;	///< map a PAGNode to its BinaryOPVFGNode
     PAGNodeToUnaryOPVFGNodeMapTy PAGNodeToUnaryOPVFGNodeMap;	///< map a PAGNode to its UnaryOPVFGNode
+    PAGNodeToBranchVFGNodeMapTy PAGNodeToBranchVFGNodeMap;	///< map a PAGNode to its BranchVFGNode
     PAGNodeToCmpVFGNodeMapTy PAGNodeToCmpVFGNodeMap;	///< map a PAGNode to its CmpVFGNode
     PAGEdgeToStmtVFGNodeMapTy PAGEdgeToStmtVFGNodeMap;	///< map a PAGEdge to its StmtVFGNode
     FunToVFGNodesMapTy funToVFGNodesMap; ///< map a function to its VFGNodes;
@@ -218,6 +220,12 @@ public:
         assert(it != PAGNodeToUnaryOPVFGNodeMap.end() && "UnaryOPVFGNode can not be found??");
         return it->second;
     }
+    inline BranchVFGNode* getBranchVFGNode(const PAGNode* pagNode) const
+    {
+        PAGNodeToBranchVFGNodeMapTy::const_iterator it = PAGNodeToBranchVFGNodeMap.find(pagNode);
+        assert(it != PAGNodeToBranchVFGNodeMap.end() && "BranchVFGNode can not be found??");
+        return it->second;
+    }
     inline CmpVFGNode* getCmpVFGNode(const PAGNode* pagNode) const
     {
         PAGNodeToCmpVFGNodeMapTy::const_iterator it = PAGNodeToCmpVFGNodeMap.find(pagNode);
@@ -605,11 +613,19 @@ protected:
     /// Add a UnaryOperator VFG node
     inline void addUnaryOPVFGNode(const UnaryOPPE* edge)
     {
-        UnaryOPVFGNode* sNode = new UnaryOPVFGNode(totalVFGNode++, edge->getDstNode());
-        sNode->setOpVer(0, edge->getSrcNode());
+        UnaryOPVFGNode* sNode = new UnaryOPVFGNode(totalVFGNode++, edge->getRes());
+        sNode->setOpVer(0, edge->getOpVar());
+        addVFGNode(sNode,edge->getICFGNode());
+        setDef(edge->getRes(),sNode);
+        PAGNodeToUnaryOPVFGNodeMap[edge->getRes()] = sNode;
+    }
+    /// Add a BranchVFGNode 
+    inline void addBranchVFGNode(const BranchStmt* edge)
+    {
+        BranchVFGNode* sNode = new BranchVFGNode(totalVFGNode++, edge);
         addVFGNode(sNode,edge->getICFGNode());
-        setDef(edge->getDstNode(),sNode);
-        PAGNodeToUnaryOPVFGNodeMap[edge->getDstNode()] = sNode;
+        setDef(edge->getBranchInst(),sNode);
+        PAGNodeToBranchVFGNodeMap[edge->getBranchInst()] = sNode;
     }
 };
 

package/SVF-linux/include/Graphs/VFGNode.h

@@ -51,7 +51,7 @@ public:
     /// Gep represents offset edge for field sensitivity
     enum VFGNodeK
     {
-        Addr, Copy, Gep, Store, Load, Cmp, BinaryOp, UnaryOp, TPhi, TIntraPhi, TInterPhi,
+        Addr, Copy, Gep, Store, Load, Cmp, BinaryOp, UnaryOp, Branch, TPhi, TIntraPhi, TInterPhi,
         MPhi, MIntraPhi, MInterPhi, FRet, ARet, AParm, FParm,
         FunRet, APIN, APOUT, FPIN, FPOUT, NPtr, DummyVProp
     };
@@ -473,10 +473,7 @@ public:
     /// Constructor
 	UnaryOPVFGNode(NodeID id, const PAGNode *r) : VFGNode(id, UnaryOp), res(r) {
 		const Value *val = r->getValue();
-		bool unop = (SVFUtil::isa<UnaryOperator>(val)
-				|| SVFUtil::isa<BranchInst>(val)
-				|| SVFUtil::isa<SwitchInst>(val));
-		assert(unop && "not a unary operator or a BranchInst or a SwitchInst?");
+		assert(SVFUtil::isa<UnaryOperator>(val) && "not a unary instruction ?");
 	}
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -509,6 +506,11 @@ public:
     {
         return res;
     }
+    inline const PAGNode* getOpVar() const
+    {
+        assert(getOpVerNum()==1 && "UnaryNode can only have one operand!");
+        return getOpVer(0);
+    }
     inline u32_t getOpVerNum() const
     {
         return opVers.size();
@@ -526,6 +528,57 @@ public:
     virtual const std::string toString() const;
 };
 
+/*
+* Branch VFGNode including if/else and switch statements
+*/
+class BranchVFGNode: public VFGNode
+{
+private:
+    BranchVFGNode();                      ///< place holder
+    BranchVFGNode(const BranchVFGNode &);  ///< place holder
+    void operator=(const BranchVFGNode &); ///< place holder
+    const BranchStmt* brstmt;
+public:
+    /// Constructor
+	BranchVFGNode(NodeID id, const BranchStmt* r) : VFGNode(id, Branch), brstmt(r) {
+		const Value *val = r->getValue();
+		assert((SVFUtil::isa<BranchInst>(val) || SVFUtil::isa<SwitchInst>(val)) && "not a BranchInst or a SwitchInst?");
+	}
+    /// Methods for support type inquiry through isa, cast, and dyn_cast:
+    //@{
+    static inline bool classof(const BranchVFGNode *)
+    {
+        return true;
+    }
+    static inline bool classof(const VFGNode *node)
+    {
+        return node->getNodeKind() == Branch;
+    }
+    static inline bool classof(const GenericVFGNodeTy *node)
+    {
+        return node->getNodeKind() == Branch;
+    }
+    //@}
+
+    /// Return the branch statement 
+    const BranchStmt* getBranchStmt() const{
+        return brstmt;
+    }
+    /// Successors of this branch statement
+    ///@{
+    u32_t getNumSuccessors() const{
+        return brstmt->getNumSuccessors();
+    }
+    const std::vector<const ICFGNode*>& getSuccessors() const{
+        return brstmt->getSuccessors();
+    }
+    const ICFGNode* getSuccessor (u32_t i) const{
+        return brstmt->getSuccessor(i);
+    }
+    ///@}
+    virtual const std::string toString() const override;
+};
+
 /*!
  * VFGNode for Gep
  */

package/SVF-linux/include/MemoryModel/SVFIR.h

@@ -197,19 +197,11 @@ public:
             inst2PTAPAGEdgesMap[inst].push_back(edge);
     }
     /// Get global PAGEdges (not in a procedure)
-    inline void addGlobalPAGEdge(const SVFStmt* edge)
-    {
-        globPAGEdgesSet.insert(edge);
-    }
-    /// Get global PAGEdges (not in a procedure)
     inline PAGEdgeSet& getGlobalPAGEdgeSet()
     {
         return globPAGEdgesSet;
     }
-    inline void addCallSite(const CallBlockNode* call)
-    {
-        callSiteSet.insert(call);
-    }
+    /// Get all callsites
     inline const CallSiteSet& getCallSiteSet() const
     {
         return callSiteSet;
@@ -220,54 +212,6 @@ public:
         return phiNodeMap.find(node) != phiNodeMap.end();
     }
 
-private:
-    /// Map a SVFStatement type to a set of corresponding SVF statements
-    inline void addToStmt2TypeMap(SVFStmt* edge) {
-        bool added = PAGEdgeKindToSetMap[edge->getEdgeKind()].insert(edge).second;
-        assert(added && "duplicated edge, not added!!!");
-        if (edge->isPTAEdge())
-        {
-            totalPTAPAGEdge++;
-            PTAPAGEdgeKindToSetMap[edge->getEdgeKind()].insert(edge);
-        }
-    }
-    /// Get/set method for function/callsite arguments and returns
-    //@{
-    /// Add function arguments
-    inline void addFunArgs(const SVFFunction* fun, const SVFVar* arg)
-    {
-        FunEntryBlockNode* funEntryBlockNode = icfg->getFunEntryBlockNode(fun);
-        funEntryBlockNode->addFormalParms(arg);
-        funArgsListMap[fun].push_back(arg);
-    }
-    /// Add function returns
-    inline void addFunRet(const SVFFunction* fun, const SVFVar* ret)
-    {
-        FunExitBlockNode* funExitBlockNode = icfg->getFunExitBlockNode(fun);
-        funExitBlockNode->addFormalRet(ret);
-        funRetMap[fun] = ret;
-    }
-    /// Add callsite arguments
-    inline void addCallSiteArgs(CallBlockNode* callBlockNode,const SVFVar* arg)
-    {
-        callBlockNode->addActualParms(arg);
-        callSiteArgsListMap[callBlockNode].push_back(arg);
-    }
-    /// Add callsite returns
-    inline void addCallSiteRets(RetBlockNode* retBlockNode,const SVFVar* arg)
-    {
-        retBlockNode->addActualRet(arg);
-        callSiteRetMap[retBlockNode]= arg;
-    }
-    /// Add indirect callsites
-    inline void addIndirectCallsites(const CallBlockNode* cs,NodeID funPtr)
-    {
-        bool added = indCallSiteToFunPtrMap.insert(std::make_pair(cs,funPtr)).second;
-        funPtrToCallSitesMap[funPtr].insert(cs);
-        assert(added && "adding the same indirect callsite twice?");
-    }
-
-public:
     /// Function has arguments list
     inline bool hasFunArgsList(const SVFFunction* func) const
     {
@@ -515,8 +459,72 @@ public:
     NodeBS& getAllFieldsObjNode(NodeID id);
     NodeBS getFieldsAfterCollapse(NodeID id);
     //@}
+    inline NodeID addDummyValNode()
+    {
+        return addDummyValNode(NodeIDAllocator::get()->allocateValueId());
+    }
+    inline NodeID addDummyObjNode(const Type* type = nullptr)
+    {
+        return addDummyObjNode(NodeIDAllocator::get()->allocateObjectId(), type);
+    }
+    /// Whether a node is a valid pointer
+    //@{
+    bool isValidPointer(NodeID nodeId) const;
+
+    bool isValidTopLevelPtr(const SVFVar* node);
+    //@}
+
+    /// Print SVFIR
+    void print();
 
 private:
+
+    /// Map a SVFStatement type to a set of corresponding SVF statements
+    inline void addToStmt2TypeMap(SVFStmt* edge) {
+        bool added = PAGEdgeKindToSetMap[edge->getEdgeKind()].insert(edge).second;
+        assert(added && "duplicated edge, not added!!!");
+        if (edge->isPTAEdge())
+        {
+            totalPTAPAGEdge++;
+            PTAPAGEdgeKindToSetMap[edge->getEdgeKind()].insert(edge);
+        }
+    }
+    /// Get/set method for function/callsite arguments and returns
+    //@{
+    /// Add function arguments
+    inline void addFunArgs(const SVFFunction* fun, const SVFVar* arg)
+    {
+        FunEntryBlockNode* funEntryBlockNode = icfg->getFunEntryBlockNode(fun);
+        funEntryBlockNode->addFormalParms(arg);
+        funArgsListMap[fun].push_back(arg);
+    }
+    /// Add function returns
+    inline void addFunRet(const SVFFunction* fun, const SVFVar* ret)
+    {
+        FunExitBlockNode* funExitBlockNode = icfg->getFunExitBlockNode(fun);
+        funExitBlockNode->addFormalRet(ret);
+        funRetMap[fun] = ret;
+    }
+    /// Add callsite arguments
+    inline void addCallSiteArgs(CallBlockNode* callBlockNode,const SVFVar* arg)
+    {
+        callBlockNode->addActualParms(arg);
+        callSiteArgsListMap[callBlockNode].push_back(arg);
+    }
+    /// Add callsite returns
+    inline void addCallSiteRets(RetBlockNode* retBlockNode,const SVFVar* arg)
+    {
+        retBlockNode->addActualRet(arg);
+        callSiteRetMap[retBlockNode]= arg;
+    }
+    /// Add indirect callsites
+    inline void addIndirectCallsites(const CallBlockNode* cs,NodeID funPtr)
+    {
+        bool added = indCallSiteToFunPtrMap.insert(std::make_pair(cs,funPtr)).second;
+        funPtrToCallSitesMap[funPtr].insert(cs);
+        assert(added && "adding the same indirect callsite twice?");
+    }
+
     /// add node into SVFIR
     //@{
     /// Add a value (pointer) node
@@ -605,6 +613,16 @@ private:
         return addNode(node,i);
     }
 
+    /// Add global PAGEdges (not in a procedure)
+    inline void addGlobalPAGEdge(const SVFStmt* edge)
+    {
+        globPAGEdgesSet.insert(edge);
+    }
+    /// Add callsites
+    inline void addCallSite(const CallBlockNode* call)
+    {
+        callSiteSet.insert(call);
+    }
     /// Add an edge into SVFIR
     //@{
     /// Add Address edge
@@ -614,11 +632,13 @@ private:
     /// Add phi node information
     PhiPE*  addPhiNode(NodeID res, NodeID opnd);
     /// Add Copy edge
-    CmpPE* addCmpPE(NodeID op1, NodeID op2, NodeID dst);
+    CmpPE* addCmpPE(NodeID op1, NodeID op2, NodeID dst, u32_t opcode);
     /// Add Copy edge
-    BinaryOPPE* addBinaryOPPE(NodeID op1, NodeID op2, NodeID dst);
+    BinaryOPPE* addBinaryOPPE(NodeID op1, NodeID op2, NodeID dst, u32_t opcode);
     /// Add Unary edge
-    UnaryOPPE* addUnaryOPPE(NodeID src, NodeID dst);
+    UnaryOPPE* addUnaryOPPE(NodeID src, NodeID dst, u32_t opcode);
+    /// Add BranchStmt
+    BranchStmt* addBranchStmt(NodeID br, NodeID cond, std::vector<const ICFGNode*> succs);
     /// Add Load edge
     LoadPE* addLoadPE(NodeID src, NodeID dst);
     /// Add Store edge
@@ -641,25 +661,6 @@ private:
 
     /// Set a pointer points-to black hole (e.g. int2ptr)
     SVFStmt* addBlackHoleAddrPE(NodeID node);
-
-public:
-    inline NodeID addDummyValNode()
-    {
-        return addDummyValNode(NodeIDAllocator::get()->allocateValueId());
-    }
-    inline NodeID addDummyObjNode(const Type* type = nullptr)
-    {
-        return addDummyObjNode(NodeIDAllocator::get()->allocateObjectId(), type);
-    }
-    /// Whether a node is a valid pointer
-    //@{
-    bool isValidPointer(NodeID nodeId) const;
-
-    bool isValidTopLevelPtr(const SVFVar* node);
-    //@}
-
-    /// Print SVFIR
-    void print();
 };
 
 typedef SVFIR PAG;

package/SVF-linux/include/MemoryModel/SVFStatements.h

@@ -53,7 +53,7 @@ public:
     /// ThreadFork/ThreadJoin is to model parameter passings between thread spawners and spawnees.
     enum PEDGEK
     {
-        Addr, Copy, Store, Load, Call, Ret, NormalGep, VariantGep, Phi, Cmp, BinaryOp, UnaryOp, ThreadFork, ThreadJoin
+        Addr, Copy, Store, Load, Call, Ret, NormalGep, VariantGep, Phi, Cmp, BinaryOp, UnaryOp, Branch, ThreadFork, ThreadJoin
     };
 
 private:
@@ -381,6 +381,8 @@ private:
     SVFVar* getDstNode();    ///< place holder, use getRes() instead
     SVFVar* getSrcID();  ///< place holder, use getOpVarID(pos) instead
     SVFVar* getDstID();    ///< place holder, use getResID() instead
+
+    u32_t opcode;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -403,9 +405,15 @@ public:
     //@}
 
     /// constructor
-    CmpPE(SVFVar* s, const OPVars& opnds) : MultiOpndStmt(s,opnds,SVFStmt::Cmp)
+    CmpPE(SVFVar* s, const OPVars& opnds, u32_t oc) : MultiOpndStmt(s,opnds,SVFStmt::Cmp), opcode(oc)
+    {
+    }
+
+    u32_t getOpcode() const
     {
+        return opcode;
     }
+    
     virtual const std::string toString() const override;
 };
 
@@ -424,6 +432,8 @@ private:
     SVFVar* getSrcID();  ///< place holder, use getOpVarID(pos) instead
     SVFVar* getDstID();    ///< place holder, use getResID() instead
 
+    u32_t opcode;
+
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -446,9 +456,15 @@ public:
     //@}
 
     /// constructor
-    BinaryOPPE(SVFVar* s, const OPVars& opnds) : MultiOpndStmt(s,opnds,SVFStmt::BinaryOp)
+    BinaryOPPE(SVFVar* s, const OPVars& opnds, u32_t oc) : MultiOpndStmt(s,opnds,SVFStmt::BinaryOp), opcode(oc)
     {
     }
+
+    u32_t getOpcode() const
+    {
+        return opcode;
+    }
+
     virtual const std::string toString() const override;
 };
 
@@ -461,6 +477,12 @@ private:
     UnaryOPPE();                      ///< place holder
     UnaryOPPE(const UnaryOPPE &);  ///< place holder
     void operator=(const UnaryOPPE &); ///< place holder
+    SVFVar* getSrcNode();  ///< place holder, use getOpVar() instead
+    SVFVar* getDstNode();    ///< place holder, use getRes() instead
+    SVFVar* getSrcID();  ///< place holder, use getOpVarID() instead
+    SVFVar* getDstID();    ///< place holder, use getResID() instead
+
+    u32_t opcode;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -479,14 +501,90 @@ public:
     //@}
 
     /// constructor
-    UnaryOPPE(SVFVar* s, SVFVar* d) : SVFStmt(s,d,SVFStmt::UnaryOp)
+    UnaryOPPE(SVFVar* s, SVFVar* d, u32_t oc) : SVFStmt(s,d,SVFStmt::UnaryOp), opcode(oc)
     {
     }
 
+    u32_t getOpcode() const
+    {
+        return opcode;
+    }
+    inline const SVFVar* getOpVar() const{
+        return SVFStmt::getSrcNode();
+    }
+    inline const SVFVar* getRes() const{
+        return SVFStmt::getDstNode();
+    }
+    NodeID getOpVarID() const;
+    NodeID getResID() const;
+
     virtual const std::string toString() const override;
 };
 
 
+/*!
+ * Branch statements including if/else and switch 
+ */
+class BranchStmt: public SVFStmt
+{
+private:
+    BranchStmt();                      ///< place holder
+    BranchStmt(const BranchStmt &);  ///< place holder
+    void operator=(const BranchStmt &); ///< place holder
+    SVFVar* getSrcNode();  ///< place holder, not allowed 
+    SVFVar* getDstNode();    ///< place holder, not allowed 
+    SVFVar* getSrcID();  ///< place holder, not allowed 
+    SVFVar* getDstID();    ///< place holder, not allowed 
+
+    std::vector<const ICFGNode*> successors;
+    const SVFVar* cond;
+    const SVFVar* brInst;
+public:
+    /// Methods for support type inquiry through isa, cast, and dyn_cast:
+    //@{
+    static inline bool classof(const BranchStmt *)
+    {
+        return true;
+    }
+    static inline bool classof(const SVFStmt *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Branch;
+    }
+    static inline bool classof(const GenericPAGEdgeTy *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Branch;
+    }
+    //@}
+
+    /// constructor
+    BranchStmt(SVFVar* inst, SVFVar* c, const std::vector<const ICFGNode*>& succs) : SVFStmt(c,inst,SVFStmt::Branch), successors(succs), cond(c), brInst(inst)
+    {
+    }
+
+    /// The branch is unconditional if cond is a null value
+    bool isUnconditional() const;
+    /// The branch is conditional if cond is not a null value
+    bool isConditional() const;
+    /// Return the condition 
+    const SVFVar* getCondition() const;
+    const SVFVar* getBranchInst() const{
+        return brInst;
+    }
+    /// Successors of this branch statement
+    ///@{
+    u32_t getNumSuccessors() const{
+        return successors.size();
+    }
+    const std::vector<const ICFGNode*>& getSuccessors() const{
+        return successors;
+    }
+    const ICFGNode* getSuccessor (u32_t i) const{
+        return successors.at(i);
+    }
+    ///@}
+    virtual const std::string toString() const override;
+};
+
 /*!
  * Store edge
  */

package/SVF-linux/include/SVF-FE/CHGBuilder.h

@@ -0,0 +1,69 @@
+//===----- CHGBuiler.h -- Class hierarchy graph builder ---------------------------//
+//
+//                     SVF: Static Value-Flow Analysis
+//
+// Copyright (C) <2013->  <Yulei Sui>
+//
+
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+
+// You should have received a copy of the GNU General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+//
+//===----------------------------------------------------------------------===//
+
+/*
+ * CHGBuiler.h
+ *
+ *  Created on: Jun 4, 2021
+ *      Author: Yulei Sui
+ */
+
+#include "Graphs/CHG.h"
+
+namespace SVF{
+
+class CHGBuilder{
+
+private:
+    CHGraph* chg;
+
+public:
+    typedef CHGraph::CHNodeSetTy CHNodeSetTy;
+    typedef CHGraph::WorkList WorkList;
+
+    CHGBuilder(CHGraph* c): chg(c)
+    {
+
+    }
+    void buildCHG();
+    void buildCHGNodes(const GlobalValue *V);
+    void buildCHGNodes(const SVFFunction* F);
+    void buildCHGEdges(const SVFFunction* F);
+    void buildInternalMaps();
+    void readInheritanceMetadataFromModule(const Module &M);
+
+    CHNode *createNode(const std::string name);
+
+    void connectInheritEdgeViaCall(const SVFFunction* caller, CallSite cs);
+    void connectInheritEdgeViaStore(const SVFFunction* caller, const StoreInst* store);
+
+    void buildClassNameToAncestorsDescendantsMap();
+    const CHGraph::CHNodeSetTy& getInstancesAndDescendants(const std::string className);
+
+    void analyzeVTables(const Module &M);
+    void buildVirtualFunctionToIDMap();
+    void buildCSToCHAVtblsAndVfnsMap();
+    const CHNodeSetTy& getCSClasses(CallSite cs);
+    void addFuncToFuncVector(CHNode::FuncVector &v, const SVFFunction *f);
+};
+
+}

package/SVF-linux/include/SVF-FE/DCHG.h

@@ -15,7 +15,7 @@
 #define DCHG_H_
 
 #include "Graphs/GenericGraph.h"
-#include "SVF-FE/CommonCHG.h"
+#include "Graphs/CHG.h"
 #include "SVF-FE/CPPUtil.h"
 #include "Util/SVFModule.h"
 #include "Util/SVFUtil.h"

package/SVF-linux/include/SVF-FE/SVFIRBuilder.h

@@ -267,6 +267,8 @@ public:
         return nullPtr;
     }
 
+public:
+
     NodeID getGepValNode(const Value* val, const LocationSet& ls, const Type *baseType, u32_t fieldidx);
 
     void setCurrentBBAndValueForPAGEdge(PAGEdge* edge);
@@ -295,29 +297,34 @@ public:
     /// Add Copy edge
     inline PhiPE* addPhiNode(NodeID res, NodeID opnd)
     {
-        const CopyPE* copy = addCopyEdge(opnd, res);
         PhiPE *edge = pag->addPhiNode(res,opnd);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
     /// Add Copy edge
-    inline CmpPE* addCmpEdge(NodeID op1, NodeID op2, NodeID dst)
+    inline CmpPE* addCmpEdge(NodeID op1, NodeID op2, NodeID dst, u32_t opcode)
     {
-        CmpPE *edge = pag->addCmpPE(op1, op2, dst);
+        CmpPE *edge = pag->addCmpPE(op1, op2, dst, opcode);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
     /// Add Copy edge
-    inline BinaryOPPE* addBinaryOPEdge(NodeID op1, NodeID op2, NodeID dst)
+    inline BinaryOPPE* addBinaryOPEdge(NodeID op1, NodeID op2, NodeID dst, u32_t opcode)
     {
-        BinaryOPPE *edge = pag->addBinaryOPPE(op1, op2, dst);
+        BinaryOPPE *edge = pag->addBinaryOPPE(op1, op2, dst, opcode);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
     /// Add Unary edge
-    inline UnaryOPPE* addUnaryOPEdge(NodeID src, NodeID dst)
+    inline UnaryOPPE* addUnaryOPEdge(NodeID src, NodeID dst, u32_t opcode)
     {
-        UnaryOPPE *edge = pag->addUnaryOPPE(src, dst);
+        UnaryOPPE *edge = pag->addUnaryOPPE(src, dst, opcode);
+        setCurrentBBAndValueForPAGEdge(edge);
+        return edge;
+    }
+    /// Add Branch statement 
+    inline BranchStmt* addBranchStmt(NodeID br, NodeID cond, const std::vector<const ICFGNode*> succs){
+        BranchStmt *edge = pag->addBranchStmt(br, cond, succs);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-lib",
-  "version": "1.0.736",
+  "version": "1.0.737",
   "description": "SVF's npm support",
   "main": "index.js",
   "scripts": {