svf-tools 1.0.333 → 1.0.337

package/include/MemoryModel/SVFStatements.h

@@ -190,16 +190,89 @@ private:
     static u64_t multiOpndLabelCounter;  ///< MultiOpndStmt counter
 };
 
+/*
+ Parent class of Addr, Copy, Store, Load, Call, Ret, NormalGep, VariantGep, ThreadFork, ThreadJoin
+ connecting RHS expression and LHS expression with an assignment  (e.g., LHSExpr = RHSExpr)
+ Only one operand on the right handside of an assignment
+*/
+class AssignStmt : public SVFStmt{
+
+private:
+    AssignStmt();                      ///< place holder
+    AssignStmt(const AssignStmt &);  ///< place holder
+    void operator=(const AssignStmt &); ///< place holder
+    SVFVar* getSrcNode();  ///< not allowed, use getRHSVar() instead
+    SVFVar* getDstNode();    ///< not allowed, use getLHSVar() instead
+    NodeID getSrcID();  ///< not allowed, use getRHSVarID() instead
+    NodeID getDstID();    ///< not allowed, use getLHSVarID() instead
+
+protected:
+    /// constructor
+    AssignStmt(SVFVar* s, SVFVar* d, GEdgeFlag k) : SVFStmt(s,d,k)
+    {
+    }
+
+public:
+    /// Methods for support type inquiry through isa, cast, and dyn_cast:
+    //@{
+    static inline bool classof(const AssignStmt *)
+    {
+        return true;
+    }
+    static inline bool classof(const SVFStmt *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Addr ||
+               edge->getEdgeKind() == SVFStmt::Copy ||
+               edge->getEdgeKind() == SVFStmt::Store ||
+               edge->getEdgeKind() == SVFStmt::Load ||
+               edge->getEdgeKind() == SVFStmt::Call ||
+               edge->getEdgeKind() == SVFStmt::Ret ||
+               edge->getEdgeKind() == SVFStmt::NormalGep ||
+               edge->getEdgeKind() == SVFStmt::VariantGep ||
+               edge->getEdgeKind() == SVFStmt::ThreadFork ||
+               edge->getEdgeKind() == SVFStmt::ThreadJoin;
+    }
+    static inline bool classof(const GenericPAGEdgeTy *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Addr ||
+               edge->getEdgeKind() == SVFStmt::Copy ||
+               edge->getEdgeKind() == SVFStmt::Store ||
+               edge->getEdgeKind() == SVFStmt::Load ||
+               edge->getEdgeKind() == SVFStmt::Call ||
+               edge->getEdgeKind() == SVFStmt::Ret ||
+               edge->getEdgeKind() == SVFStmt::NormalGep ||
+               edge->getEdgeKind() == SVFStmt::VariantGep ||
+               edge->getEdgeKind() == SVFStmt::ThreadFork ||
+               edge->getEdgeKind() == SVFStmt::ThreadJoin;
+    }
+    //@}
+
+    inline SVFVar* getRHSVar() const {
+        return SVFStmt::getSrcNode();
+    }  
+    inline SVFVar* getLHSVar() const {
+        return SVFStmt::getDstNode();
+    }  
+    inline NodeID getRHSVarID() const {
+        return SVFStmt::getSrcID();
+    }  
+    inline NodeID getLHSVarID() const {
+        return SVFStmt::getDstID();
+    }  
+
+    virtual const std::string toString() const = 0;
+};
 
 /*!
  * Address statement (memory allocations)
  */
-class AddrStmt: public SVFStmt
+class AddrStmt: public AssignStmt
 {
 private:
     AddrStmt();                      ///< place holder
     AddrStmt(const AddrStmt &);  ///< place holder
     void operator=(const AddrStmt &); ///< place holder
+
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -218,7 +291,7 @@ public:
     //@}
 
     /// constructor
-    AddrStmt(SVFVar* s, SVFVar* d) : SVFStmt(s,d,SVFStmt::Addr)
+    AddrStmt(SVFVar* s, SVFVar* d) : AssignStmt(s,d,SVFStmt::Addr)
     {
     }
 
@@ -229,7 +302,7 @@ public:
 /*!
  * Copy statements (simple assignment and casting)
  */
-class CopyStmt: public SVFStmt
+class CopyStmt: public AssignStmt
 {
 private:
     CopyStmt();                      ///< place holder
@@ -253,646 +326,647 @@ public:
     //@}
 
     /// constructor
-    CopyStmt(SVFVar* s, SVFVar* d) : SVFStmt(s,d,SVFStmt::Copy)
+    CopyStmt(SVFVar* s, SVFVar* d) : AssignStmt(s,d,SVFStmt::Copy)
     {
     }
 
     virtual const std::string toString() const override;
 };
 
-/*
-* Program statements with multiple operands including BinaryOPStmt, CmpStmt and PhiStmt
-*/
-class MultiOpndStmt : public SVFStmt{
-public:
-    typedef std::vector<SVFVar*> OPVars;
-protected:
-    OPVars opVars;
+/*!
+ * Store statement
+ */
+class StoreStmt: public AssignStmt
+{
+private:
+    StoreStmt();                      ///< place holder
+    StoreStmt(const StoreStmt &);  ///< place holder
+    void operator=(const StoreStmt &); ///< place holder
+
 public:
-    /// Constructor, only used by subclassess but not external users
-    MultiOpndStmt(SVFVar* r, const OPVars& opnds, GEdgeFlag k): SVFStmt(opnds.at(0), r, k), opVars(opnds)
-    {
-    }
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const MultiOpndStmt *)
+    static inline bool classof(const StoreStmt *)
     {
         return true;
     }
-    static inline bool classof(const SVFStmt *node)
+    static inline bool classof(const SVFStmt *edge)
     {
-        return node->getEdgeKind() == Phi ||
-               node->getEdgeKind() == BinaryOp ||
-               node->getEdgeKind() == Cmp;
+        return edge->getEdgeKind() == SVFStmt::Store;
     }
-    static inline bool classof(const GenericPAGEdgeTy *node)
+    static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return node->getEdgeKind() == Phi ||
-               node->getEdgeKind() == BinaryOp ||
-               node->getEdgeKind() == Cmp;
+        return edge->getEdgeKind() == SVFStmt::Store;
     }
     //@}
-    /// Operands and result at a BinaryNode e.g., p = q + r, `p` is resVar and `r` is OpVar
-    //@{
-    /// Operand SVFVars
-    inline const SVFVar* getOpVar(u32_t pos) const
-    {
-        return opVars.at(pos);
-    }
-    /// Result SVFVar
-    inline const SVFVar* getRes() const
-    {
-        return getDstNode();
-    }
-    
-    NodeID getOpVarID(u32_t pos) const;
-    NodeID getResID() const;
 
-    inline u32_t getOpVarNum() const
-    {
-        return opVars.size();
-    }
-    inline const OPVars& getOpndVars() const{
-        return opVars;
-    }
-    inline OPVars::const_iterator opVarBegin() const
-    {
-        return opVars.begin();
-    }
-    inline OPVars::const_iterator opVerEnd() const
+    /// constructor
+    StoreStmt(SVFVar* s, SVFVar* d, const IntraBlockNode* st) :
+        AssignStmt(s, d, makeEdgeFlagWithStoreInst(SVFStmt::Store, st))
     {
-        return opVars.end();
     }
-    //@}
+
+    virtual const std::string toString() const override;
 };
 
+
 /*!
- * Phi statement (e.g., p = phi(q,r) which receives values from variables q and r from different paths)
- * it is typically at a joint point of the control-flow graph
+ * Load statement
  */
-class PhiStmt: public MultiOpndStmt
+class LoadStmt: public AssignStmt
 {
 private:
-    PhiStmt();                      ///< place holder
-    PhiStmt(const PhiStmt &);  ///< place holder
-    void operator=(const PhiStmt &); ///< place holder
-    SVFVar* getSrcNode();  ///< place holder, not allowed since this SVFStmt has multiple operands but not a single source
-    SVFVar* getDstNode();    ///< place holder, use getRes() instead
-    SVFVar* getSrcID();  ///< place holder, use getOpVarID(pos) instead
-    SVFVar* getDstID();    ///< place holder, use getResID() instead
+    LoadStmt();                      ///< place holder
+    LoadStmt(const LoadStmt &);  ///< place holder
+    void operator=(const LoadStmt &); ///< place holder
 
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const PhiStmt *)
+    static inline bool classof(const LoadStmt *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Phi;
-    }
-    static inline bool classof(const MultiOpndStmt *edge)
-    {
-        return edge->getEdgeKind() == SVFStmt::Phi;
+        return edge->getEdgeKind() == SVFStmt::Load;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Phi;
+        return edge->getEdgeKind() == SVFStmt::Load;
     }
     //@}
 
     /// constructor
-    PhiStmt(SVFVar* s, const OPVars& opnds) : MultiOpndStmt(s,opnds,SVFStmt::Phi)
+    LoadStmt(SVFVar* s, SVFVar* d) : AssignStmt(s,d,SVFStmt::Load)
     {
     }
-    void addOpVar(SVFVar* op){
-        opVars.push_back(op);
-    }
+
     virtual const std::string toString() const override;
 };
 
 
 /*!
- * Comparison statement
+ * Gep statement for struct field access, array access and pointer arithmetic
  */
-class CmpStmt: public MultiOpndStmt
+class GepStmt: public AssignStmt
 {
 private:
-    CmpStmt();                      ///< place holder
-    CmpStmt(const CmpStmt &);  ///< place holder
-    void operator=(const CmpStmt &); ///< place holder
-    SVFVar* getSrcNode();  ///< place holder, not allowed since this SVFStmt has multiple operands but not a single source
-    SVFVar* getDstNode();    ///< place holder, use getRes() instead
-    SVFVar* getSrcID();  ///< place holder, use getOpVarID(pos) instead
-    SVFVar* getDstID();    ///< place holder, use getResID() instead
+    GepStmt();                      ///< place holder
+    GepStmt(const GepStmt &);  ///< place holder
+    void operator=(const GepStmt &); ///< place holder
+
+    LocationSet ls;	///< location set of the gep edge
 
-    u32_t predicate;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const CmpStmt *)
+    static inline bool classof(const GepStmt *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Cmp;
-    }
-    static inline bool classof(const MultiOpndStmt *edge)
-    {
-        return edge->getEdgeKind() == SVFStmt::Cmp;
+        return 	edge->getEdgeKind() == SVFStmt::NormalGep ||
+                edge->getEdgeKind() == SVFStmt::VariantGep;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Cmp;
+        return	edge->getEdgeKind() == SVFStmt::NormalGep ||
+                edge->getEdgeKind() == SVFStmt::VariantGep;
     }
     //@}
 
-    /// constructor
-    CmpStmt(SVFVar* s, const OPVars& opnds, u32_t pre) : MultiOpndStmt(s,opnds,SVFStmt::Cmp), predicate(pre)
+    inline const LocationSet& getLocationSet() const
     {
+        return ls;
     }
 
-    u32_t getPredicate() const
+protected:
+    /// constructor
+    GepStmt(SVFVar* s, SVFVar* d, const LocationSet& l, PEDGEK k) : AssignStmt(s,d,k), ls(l)
     {
-        return predicate;
     }
-    
-    virtual const std::string toString() const override;
+
+    virtual const std::string toString() const;
+
 };
 
 
 /*!
- * Binary statement
+ * Gep statement with a fixed field index for struct field access 
  */
-class BinaryOPStmt: public MultiOpndStmt
+class NormalGepStmt : public GepStmt
 {
 private:
-    BinaryOPStmt();                      ///< place holder
-    BinaryOPStmt(const BinaryOPStmt &);  ///< place holder
-    void operator=(const BinaryOPStmt &); ///< place holder
-    SVFVar* getSrcNode();  ///< place holder, not allowed since this SVFStmt has multiple operands but not a single source
-    SVFVar* getDstNode();    ///< place holder, use getRes() instead
-    SVFVar* getSrcID();  ///< place holder, use getOpVarID(pos) instead
-    SVFVar* getDstID();    ///< place holder, use getResID() instead
-
-    u32_t opcode;
+    NormalGepStmt(); ///< place holder
+    NormalGepStmt(const NormalGepStmt&); ///< place holder
+    void operator=(const NormalGepStmt&); ///< place holder
 
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const BinaryOPStmt *)
+    static inline bool classof(const NormalGepStmt *)
     {
         return true;
     }
-    static inline bool classof(const SVFStmt *edge)
+    static inline bool classof(const GepStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::BinaryOp;
+        return edge->getEdgeKind() == SVFStmt::NormalGep;
     }
-    static inline bool classof(const MultiOpndStmt *edge)
+    static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::BinaryOp;
+        return edge->getEdgeKind() == SVFStmt::NormalGep;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::BinaryOp;
+        return edge->getEdgeKind() == SVFStmt::NormalGep;
     }
     //@}
 
     /// constructor
-    BinaryOPStmt(SVFVar* s, const OPVars& opnds, u32_t oc) : MultiOpndStmt(s,opnds,SVFStmt::BinaryOp), opcode(oc)
-    {
-    }
+    NormalGepStmt(SVFVar* s, SVFVar* d, const LocationSet& l) : GepStmt(s,d,l, SVFStmt::NormalGep)
+    {}
 
-    u32_t getOpcode() const
+    /// offset of the gep edge
+    inline u32_t getFieldOffset() const
     {
-        return opcode;
+        return getLocationSet().accumulateConstantFieldIdx();
     }
 
     virtual const std::string toString() const override;
 };
 
 /*!
- * Unary statement
+ * Gep statement with a variant field index for struct field access 
  */
-class UnaryOPStmt: public SVFStmt
+class VariantGepStmt : public GepStmt
 {
 private:
-    UnaryOPStmt();                      ///< place holder
-    UnaryOPStmt(const UnaryOPStmt &);  ///< place holder
-    void operator=(const UnaryOPStmt &); ///< place holder
-    SVFVar* getSrcNode();  ///< place holder, use getOpVar() instead
-    SVFVar* getDstNode();    ///< place holder, use getRes() instead
-    SVFVar* getSrcID();  ///< place holder, use getOpVarID() instead
-    SVFVar* getDstID();    ///< place holder, use getResID() instead
+    VariantGepStmt(); ///< place holder
+    VariantGepStmt(const VariantGepStmt&); ///< place holder
+    void operator=(const VariantGepStmt&); ///< place holder
 
-    u32_t opcode;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const UnaryOPStmt *)
+    static inline bool classof(const VariantGepStmt *)
     {
         return true;
     }
+    static inline bool classof(const GepStmt *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::VariantGep;
+    }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::UnaryOp;
+        return edge->getEdgeKind() == SVFStmt::VariantGep;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::UnaryOp;
+        return edge->getEdgeKind() == SVFStmt::VariantGep;
     }
     //@}
 
     /// constructor
-    UnaryOPStmt(SVFVar* s, SVFVar* d, u32_t oc) : SVFStmt(s,d,SVFStmt::UnaryOp), opcode(oc)
-    {
-    }
-
-    u32_t getOpcode() const
-    {
-        return opcode;
-    }
-    inline const SVFVar* getOpVar() const{
-        return SVFStmt::getSrcNode();
-    }
-    inline const SVFVar* getRes() const{
-        return SVFStmt::getDstNode();
-    }
-    NodeID getOpVarID() const;
-    NodeID getResID() const;
+    VariantGepStmt(SVFVar* s, SVFVar* d, const LocationSet& l) : GepStmt(s,d,l, SVFStmt::VariantGep) {}
 
     virtual const std::string toString() const override;
+
 };
 
 
 /*!
- * Branch statements including if/else and switch 
+ * Call 
  */
-class BranchStmt: public SVFStmt
+class CallPE: public AssignStmt
 {
 private:
-    BranchStmt();                      ///< place holder
-    BranchStmt(const BranchStmt &);  ///< place holder
-    void operator=(const BranchStmt &); ///< place holder
-    SVFVar* getSrcNode();  ///< place holder, not allowed 
-    SVFVar* getDstNode();    ///< place holder, not allowed 
-    SVFVar* getSrcID();  ///< place holder, not allowed 
-    SVFVar* getDstID();    ///< place holder, not allowed 
+    CallPE();                      ///< place holder
+    CallPE(const CallPE &);  ///< place holder
+    void operator=(const CallPE &); ///< place holder
 
-    std::vector<const ICFGNode*> successors;
-    const SVFVar* cond;
-    const SVFVar* brInst;
+    const CallBlockNode* inst;		///< llvm instruction for this call
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const BranchStmt *)
+    static inline bool classof(const CallPE *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Branch;
+        return edge->getEdgeKind() == SVFStmt::Call
+        	|| edge->getEdgeKind() == SVFStmt::ThreadFork;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Branch;
+        return edge->getEdgeKind() == SVFStmt::Call
+        	|| edge->getEdgeKind() == SVFStmt::ThreadFork;
     }
     //@}
 
     /// constructor
-    BranchStmt(SVFVar* inst, SVFVar* c, const std::vector<const ICFGNode*>& succs) : SVFStmt(c,inst,SVFStmt::Branch), successors(succs), cond(c), brInst(inst)
+    CallPE(SVFVar* s, SVFVar* d, const CallBlockNode* i, GEdgeKind k = SVFStmt::Call) :
+        AssignStmt(s,d,makeEdgeFlagWithCallInst(k,i)), inst(i)
     {
     }
 
-    /// The branch is unconditional if cond is a null value
-    bool isUnconditional() const;
-    /// The branch is conditional if cond is not a null value
-    bool isConditional() const;
-    /// Return the condition 
-    const SVFVar* getCondition() const;
-    const SVFVar* getBranchInst() const{
-        return brInst;
-    }
-    /// Successors of this branch statement
-    ///@{
-    u32_t getNumSuccessors() const{
-        return successors.size();
-    }
-    const std::vector<const ICFGNode*>& getSuccessors() const{
-        return successors;
+    /// Get method for the call instruction
+    //@{
+    inline const CallBlockNode* getCallInst() const
+    {
+        return inst;
     }
-    const ICFGNode* getSuccessor (u32_t i) const{
-        return successors.at(i);
+    inline const CallBlockNode* getCallSite() const
+    {
+        return inst;
     }
-    ///@}
+    //@}
+
     virtual const std::string toString() const override;
 };
 
+
 /*!
- * Store statement
+ * Return 
  */
-class StoreStmt: public SVFStmt
+class RetPE: public AssignStmt
 {
 private:
-    StoreStmt();                      ///< place holder
-    StoreStmt(const StoreStmt &);  ///< place holder
-    void operator=(const StoreStmt &); ///< place holder
+    RetPE();                      ///< place holder
+    RetPE(const RetPE &);  ///< place holder
+    void operator=(const RetPE &); ///< place holder
 
+    const CallBlockNode* inst;		/// the callsite instruction return to
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const StoreStmt *)
+    static inline bool classof(const RetPE *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Store;
+        return edge->getEdgeKind() == SVFStmt::Ret
+			|| edge->getEdgeKind() == SVFStmt::ThreadJoin;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Store;
+        return edge->getEdgeKind() == SVFStmt::Ret
+    		|| edge->getEdgeKind() == SVFStmt::ThreadJoin;
     }
     //@}
 
     /// constructor
-    StoreStmt(SVFVar* s, SVFVar* d, const IntraBlockNode* st) :
-        SVFStmt(s, d, makeEdgeFlagWithStoreInst(SVFStmt::Store, st))
+    RetPE(SVFVar* s, SVFVar* d, const CallBlockNode* i, GEdgeKind k = SVFStmt::Ret) :
+        AssignStmt(s,d,makeEdgeFlagWithCallInst(k,i)), inst(i)
+    {
+    }
+
+    /// Get method for call instruction at caller
+    //@{
+    inline const CallBlockNode* getCallInst() const
     {
+        return inst;
     }
+    inline const CallBlockNode* getCallSite() const
+    {
+        return inst;
+    }
+    //@}
 
     virtual const std::string toString() const override;
 };
 
-
-/*!
- * Load statement
- */
-class LoadStmt: public SVFStmt
-{
+/*
+* Program statements with multiple operands including BinaryOPStmt, CmpStmt and PhiStmt
+*/
+class MultiOpndStmt : public SVFStmt{
+public:
+    typedef std::vector<SVFVar*> OPVars;
 private:
-    LoadStmt();                      ///< place holder
-    LoadStmt(const LoadStmt &);  ///< place holder
-    void operator=(const LoadStmt &); ///< place holder
+    MultiOpndStmt();                      ///< place holder
+    MultiOpndStmt(const MultiOpndStmt &);  ///< place holder
+    void operator=(const MultiOpndStmt &); ///< place holder
+    SVFVar* getSrcNode();  ///< not allowed, use getOpVar(idx) instead
+    SVFVar* getDstNode();    ///< not allowed, use getRes() instead
+    NodeID getSrcID();  ///< not allowed, use getOpVarID(idx) instead
+    NodeID getDstID();    ///< not allowed, use getResID() instead
 
+protected:
+    OPVars opVars;
+    /// Constructor, only used by subclassess but not external users
+    MultiOpndStmt(SVFVar* r, const OPVars& opnds, GEdgeFlag k): SVFStmt(opnds.at(0), r, k), opVars(opnds)
+    {
+    }
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const LoadStmt *)
+    static inline bool classof(const MultiOpndStmt *)
     {
         return true;
     }
-    static inline bool classof(const SVFStmt *edge)
+    static inline bool classof(const SVFStmt *node)
     {
-        return edge->getEdgeKind() == SVFStmt::Load;
+        return node->getEdgeKind() == Phi ||
+               node->getEdgeKind() == BinaryOp ||
+               node->getEdgeKind() == Cmp;
     }
-    static inline bool classof(const GenericPAGEdgeTy *edge)
+    static inline bool classof(const GenericPAGEdgeTy *node)
     {
-        return edge->getEdgeKind() == SVFStmt::Load;
+        return node->getEdgeKind() == Phi ||
+               node->getEdgeKind() == BinaryOp ||
+               node->getEdgeKind() == Cmp;
     }
     //@}
-
-    /// constructor
-    LoadStmt(SVFVar* s, SVFVar* d) : SVFStmt(s,d,SVFStmt::Load)
+    /// Operands and result at a BinaryNode e.g., p = q + r, `p` is resVar and `r` is OpVar
+    //@{
+    /// Operand SVFVars
+    inline const SVFVar* getOpVar(u32_t pos) const
     {
+        return opVars.at(pos);
     }
+    /// Result SVFVar
+    inline const SVFVar* getRes() const
+    {
+        return SVFStmt::getDstNode();
+    }
+    
+    NodeID getOpVarID(u32_t pos) const;
+    NodeID getResID() const;
 
-    virtual const std::string toString() const override;
+    inline u32_t getOpVarNum() const
+    {
+        return opVars.size();
+    }
+    inline const OPVars& getOpndVars() const{
+        return opVars;
+    }
+    inline OPVars::const_iterator opVarBegin() const
+    {
+        return opVars.begin();
+    }
+    inline OPVars::const_iterator opVerEnd() const
+    {
+        return opVars.end();
+    }
+    //@}
 };
 
-
 /*!
- * Gep statement for struct field access, array access and pointer arithmetic
+ * Phi statement (e.g., p = phi(q,r) which receives values from variables q and r from different paths)
+ * it is typically at a joint point of the control-flow graph
  */
-class GepStmt: public SVFStmt
+class PhiStmt: public MultiOpndStmt
 {
 private:
-    GepStmt();                      ///< place holder
-    GepStmt(const GepStmt &);  ///< place holder
-    void operator=(const GepStmt &); ///< place holder
-
-    LocationSet ls;	///< location set of the gep edge
+    PhiStmt();                      ///< place holder
+    PhiStmt(const PhiStmt &);  ///< place holder
+    void operator=(const PhiStmt &); ///< place holder
 
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const GepStmt *)
+    static inline bool classof(const PhiStmt *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return 	edge->getEdgeKind() == SVFStmt::NormalGep ||
-                edge->getEdgeKind() == SVFStmt::VariantGep;
+        return edge->getEdgeKind() == SVFStmt::Phi;
     }
-    static inline bool classof(const GenericPAGEdgeTy *edge)
+    static inline bool classof(const MultiOpndStmt *edge)
     {
-        return	edge->getEdgeKind() == SVFStmt::NormalGep ||
-                edge->getEdgeKind() == SVFStmt::VariantGep;
+        return edge->getEdgeKind() == SVFStmt::Phi;
     }
-    //@}
-
-    inline const LocationSet& getLocationSet() const
+    static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return ls;
+        return edge->getEdgeKind() == SVFStmt::Phi;
     }
+    //@}
 
-protected:
     /// constructor
-    GepStmt(SVFVar* s, SVFVar* d, const LocationSet& l, PEDGEK k) : SVFStmt(s,d,k), ls(l)
+    PhiStmt(SVFVar* s, const OPVars& opnds) : MultiOpndStmt(s,opnds,SVFStmt::Phi)
     {
     }
+    void addOpVar(SVFVar* op){
+        opVars.push_back(op);
+    }
 
-    virtual const std::string toString() const;
+    /// Return true if this is a phi at the function exit 
+    /// to receive one or multiple return values of this function
+    bool isFunctionRetPhi() const;
 
+    virtual const std::string toString() const override;
 };
 
 
 /*!
- * Gep statement with a fixed field index for struct field access 
+ * Comparison statement
  */
-class NormalGepStmt : public GepStmt
+class CmpStmt: public MultiOpndStmt
 {
 private:
-    NormalGepStmt(); ///< place holder
-    NormalGepStmt(const NormalGepStmt&); ///< place holder
-    void operator=(const NormalGepStmt&); ///< place holder
+    CmpStmt();                      ///< place holder
+    CmpStmt(const CmpStmt &);  ///< place holder
+    void operator=(const CmpStmt &); ///< place holder
 
+    u32_t predicate;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const NormalGepStmt *)
+    static inline bool classof(const CmpStmt *)
     {
         return true;
     }
-    static inline bool classof(const GepStmt *edge)
+    static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::NormalGep;
+        return edge->getEdgeKind() == SVFStmt::Cmp;
     }
-    static inline bool classof(const SVFStmt *edge)
+    static inline bool classof(const MultiOpndStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::NormalGep;
+        return edge->getEdgeKind() == SVFStmt::Cmp;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::NormalGep;
+        return edge->getEdgeKind() == SVFStmt::Cmp;
     }
     //@}
 
     /// constructor
-    NormalGepStmt(SVFVar* s, SVFVar* d, const LocationSet& l) : GepStmt(s,d,l, SVFStmt::NormalGep)
-    {}
-
-    /// offset of the gep edge
-    inline u32_t getFieldOffset() const
+    CmpStmt(SVFVar* s, const OPVars& opnds, u32_t pre) : MultiOpndStmt(s,opnds,SVFStmt::Cmp), predicate(pre)
     {
-        return getLocationSet().accumulateConstantFieldIdx();
     }
 
+    u32_t getPredicate() const
+    {
+        return predicate;
+    }
+    
     virtual const std::string toString() const override;
 };
 
+
 /*!
- * Gep statement with a variant field index for struct field access 
+ * Binary statement
  */
-class VariantGepStmt : public GepStmt
+class BinaryOPStmt: public MultiOpndStmt
 {
 private:
-    VariantGepStmt(); ///< place holder
-    VariantGepStmt(const VariantGepStmt&); ///< place holder
-    void operator=(const VariantGepStmt&); ///< place holder
+    BinaryOPStmt();                      ///< place holder
+    BinaryOPStmt(const BinaryOPStmt &);  ///< place holder
+    void operator=(const BinaryOPStmt &); ///< place holder
+    u32_t opcode;
 
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const VariantGepStmt *)
+    static inline bool classof(const BinaryOPStmt *)
     {
         return true;
     }
-    static inline bool classof(const GepStmt *edge)
+    static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::VariantGep;
+        return edge->getEdgeKind() == SVFStmt::BinaryOp;
     }
-    static inline bool classof(const SVFStmt *edge)
+    static inline bool classof(const MultiOpndStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::VariantGep;
+        return edge->getEdgeKind() == SVFStmt::BinaryOp;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::VariantGep;
+        return edge->getEdgeKind() == SVFStmt::BinaryOp;
     }
     //@}
 
     /// constructor
-    VariantGepStmt(SVFVar* s, SVFVar* d, const LocationSet& l) : GepStmt(s,d,l, SVFStmt::VariantGep) {}
+    BinaryOPStmt(SVFVar* s, const OPVars& opnds, u32_t oc) : MultiOpndStmt(s,opnds,SVFStmt::BinaryOp), opcode(oc)
+    {
+    }
 
-    virtual const std::string toString() const override;
+    u32_t getOpcode() const
+    {
+        return opcode;
+    }
 
+    virtual const std::string toString() const override;
 };
 
-
 /*!
- * Call 
+ * Unary statement
  */
-class CallPE: public SVFStmt
+class UnaryOPStmt: public SVFStmt
 {
 private:
-    CallPE();                      ///< place holder
-    CallPE(const CallPE &);  ///< place holder
-    void operator=(const CallPE &); ///< place holder
+    UnaryOPStmt();                      ///< place holder
+    UnaryOPStmt(const UnaryOPStmt &);  ///< place holder
+    void operator=(const UnaryOPStmt &); ///< place holder
+    SVFVar* getSrcNode();  ///< place holder, use getOpVar() instead
+    SVFVar* getDstNode();    ///< place holder, use getRes() instead
+    NodeID getSrcID();  ///< place holder, use getOpVarID(pos) instead
+    NodeID getDstID();    ///< place holder, use getResID() instead
 
-    const CallBlockNode* inst;		///< llvm instruction for this call
+    u32_t opcode;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const CallPE *)
+    static inline bool classof(const UnaryOPStmt *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Call
-        	|| edge->getEdgeKind() == SVFStmt::ThreadFork;
+        return edge->getEdgeKind() == SVFStmt::UnaryOp;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Call
-        	|| edge->getEdgeKind() == SVFStmt::ThreadFork;
+        return edge->getEdgeKind() == SVFStmt::UnaryOp;
     }
     //@}
 
     /// constructor
-    CallPE(SVFVar* s, SVFVar* d, const CallBlockNode* i, GEdgeKind k = SVFStmt::Call) :
-        SVFStmt(s,d,makeEdgeFlagWithCallInst(k,i)), inst(i)
+    UnaryOPStmt(SVFVar* s, SVFVar* d, u32_t oc) : SVFStmt(s,d,SVFStmt::UnaryOp), opcode(oc)
     {
     }
 
-    /// Get method for the call instruction
-    //@{
-    inline const CallBlockNode* getCallInst() const
+    u32_t getOpcode() const
     {
-        return inst;
+        return opcode;
     }
-    inline const CallBlockNode* getCallSite() const
-    {
-        return inst;
+    inline const SVFVar* getOpVar() const{
+        return SVFStmt::getSrcNode();
     }
-    //@}
+    inline const SVFVar* getRes() const{
+        return SVFStmt::getDstNode();
+    }
+    NodeID getOpVarID() const;
+    NodeID getResID() const;
 
     virtual const std::string toString() const override;
 };
 
 
 /*!
- * Return 
+ * Branch statements including if/else and switch 
  */
-class RetPE: public SVFStmt
+class BranchStmt: public SVFStmt
 {
 private:
-    RetPE();                      ///< place holder
-    RetPE(const RetPE &);  ///< place holder
-    void operator=(const RetPE &); ///< place holder
+    BranchStmt();                      ///< place holder
+    BranchStmt(const BranchStmt &);  ///< place holder
+    void operator=(const BranchStmt &); ///< place holder
+    SVFVar* getSrcNode();  ///< place holder, not allowed 
+    SVFVar* getDstNode();    ///< place holder, not allowed 
+    NodeID getSrcID();  ///< place holder, use getOpVarID(pos) instead
+    NodeID getDstID();    ///< place holder, use getResID() instead
 
-    const CallBlockNode* inst;		/// the callsite instruction return to
+    std::vector<const ICFGNode*> successors;
+    const SVFVar* cond;
+    const SVFVar* brInst;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
-    static inline bool classof(const RetPE *)
+    static inline bool classof(const BranchStmt *)
     {
         return true;
     }
     static inline bool classof(const SVFStmt *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Ret
-			|| edge->getEdgeKind() == SVFStmt::ThreadJoin;
+        return edge->getEdgeKind() == SVFStmt::Branch;
     }
     static inline bool classof(const GenericPAGEdgeTy *edge)
     {
-        return edge->getEdgeKind() == SVFStmt::Ret
-    		|| edge->getEdgeKind() == SVFStmt::ThreadJoin;
+        return edge->getEdgeKind() == SVFStmt::Branch;
     }
     //@}
 
     /// constructor
-    RetPE(SVFVar* s, SVFVar* d, const CallBlockNode* i, GEdgeKind k = SVFStmt::Ret) :
-        SVFStmt(s,d,makeEdgeFlagWithCallInst(k,i)), inst(i)
+    BranchStmt(SVFVar* inst, SVFVar* c, const std::vector<const ICFGNode*>& succs) : SVFStmt(c,inst,SVFStmt::Branch), successors(succs), cond(c), brInst(inst)
     {
     }
 
-    /// Get method for call instruction at caller
-    //@{
-    inline const CallBlockNode* getCallInst() const
-    {
-        return inst;
+    /// The branch is unconditional if cond is a null value
+    bool isUnconditional() const;
+    /// The branch is conditional if cond is not a null value
+    bool isConditional() const;
+    /// Return the condition 
+    const SVFVar* getCondition() const;
+    const SVFVar* getBranchInst() const{
+        return brInst;
     }
-    inline const CallBlockNode* getCallSite() const
-    {
-        return inst;
+    /// Successors of this branch statement
+    ///@{
+    u32_t getNumSuccessors() const{
+        return successors.size();
     }
-    //@}
-
+    const std::vector<const ICFGNode*>& getSuccessors() const{
+        return successors;
+    }
+    const ICFGNode* getSuccessor (u32_t i) const{
+        return successors.at(i);
+    }
+    ///@}
     virtual const std::string toString() const override;
 };