svf-tools 1.0.1255 → 1.0.1257

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.1255",
+  "version": "1.0.1257",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/AE/Svfexe/AbstractInterpretation.h

@@ -172,8 +172,11 @@ public:
     IntervalValue getGepByteOffset(const GepStmt* gep);
     AddressValue getGepObjAddrs(const ValVar* pointer, IntervalValue offset);
 
-    AbstractValue loadValue(const ValVar* pointer, const ICFGNode* node);
-    void storeValue(const ValVar* pointer, const AbstractValue& val, const ICFGNode* node);
+    /// Virtual so full-sparse can layer the GepObj overlay on top.
+    virtual AbstractValue loadValue(const ValVar* pointer,
+                                    const ICFGNode* node);
+    virtual void storeValue(const ValVar* pointer, const AbstractValue& val,
+                            const ICFGNode* node);
 
     const SVFType* getPointeeElement(const ObjVar* var, const ICFGNode* node);
     u32_t getAllocaInstByteSize(const AddrStmt* addr);
@@ -214,17 +217,38 @@ protected:
     virtual bool narrowCycleState(const AbstractState& prev, const AbstractState& cur,
                                   const ICFGCycleWTO* cycle);
 
-private:
-    /// Initialize abstract state for the global ICFG node and process global statements
-    virtual void handleGlobalNode();
-
+protected:
     /// Pull-based state merge: read abstractTrace[pred] for each predecessor,
     /// apply branch refinement for conditional IntraCFGEdges, and join into
     /// abstractTrace[node]. Returns true if at least one predecessor had state.
-    bool mergeStatesFromPredecessors(const ICFGNode* node);
+    /// Virtual so full-sparse can layer per-MRSVFGNode obj pulls on top of the
+    /// base ICFG-edge merge.
+    virtual bool mergeStatesFromPredecessors(const ICFGNode* node);
+
+    /// Returns true if the branch edge is reachable under the current state.
+    /// Pure query: does not update `as` or branch refinement traces.
+    bool isBranchEdgeFeasible(const IntraCFGEdge* edge, AbstractState& as);
+
+    /// Collect branch-induced interval refinement after a feasible edge has
+    /// been selected for normal CFG-state merging.
+    void collectBranchRefinement(const IntraCFGEdge* edge, AbstractState& as);
+
+    /// Hook called by collectBranchRefinement for each obj that the
+    /// branch narrows.  Default (dense/semi): MEET `narrowed` onto
+    /// obj's value (read at `loadIcfg` where sparse keeps it) and
+    /// write the result into the local `as` (per-edge predState copy)
+    /// so joinStates carries it to `succ`.  FullSparse overrides to
+    /// capture into refinementTrace[succ] instead.
+    virtual void recordBranchRefinement(NodeID objId,
+                                        const IntervalValue& narrowed,
+                                        AbstractState& as,
+                                        const ICFGNode* loadIcfg,
+                                        const ICFGNode* succ);
 
-    /// Returns true if the branch is reachable; narrows as in-place.
-    bool isBranchFeasible(const IntraCFGEdge* edge, AbstractState& as);
+private:
+    /// Initialize abstract state for the global ICFG node and process global
+    /// statements
+    virtual void handleGlobalNode();
 
     /// Handle a call site node: dispatch to ext-call, direct-call, or indirect-call handling
     virtual void handleCallSite(const ICFGNode* node);
@@ -241,11 +265,12 @@ private:
     /// Dispatch an SVF statement (Addr/Binary/Cmp/Load/Store/Copy/Gep/Select/Phi/Call/Ret) to its handler
     virtual void handleSVFStatement(const SVFStmt* stmt);
 
-    /// Returns true if the cmp-conditional branch is feasible; narrows as in-place.
-    bool isCmpBranchFeasible(const IntraCFGEdge* edge, AbstractState& as);
+    /// Returns true if the cmp-conditional branch is feasible.
+    bool isCmpBranchEdgeFeasible(const IntraCFGEdge* edge, AbstractState& as);
 
-    /// Returns true if the switch branch is feasible; narrows as in-place.
-    bool isSwitchBranchFeasible(const IntraCFGEdge* edge, AbstractState& as);
+    /// Returns true if the switch branch is feasible.
+    bool isSwitchBranchEdgeFeasible(const IntraCFGEdge* edge,
+                                    AbstractState& as);
 
     void updateStateOnAddr(const AddrStmt *addr);
 
@@ -309,4 +334,4 @@ protected:
 
     bool shouldApplyNarrowing(const FunObjVar* fun);
 };
-}
+} // namespace SVF

package/svf/include/AE/Svfexe/SparseAbstractInterpretation.h

@@ -24,11 +24,15 @@
 #define INCLUDE_AE_SVFEXE_SPARSEABSTRACTINTERPRETATION_H_
 
 #include "AE/Svfexe/AbstractInterpretation.h"
+#include <memory>
 
 namespace SVF
 {
 
 class SVFG;
+class SVFGBuilder;
+class IndirectSVFGEdge;
+class VFGNode;
 
 /// Abstract Interpretation for `Options::AESparsity::SemiSparse`.
 ///
@@ -76,10 +80,8 @@ protected:
 ///
 /// In full-sparse mode both ValVars and ObjVars live at their SVFG
 /// def-sites; reads query the SVFG for the reaching-def site, writes
-/// happen at def-sites.  ValVar reads currently assert(false) until the
-/// SVFG-backed resolution lands (see `doc/plan-full-sparse.md`); cycle
-/// helpers are inherited from the semi-sparse parent and will also need
-/// extension for ObjVars.
+/// happen at def-sites.  See `doc/plan-full-sparse.md` for the
+/// phase plan; Phase 1 routes ValVar and ObjVar reads through the SVFG.
 class FullSparseAbstractInterpretation : public SemiSparseAbstractInterpretation
 {
 public:
@@ -89,28 +91,83 @@ public:
     }
     ~FullSparseAbstractInterpretation() override;
 
-    // Full-sparse ValVar resolution will route through the SVFG once
-    // implemented; fail loudly until then rather than silently inherit
-    // semi-sparse semantics.
-    const AbstractValue& getAbsValue(const ValVar* var, const ICFGNode* node) override;
-    using SemiSparseAbstractInterpretation::getAbsValue;
-
-    bool hasAbsValue(const ValVar* var, const ICFGNode* node) const override;
-    using SemiSparseAbstractInterpretation::hasAbsValue;
+protected:
+    /// Full-sparse does not merge normal value-flow state along ICFG
+    /// edges.  The ICFG join carries only side-channel state that is not
+    /// represented as MemorySSA def-use flow: GepObjVar field snapshots
+    /// and `_freedAddrs`.  Base/Dummy ObjVars are populated later by
+    /// pullObjValueFlows from SVFG indirect in-edges; ValVars stay at their
+    /// def-sites.
+    void joinStates(AbstractState& dst, const AbstractState& src) override;
 
-    const Set<const ICFGNode*> getUseSitesOfValVar(const ValVar* var) const;
-    const ICFGNode* getDefSiteOfValVar(const ValVar* var) const;
-    /// Given an ObjVar and its def-site ICFGNode, find all use-site ICFGNodes
-    /// by following outgoing IndirectSVFGEdges whose pts contains the ObjVar
-    const Set<const ICFGNode*> getDefSiteOfObjVar(const ObjVar* obj, const ICFGNode* node) const;
-    /// Given an ObjVar and its def-site ICFGNode, find all use-site ICFGNodes
-    /// by following outgoing IndirectSVFGEdges whose pts contains the ObjVar
-    const Set<const ICFGNode*> getUseSitesOfObjVar(const ObjVar* obj, const ICFGNode* node) const;
+    /// After a store overwrites an ObjVar, clear any branch refinement
+    /// for that ObjVar at the store's node so stale branch constraints
+    /// don't propagate past the redefinition.
+    void storeValue(const ValVar* pointer, const AbstractValue& val,
+                    const ICFGNode* node) override;
+
+    /// Thin wrapper: defer to base for ICFG-edge bookkeeping
+    /// (predecessor iteration, branch feasibility, joinStates,
+    /// updateAbsState, reachability return).  For reachable nodes,
+    /// additionally run pullObjValueFlows to populate trace[node] with obj
+    /// values from SVFG def-sites.
+    bool mergeStatesFromPredecessors(const ICFGNode* node) override;
+
+    /// Capture branch narrowings into refinementTrace[succ] instead of
+    /// writing them into the local `as`: in FullSparse `as` would be
+    /// discarded by joinStates (no-op for ObjVar), so we route the
+    /// narrowing to refinementTrace and let propagateAndApplyRefinement
+    /// bake it into trace at the end of mergeStatesFromPredecessors.
+    void recordBranchRefinement(NodeID objId, const IntervalValue& narrowed,
+                                AbstractState& as, const ICFGNode* loadIcfg,
+                                const ICFGNode* succ) override;
+
+private:
+    /// SVFG-pull helper: walk each VFG node's indirect SVFG in-edges
+    /// and pull obj values from upstream def-site traces into
+    /// trace[node].  Multiple sources (e.g. mphi operands) JOIN.
+    void pullObjValueFlows(const ICFGNode* node);
+
+    /// Return whether an indirect SVFG edge should be pulled into dst.
+    /// Besides branch-feasible ICFG reachability, this rejects paths where
+    /// another store to the same points-to object kills the edge's value.
+    bool isIndirectSVFGEdgeFeasible(const IndirectSVFGEdge* edge,
+                                    const VFGNode* dst);
+
+    /// Return whether a branch-feasible ICFG path exists from src to dst.
+    /// Conditional edges are checked with a pure branch-feasibility query,
+    /// so path probing does not create branch-refinement side effects.
+    bool isICFGPathFeasible(const ICFGNode* src, const ICFGNode* dst);
+
+    /// Return whether this intra edge is allowed by the current branch state.
+    bool isIntraEdgeBranchFeasible(const IntraCFGEdge* edge,
+                                   const ICFGNode* src);
+
+    /// Compose pred-inherited refinement into refinementTrace[node]
+    /// (single-pred linear copy / multi-pred intersect-JOIN; any pred
+    /// without refinement drops the inheritance), then MEET the final
+    /// refinementTrace[node] into trace[node]._addrToAbsVal so the
+    /// inherited base getAbsValue(ObjVar*, node) returns the narrowed
+    /// value directly — no read-time override or cache.  Called once
+    /// per merge as the last step.
+    void propagateAndApplyRefinement(const ICFGNode* node);
+
+    /// Path-refined obj values produced by branch narrowing.  Each
+    /// entry is the *interval constraint* (not effective value) so
+    /// base trace can widen/narrow independently.  Cached at branch
+    /// successors by recordBranchRefinement; propagated and applied by
+    /// propagateAndApplyRefinement at the end of
+    /// mergeStatesFromPredecessors.
+    Map<const ICFGNode*, Map<NodeID, IntervalValue>> refinementTrace;
 
-protected:
     /// Build the SVFG on top of the semi-sparse precompute.
     void buildSVFG();
 
+    /// Owns the SVFG (via SVFGBuilder's internal unique_ptr).  Without
+    /// this, SVFGBuilder would be a local in buildSVFG() and free the
+    /// graph at scope exit, leaving `svfg` dangling.
+    std::unique_ptr<SVFGBuilder> svfgBuilder;
+    /// View pointer into svfgBuilder's graph; non-null after buildSVFG().
     SVFG* svfg{nullptr};
 };
 

package/svf/lib/AE/Svfexe/AEDetector.cpp

@@ -568,6 +568,9 @@ void NullptrDerefDetector::handleStubFunctions(const CallICFGNode* callNode)
         const ValVar* arg0Val = callNode->getArgument(0);
         // opt may directly dereference a null pointer and call UNSAFE_LOAD(null)
         bool isSafe = canSafelyDerefPtr(arg0Val, callNode) && arg0Val->getId() != 0;
+        SVFUtil::outs() << "[UNSAFE_LOAD] node=" << callNode->getId()
+                        << " arg0=" << arg0Val->getId() << " isSafe=" << isSafe
+                        << "\n";
         if (!isSafe)
         {
             SVFUtil::outs() << SVFUtil::sucMsg("success: expected null dereference at UNSAFE_LOAD")
@@ -667,9 +670,7 @@ bool NullptrDerefDetector::canSafelyDerefPtr(const ValVar* value, const ICFGNode
 {
     auto& ae = AbstractInterpretation::getAEInstance();
     const AbstractValue& AbsVal = ae.getAbsValue(value, node);
-    // uninit value cannot be dereferenced, return unsafe
     if (isUninit(AbsVal)) return false;
-    // Interval Value (non-addr) is not the checkpoint of nullptr dereference, return safe
     if (!AbsVal.isAddr()) return true;
     for (const auto &addr: AbsVal.getAddrs())
     {
@@ -684,4 +685,4 @@ bool NullptrDerefDetector::canSafelyDerefPtr(const ValVar* value, const ICFGNode
             return false;
     }
     return true;
-}
+}

package/svf/lib/AE/Svfexe/AEStat.cpp

@@ -115,7 +115,6 @@ void AEStat::finializeStat()
     generalNumMap["EXT_CallSite_Num"] = extCallSiteNum;
     generalNumMap["NonEXT_CallSite_Num"] = callSiteNum;
     timeStatMap["Total_Time(sec)"] = (double)(endTime - startTime) / TIMEINTERVAL;
-
 }
 
 void AEStat::performStat()

package/svf/lib/AE/Svfexe/AbsExtAPI.cpp

@@ -145,44 +145,6 @@ void AbsExtAPI::initExtFunMap()
     };
     func_map["set_value"] = svf_set_value;
 
-    auto sse_scanf = [&](const CallICFGNode* callNode)
-    {
-        //scanf("%d", &data);
-        if (callNode->arg_size() < 2) return;
-        AbstractState& as = getAbsState(callNode);
-        const AbstractValue& dstVal = ae->getAbsValue(callNode->getArgument(1), callNode);
-        if (!dstVal.isAddr()) return;
-        for (auto vaddr: dstVal.getAddrs())
-        {
-            u32_t objId = as.getIDFromAddr(vaddr);
-            AbstractValue range = getRangeLimitFromType(svfir->getSVFVar(objId)->getType());
-            as.store(vaddr, range);
-        }
-    };
-    auto sse_fscanf = [&](const CallICFGNode* callNode)
-    {
-        //fscanf(stdin, "%d", &data);
-        if (callNode->arg_size() < 3) return;
-        AbstractState& as = getAbsState(callNode);
-        const AbstractValue& dstVal = ae->getAbsValue(callNode->getArgument(2), callNode);
-        if (!dstVal.isAddr()) return;
-        for (auto vaddr: dstVal.getAddrs())
-        {
-            u32_t objId = as.getIDFromAddr(vaddr);
-            AbstractValue range = getRangeLimitFromType(svfir->getSVFVar(objId)->getType());
-            as.store(vaddr, range);
-        }
-    };
-
-    func_map["__isoc99_fscanf"] = sse_fscanf;
-    func_map["__isoc99_scanf"] = sse_scanf;
-    func_map["__isoc99_vscanf"] = sse_scanf;
-    func_map["fscanf"] = sse_fscanf;
-    func_map["scanf"] = sse_scanf;
-    func_map["sscanf"] = sse_scanf;
-    func_map["__isoc99_sscanf"] = sse_scanf;
-    func_map["vscanf"] = sse_scanf;
-
     auto sse_fread = [&](const CallICFGNode *callNode)
     {
         if (callNode->arg_size() < 3) return;
@@ -737,4 +699,4 @@ IntervalValue AbsExtAPI::getRangeLimitFromType(const SVFType* type)
         return IntervalValue::top();
         // other types, return top interval
     }
-}
+}

package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp

@@ -236,8 +236,9 @@ bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode* node)
             if (intraCfgEdge->getCondition())
             {
                 AbstractState predState = getAbsState(pred);
-                if (isBranchFeasible(intraCfgEdge, predState))
+                if (isBranchEdgeFeasible(intraCfgEdge, predState))
                 {
+                    collectBranchRefinement(intraCfgEdge, predState);
                     joinStates(merged, predState);
                     hasFeasiblePred = true;
                 }
@@ -285,7 +286,6 @@ bool AbstractInterpretation::mergeStatesFromPredecessors(const ICFGNode* node)
     return true;
 }
 
-
 /// Given a cmp operand, walk its SSA def edge to find the LoadStmt that
 /// produced it. This lets us trace back to the ObjVar in memory so that
 /// branch narrowing can refine the stored value.
@@ -316,7 +316,7 @@ static const LoadStmt* findBackingLoad(const SVFVar* var)
 /// branch direction (succ), which side it is on, and the other operand's
 /// interval. Returns top if no useful narrowing is possible.
 ///
-/// Called from isCmpBranchFeasible for each non-constant operand that has a
+/// Called from collectBranchRefinement for each non-constant operand that has a
 /// backing load. Given a branch condition like:
 ///
 ///   %cmp = icmp sgt %a, 5       ;  a > 5
@@ -442,14 +442,13 @@ static IntervalValue computeCmpConstraint(s32_t predicate, s64_t succ,
     return result;
 }
 
-bool AbstractInterpretation::isCmpBranchFeasible(const IntraCFGEdge* edge,
-        AbstractState& as)
+bool AbstractInterpretation::isCmpBranchEdgeFeasible(const IntraCFGEdge* edge,
+                                                     AbstractState& as)
 {
     const ICFGNode* pred = edge->getSrcNode();
     s64_t succ = edge->getSuccessorCondValue();
     const CmpStmt* cmpStmt = SVFUtil::cast<CmpStmt>(
                                  *edge->getCondition()->getInEdges().begin());
-    s32_t predicate = cmpStmt->getPredicate();
 
     if (cmpStmt->getOpVarID(0) == IRGraph::NullPtr ||
             cmpStmt->getOpVarID(1) == IRGraph::NullPtr)
@@ -460,7 +459,9 @@ bool AbstractInterpretation::isCmpBranchFeasible(const IntraCFGEdge* edge,
         getAbsValue(cmpStmt->getOpVar(0), pred),
         getAbsValue(cmpStmt->getOpVar(1), pred)
     };
-    if (opVal[0].isAddr() || opVal[1].isAddr())
+
+    const bool hasIntervalCmp = opVal[0].isInterval() && opVal[1].isInterval();
+    if (!hasIntervalCmp && (opVal[0].isAddr() || opVal[1].isAddr()))
         return true;
 
     // Feasibility check: cmp result must be compatible with branch successor
@@ -469,83 +470,201 @@ bool AbstractInterpretation::isCmpBranchFeasible(const IntraCFGEdge* edge,
     if (resVal.isBottom())
         return false;
 
-    // For each operand: if it is the variable side (non-constant), has a
-    // backing load, and the branch imposes a useful constraint, narrow the
-    // ObjVar behind the load.
-    for (int i = 0; i < 2; i++)
-    {
-        if (opVal[i].getInterval().is_numeral() || !opVal[1-i].getInterval().is_numeral())
-            continue; // skip constant operands and var-vs-var
-
-        if (const LoadStmt* load = findBackingLoad(cmpStmt->getOpVar(i)))
-        {
-            IntervalValue narrowed = computeCmpConstraint(
-                                         predicate, succ, i == 0,
-                                         opVal[i].getInterval(), opVal[1-i].getInterval());
-
-            if (!narrowed.isTop())
-            {
-                const AbstractValue& ptrVal = getAbsValue(load->getRHSVar(), pred);
-                if (ptrVal.isAddr())
-                {
-                    for (const auto& addr : ptrVal.getAddrs())
-                    {
-                        NodeID objId = as.getIDFromAddr(addr);
-                        if (as.inAddrToValTable(objId))
-                            as.load(addr).meet_with(narrowed);
-                    }
-                }
-            }
-        }
-    }
     return true;
 }
 
-bool AbstractInterpretation::isSwitchBranchFeasible(const IntraCFGEdge* edge,
-        AbstractState& as)
+bool AbstractInterpretation::isSwitchBranchEdgeFeasible(
+    const IntraCFGEdge* edge, AbstractState& as)
 {
     const ICFGNode* pred = edge->getSrcNode();
     s64_t succ = edge->getSuccessorCondValue();
     const SVFVar* var = edge->getCondition();
 
-    if (!as.inVarToValTable(var->getId()) && !as.inVarToAddrsTable(var->getId()))
-        as[var->getId()] = getAbsValue(var, pred);
-    IntervalValue& switch_cond = as[var->getId()].getInterval();
+    AbstractValue condVal = getAbsValue(var, pred);
+    IntervalValue switch_cond = condVal.getInterval();
     switch_cond.meet_with(IntervalValue(succ, succ));
     if (switch_cond.isBottom())
         return false;
+    return true;
+}
 
-    FIFOWorkList<const SVFStmt*> stmtList;
-    for (SVFStmt* stmt : var->getInEdges())
-        stmtList.push(stmt);
-    while (!stmtList.empty())
+void AbstractInterpretation::collectBranchRefinement(const IntraCFGEdge* edge,
+                                                     AbstractState& as)
+{
+    const SVFVar* cond = edge->getCondition();
+    const ICFGNode* pred = edge->getSrcNode();
+    const ICFGNode* succNode = edge->getDstNode();
+    s64_t succ = edge->getSuccessorCondValue();
+
+    assert(!cond->getInEdges().empty() &&
+           "branch condition has no defining edge?");
+    const SVFStmt* condDef = *cond->getInEdges().begin();
+
+    if (const CmpStmt* cmpStmt = SVFUtil::dyn_cast<CmpStmt>(condDef))
     {
-        const SVFStmt* stmt = stmtList.pop();
-        if (const LoadStmt* load = SVFUtil::dyn_cast<LoadStmt>(stmt))
+        s32_t predicate = cmpStmt->getPredicate();
+
+        if (cmpStmt->getOpVarID(0) == IRGraph::NullPtr ||
+            cmpStmt->getOpVarID(1) == IRGraph::NullPtr)
         {
-            const AbstractValue& ptrVal = getAbsValue(load->getRHSVar(), pred);
-            if (ptrVal.isAddr())
+            // p == NULL / p != NULL: no interval obj to refine.
+        }
+        else
+        {
+            AbstractValue opVal[2] = {getAbsValue(cmpStmt->getOpVar(0), pred),
+                                      getAbsValue(cmpStmt->getOpVar(1), pred)};
+
+            const bool hasIntervalCmp =
+                opVal[0].isInterval() && opVal[1].isInterval();
+            if (!hasIntervalCmp && (opVal[0].isAddr() || opVal[1].isAddr()))
+            {
+                // Pointer-valued cmp: branch feasibility only.
+            }
+            else
             {
-                for (const auto& addr : ptrVal.getAddrs())
+                for (int i = 0; i < 2; i++)
                 {
-                    NodeID objId = as.getIDFromAddr(addr);
-                    if (as.inAddrToValTable(objId))
-                        as.load(addr).meet_with(switch_cond);
+                    const int other = 1 - i;
+                    const LoadStmt* load =
+                        findBackingLoad(cmpStmt->getOpVar(i));
+
+                    if (opVal[i].getInterval().is_numeral())
+                    {
+                        // Example: in x < 5, operand 5 is not refined.
+                    }
+                    else if (!opVal[other].getInterval().is_numeral())
+                    {
+                        // Example: x < y, neither side has a fixed bound.
+                    }
+                    else if (!load)
+                    {
+                        // Example: cmp uses a computed temporary, not load p.
+                    }
+                    else
+                    {
+                        IntervalValue narrowed = computeCmpConstraint(
+                            predicate, succ, i == 0, opVal[i].getInterval(),
+                            opVal[other].getInterval());
+
+                        if (narrowed.isTop())
+                        {
+                            // != and unsupported predicates reach here.
+                        }
+                        else
+                        {
+                            const ICFGNode* loadIcfg = load->getICFGNode();
+                            const AbstractValue& ptrVal =
+                                getAbsValue(load->getRHSVar(), loadIcfg);
+                            if (!ptrVal.isAddr())
+                            {
+                                // Cannot map load p back to concrete ObjVars.
+                            }
+                            else
+                            {
+                                for (const auto& addr : ptrVal.getAddrs())
+                                {
+                                    NodeID objId = as.getIDFromAddr(addr);
+                                    recordBranchRefinement(objId, narrowed, as,
+                                                           loadIcfg, succNode);
+                                }
+                            }
+                        }
+                    }
                 }
             }
         }
     }
-    return true;
+    else
+    {
+        const SVFVar* var = cond;
+
+        AbstractValue condVal = getAbsValue(var, pred);
+        IntervalValue switch_cond = condVal.getInterval();
+        switch_cond.meet_with(IntervalValue(succ, succ));
+        if (switch_cond.isBottom())
+        {
+            // This case label is not reachable from cond's interval.
+        }
+        else
+        {
+            as[var->getId()] = AbstractValue(switch_cond);
+
+            FIFOWorkList<const SVFStmt*> stmtList;
+            for (SVFStmt* stmt : var->getInEdges())
+                stmtList.push(stmt);
+            while (!stmtList.empty())
+            {
+                const SVFStmt* stmt = stmtList.pop();
+                const LoadStmt* load = SVFUtil::dyn_cast<LoadStmt>(stmt);
+                if (!load)
+                {
+                    // Skip non-load definitions of the switch condition.
+                }
+                else
+                {
+                    const ICFGNode* loadIcfg = load->getICFGNode();
+                    const AbstractValue& ptrVal =
+                        getAbsValue(load->getRHSVar(), loadIcfg);
+                    if (!ptrVal.isAddr())
+                    {
+                        // Cannot map load p back to concrete ObjVars.
+                    }
+                    else
+                    {
+                        for (const auto& addr : ptrVal.getAddrs())
+                        {
+                            NodeID objId = as.getIDFromAddr(addr);
+                            recordBranchRefinement(objId, switch_cond, as,
+                                                   loadIcfg, succNode);
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+
+void AbstractInterpretation::recordBranchRefinement(
+    NodeID objId, const IntervalValue& narrowed, AbstractState& as,
+    const ICFGNode* loadIcfg, const ICFGNode* /*succ*/)
+{
+    // Default (dense / semi-sparse): MEET narrowed onto obj's current
+    // value, store back into the local `as`.  Caller's joinStates
+    // propagates `as` into `merged`, then `updateAbsState(succ, merged)`
+    // commits it to trace[succ].
+    //
+    // We can't go through the polymorphic updateAbsValue here: `as` is
+    // a transient per-edge predState copy that lives outside
+    // abstractTrace, so it has no node id.  Writing via `updateAbsValue`
+    // with `succ` as the node would land in trace[succ] but get
+    // clobbered by the subsequent `updateAbsState(succ, merged)`; with
+    // `loadIcfg` it would corrupt the obj's authoritative value at its
+    // load site.  AbstractState::store on the transient `as` is the
+    // only sound primitive — and recordBranchRefinement itself is the
+    // virtual customisation point (FullSparse routes to
+    // refinementTrace instead of touching `as`).
+    const ObjVar* objVar = SVFUtil::dyn_cast<ObjVar>(svfir->getGNode(objId));
+    if (objVar && hasAbsValue(objVar, loadIcfg))
+    {
+        AbstractValue cur = getAbsValue(objVar, loadIcfg);
+        if (cur.isInterval())
+        {
+            IntervalValue itv = cur.getInterval();
+            itv.meet_with(narrowed);
+            u32_t addr = AbstractState::getVirtualMemAddress(objId);
+            as.store(addr, AbstractValue(itv));
+        }
+    }
 }
 
-bool AbstractInterpretation::isBranchFeasible(const IntraCFGEdge* edge,
-        AbstractState& as)
+bool AbstractInterpretation::isBranchEdgeFeasible(const IntraCFGEdge* edge,
+                                                  AbstractState& as)
 {
     const SVFVar* cmpVar = edge->getCondition();
     assert(!cmpVar->getInEdges().empty() && "branch condition has no defining edge?");
     if (SVFUtil::isa<CmpStmt>(*cmpVar->getInEdges().begin()))
-        return isCmpBranchFeasible(edge, as);
-    return isSwitchBranchFeasible(edge, as);
+        return isCmpBranchEdgeFeasible(edge, as);
+    return isSwitchBranchEdgeFeasible(edge, as);
 }
 
 /**
@@ -854,7 +973,7 @@ void AbstractInterpretation::updateStateOnPhi(const PhiStmt *phi)
                 const IntraCFGEdge* intraEdge = SVFUtil::cast<IntraCFGEdge>(edge);
                 if (intraEdge->getCondition())
                 {
-                    if (isBranchFeasible(intraEdge, tmpState))
+                    if (isBranchEdgeFeasible(intraEdge, tmpState))
                         rhs.join_with(opVal);
                 }
                 else
@@ -1200,15 +1319,16 @@ void AbstractInterpretation::updateStateOnCmp(const CmpStmt *cmp)
 void AbstractInterpretation::updateStateOnLoad(const LoadStmt *load)
 {
     const ICFGNode* node = load->getICFGNode();
-    updateAbsValue(load->getLHSVar(),
-                   loadValue(SVFUtil::cast<ValVar>(load->getRHSVar()), node), node);
+    AbstractValue loaded =
+        loadValue(SVFUtil::cast<ValVar>(load->getRHSVar()), node);
+    updateAbsValue(load->getLHSVar(), loaded, node);
 }
 
 void AbstractInterpretation::updateStateOnStore(const StoreStmt *store)
 {
     const ICFGNode* node = store->getICFGNode();
-    storeValue(SVFUtil::cast<ValVar>(store->getLHSVar()),
-               getAbsValue(store->getRHSVar(), node), node);
+    AbstractValue val = getAbsValue(store->getRHSVar(), node);
+    storeValue(SVFUtil::cast<ValVar>(store->getLHSVar()), val, node);
 }
 
 void AbstractInterpretation::updateStateOnCopy(const CopyStmt *copy)
@@ -1352,5 +1472,3 @@ void AbstractInterpretation::updateStateOnCopy(const CopyStmt *copy)
     else
         assert(false && "undefined copy kind");
 }
-
-