svf-tools 1.0.363 → 1.0.367

package/include/MemoryModel/SVFStatements.h

@@ -53,7 +53,7 @@ public:
     /// ThreadFork/ThreadJoin is to model parameter passings between thread spawners and spawnees.
     enum PEDGEK
     {
-        Addr, Copy, Store, Load, Call, Ret, Gep, Phi, Cmp, BinaryOp, UnaryOp, Branch, ThreadFork, ThreadJoin
+        Addr, Copy, Store, Load, Call, Ret, Gep, Phi, Select, Cmp, BinaryOp, UnaryOp, Branch, ThreadFork, ThreadJoin
     };
 
 private:
@@ -481,7 +481,8 @@ private:
     CallPE(const CallPE &);  ///< place holder
     void operator=(const CallPE &); ///< place holder
 
-    const CallICFGNode* inst;		///< llvm instruction for this call
+    const CallICFGNode* call;		        /// the callsite statement calling from 
+    const FunEntryICFGNode* entry;		/// the function exit statement calling to
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -502,8 +503,8 @@ public:
     //@}
 
     /// constructor
-    CallPE(SVFVar* s, SVFVar* d, const CallICFGNode* i, GEdgeKind k = SVFStmt::Call) :
-        AssignStmt(s,d,makeEdgeFlagWithCallInst(k,i)), inst(i)
+    CallPE(SVFVar* s, SVFVar* d, const CallICFGNode* i, const FunEntryICFGNode* e, GEdgeKind k = SVFStmt::Call) :
+        AssignStmt(s,d,makeEdgeFlagWithCallInst(k,i)), call(i), entry(e)
     {
     }
 
@@ -511,11 +512,15 @@ public:
     //@{
     inline const CallICFGNode* getCallInst() const
     {
-        return inst;
+        return call;
     }
     inline const CallICFGNode* getCallSite() const
     {
-        return inst;
+        return call;
+    }
+    inline const FunEntryICFGNode* getFunEntryICFGNode() const
+    {
+        return entry;
     }
     //@}
 
@@ -533,7 +538,8 @@ private:
     RetPE(const RetPE &);  ///< place holder
     void operator=(const RetPE &); ///< place holder
 
-    const CallICFGNode* inst;		/// the callsite instruction return to
+    const CallICFGNode* call;		        /// the callsite statement returning to
+    const FunExitICFGNode* exit;		/// the function exit statement returned from
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -554,8 +560,8 @@ public:
     //@}
 
     /// constructor
-    RetPE(SVFVar* s, SVFVar* d, const CallICFGNode* i, GEdgeKind k = SVFStmt::Ret) :
-        AssignStmt(s,d,makeEdgeFlagWithCallInst(k,i)), inst(i)
+    RetPE(SVFVar* s, SVFVar* d, const CallICFGNode* i, const FunExitICFGNode* e, GEdgeKind k = SVFStmt::Ret) :
+        AssignStmt(s,d,makeEdgeFlagWithCallInst(k,i)), call(i), exit(e)
     {
     }
 
@@ -563,11 +569,15 @@ public:
     //@{
     inline const CallICFGNode* getCallInst() const
     {
-        return inst;
+        return call;
     }
     inline const CallICFGNode* getCallSite() const
     {
-        return inst;
+        return call;
+    }
+    inline const FunExitICFGNode* getFunExitICFGNode() const
+    {
+        return exit;
     }
     //@}
 
@@ -605,12 +615,14 @@ public:
     static inline bool classof(const SVFStmt *node)
     {
         return node->getEdgeKind() == Phi ||
+               node->getEdgeKind() == Select ||
                node->getEdgeKind() == BinaryOp ||
                node->getEdgeKind() == Cmp;
     }
     static inline bool classof(const GenericPAGEdgeTy *node)
     {
         return node->getEdgeKind() == Phi ||
+               node->getEdgeKind() == Select ||
                node->getEdgeKind() == BinaryOp ||
                node->getEdgeKind() == Cmp;
     }
@@ -627,7 +639,16 @@ public:
     {
         return SVFStmt::getDstNode();
     }
-    
+    /// Return the position of this op
+    const u32_t getOpPos(const SVFVar* op) const{
+        for(u32_t i = 0; i < getOpVarNum(); i++){
+            if(getOpVar(i)==op)
+                return i;
+        }
+        assert(false && "this operand not found!");
+        abort();
+    }
+
     NodeID getOpVarID(u32_t pos) const;
     NodeID getResID() const;
 
@@ -655,11 +676,15 @@ public:
  */
 class PhiStmt: public MultiOpndStmt
 {
+public:
+    typedef std::vector<const ICFGNode* > OpICFGNodeVec;
+
 private:
     PhiStmt();                      ///< place holder
     PhiStmt(const PhiStmt &);  ///< place holder
     void operator=(const PhiStmt &); ///< place holder
 
+    OpICFGNodeVec opICFGNodes;
 public:
     /// Methods for support type inquiry through isa, cast, and dyn_cast:
     //@{
@@ -682,11 +707,19 @@ public:
     //@}
 
     /// constructor
-    PhiStmt(SVFVar* s, const OPVars& opnds) : MultiOpndStmt(s,opnds,SVFStmt::Phi)
+    PhiStmt(SVFVar* s, const OPVars& opnds, const OpICFGNodeVec& icfgNodes) : MultiOpndStmt(s,opnds,SVFStmt::Phi), opICFGNodes(icfgNodes)
     {
+        assert(opnds.size()==icfgNodes.size() && "Numbers of operands and their ICFGNodes are not consistent?");
     }
-    void addOpVar(SVFVar* op){
+    void addOpVar(SVFVar* op, const ICFGNode* inode){
         opVars.push_back(op);
+        opICFGNodes.push_back(inode);
+        assert(opVars.size()==opICFGNodes.size() && "Numbers of operands and their ICFGNodes are not consistent?");
+    }
+
+    /// Return the corresponding ICFGNode of this operand
+    inline const ICFGNode* getOpICFGNode(const SVFVar* op) const{
+        return opICFGNodes.at(getOpPos(op));
     }
 
     /// Return true if this is a phi at the function exit 
@@ -696,6 +729,55 @@ public:
     virtual const std::string toString() const override;
 };
 
+/*!
+ * Select statement (e.g., p ? q: r which receives values from variables q and r based on condition p)
+ */
+class SelectStmt: public MultiOpndStmt
+{
+private:
+    SelectStmt();                      ///< place holder
+    SelectStmt(const SelectStmt &);  ///< place holder
+    void operator=(const SelectStmt &); ///< place holder
+
+    const SVFVar* condition;
+public:
+    /// Methods for support type inquiry through isa, cast, and dyn_cast:
+    //@{
+    static inline bool classof(const SelectStmt *)
+    {
+        return true;
+    }
+    static inline bool classof(const SVFStmt *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Select;
+    }
+    static inline bool classof(const MultiOpndStmt *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Select;
+    }
+    static inline bool classof(const GenericPAGEdgeTy *edge)
+    {
+        return edge->getEdgeKind() == SVFStmt::Select;
+    }
+    //@}
+
+    /// constructor
+    SelectStmt(SVFVar* s, const OPVars& opnds, const SVFVar* cond) : MultiOpndStmt(s,opnds,SVFStmt::Select), condition(cond)
+    {
+        assert(opnds.size()==2 && "SelectStmt can only have two operands!");
+    }
+    virtual const std::string toString() const override;
+
+    inline const SVFVar* getCondition() const{
+        return condition;
+    }
+    inline const SVFVar* getTrueValue() const{
+        return  getOpVar(0);
+    }
+    inline const SVFVar* getFalseValue() const{
+        return  getOpVar(1);
+    }
+};
 
 /*!
  * Comparison statement
@@ -950,8 +1032,8 @@ public:
     //@}
 
     /// constructor
-    TDForkPE(SVFVar* s, SVFVar* d, const CallICFGNode* i) :
-        CallPE(s,d,i,SVFStmt::ThreadFork)
+    TDForkPE(SVFVar* s, SVFVar* d, const CallICFGNode* i, const FunEntryICFGNode* entry) :
+        CallPE(s,d,i,entry,SVFStmt::ThreadFork)
     {
     }
 
@@ -988,8 +1070,8 @@ public:
     //@}
 
     /// Constructor
-    TDJoinPE(SVFVar* s, SVFVar* d, const CallICFGNode* i) :
-        RetPE(s,d,i,SVFStmt::ThreadJoin)
+    TDJoinPE(SVFVar* s, SVFVar* d, const CallICFGNode* i, const FunExitICFGNode* e) :
+        RetPE(s,d,i,e, SVFStmt::ThreadJoin)
     {
     }
 

package/include/SVF-FE/SVFIRBuilder.h

@@ -306,9 +306,16 @@ public:
         return edge;
     }
     /// Add Copy edge
-    inline PhiStmt* addPhiStmt(NodeID res, NodeID opnd)
+    inline PhiStmt* addPhiStmt(NodeID res, NodeID opnd, const ICFGNode* pred)
     {
-        PhiStmt *edge = pag->addPhiStmt(res,opnd);
+        PhiStmt *edge = pag->addPhiStmt(res,opnd,pred);
+        setCurrentBBAndValueForPAGEdge(edge);
+        return edge;
+    }
+    /// Add SelectStmt
+    inline SelectStmt* addSelectStmt(NodeID res, NodeID op1, NodeID op2, NodeID cond)
+    {
+        SelectStmt *edge = pag->addSelectStmt(res,op1,op2,cond);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
@@ -359,16 +366,16 @@ public:
         return edge;
     }
     /// Add Call edge
-    inline CallPE* addCallEdge(NodeID src, NodeID dst, const CallICFGNode* cs)
+    inline CallPE* addCallEdge(NodeID src, NodeID dst, const CallICFGNode* cs, const FunEntryICFGNode* entry)
     {
-        CallPE *edge = pag->addCallPE(src, dst, cs);
+        CallPE *edge = pag->addCallPE(src, dst, cs, entry);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
     /// Add Return edge
-    inline RetPE* addRetEdge(NodeID src, NodeID dst, const CallICFGNode* cs)
+    inline RetPE* addRetEdge(NodeID src, NodeID dst, const CallICFGNode* cs, const FunExitICFGNode* exit)
     {
-        RetPE *edge = pag->addRetPE(src, dst, cs);
+        RetPE *edge = pag->addRetPE(src, dst, cs, exit);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
@@ -394,16 +401,16 @@ public:
         return edge;
     }
     /// Add Thread fork edge for parameter passing
-    inline TDForkPE* addThreadForkEdge(NodeID src, NodeID dst, const CallICFGNode* cs)
+    inline TDForkPE* addThreadForkEdge(NodeID src, NodeID dst, const CallICFGNode* cs, const FunEntryICFGNode* entry)
     {
-        TDForkPE *edge = pag->addThreadForkPE(src, dst, cs);
+        TDForkPE *edge = pag->addThreadForkPE(src, dst, cs, entry);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }
     /// Add Thread join edge for parameter passing
-    inline TDJoinPE* addThreadJoinEdge(NodeID src, NodeID dst, const CallICFGNode* cs)
+    inline TDJoinPE* addThreadJoinEdge(NodeID src, NodeID dst, const CallICFGNode* cs, const FunExitICFGNode* exit)
     {
-        TDJoinPE *edge = pag->addThreadJoinPE(src, dst, cs);
+        TDJoinPE *edge = pag->addThreadJoinPE(src, dst, cs, exit);
         setCurrentBBAndValueForPAGEdge(edge);
         return edge;
     }

package/lib/Graphs/ConsG.cpp

@@ -74,6 +74,15 @@ void ConstraintGraph::buildCG()
             addCopyCGEdge(opVar->getId(),edge->getResID());
     }
 
+    SVFStmt::SVFStmtSetTy& selects = getPAGEdgeSet(SVFStmt::Select);
+    for (SVFStmt::SVFStmtSetTy::iterator iter = selects.begin(), eiter =
+                selects.end(); iter != eiter; ++iter)
+    {
+        const SelectStmt* edge = SVFUtil::cast<SelectStmt>(*iter);
+        for(const auto opVar : edge->getOpndVars())
+            addCopyCGEdge(opVar->getId(),edge->getResID());
+    }
+
     SVFStmt::SVFStmtSetTy& calls = getPAGEdgeSet(SVFStmt::Call);
     for (SVFStmt::SVFStmtSetTy::iterator iter = calls.begin(), eiter =
                 calls.end(); iter != eiter; ++iter)

package/lib/Graphs/VFG.cpp

@@ -489,6 +489,15 @@ void VFG::addVFGNodes()
         if(isInterestedPAGNode(edge->getRes()))
             addIntraPHIVFGNode(edge);
     }
+    // initialize select statement
+    SVFStmt::SVFStmtSetTy& selects = getPAGEdgeSet(SVFStmt::Select);
+    for (SVFStmt::SVFStmtSetTy::iterator iter = selects.begin(), eiter =
+                selects.end(); iter != eiter; ++iter)
+    {
+        const MultiOpndStmt* edge = SVFUtil::cast<MultiOpndStmt>(*iter);
+        if(isInterestedPAGNode(edge->getRes()))
+            addIntraPHIVFGNode(edge);
+    }
     // initialize llvm binary nodes (binary operators)
     SVFStmt::SVFStmtSetTy& binaryops = getPAGEdgeSet(SVFStmt::BinaryOp);
     for (SVFStmt::SVFStmtSetTy::iterator iter = binaryops.begin(), eiter =

package/lib/MemoryModel/PAGBuilderFromFile.cpp

@@ -173,9 +173,9 @@ void PAGBuilderFromFile::addEdge(NodeID srcID, NodeID dstID,
     else if (edge == "variant-gep")
         pag->addVariantGepStmt(srcID, dstID, LocationSet(offsetOrCSId));
     else if (edge == "call")
-        pag->addEdge(srcNode, dstNode, new CallPE(srcNode, dstNode, nullptr));
+        pag->addEdge(srcNode, dstNode, new CallPE(srcNode, dstNode, nullptr, nullptr));
     else if (edge == "ret")
-        pag->addEdge(srcNode, dstNode, new RetPE(srcNode, dstNode, nullptr));
+        pag->addEdge(srcNode, dstNode, new RetPE(srcNode, dstNode, nullptr,nullptr));
     else if (edge == "cmp")
         pag->addCmpStmt(srcID, dstID, dstID, dstID);
     else if (edge == "binary-op")
@@ -183,7 +183,9 @@ void PAGBuilderFromFile::addEdge(NodeID srcID, NodeID dstID,
     else if (edge == "unary-op")
         pag->addUnaryOPStmt(srcID, dstID, dstID);
     else if (edge == "phi")
-        pag->addPhiStmt(srcID, dstID);
+        assert(false && "fix phi here!");
+    else if (edge == "select")
+        assert(false && "fix select here!");
     else if (edge == "branch"){
         assert(false && "fix successors here!");
         //pag->addBranchStmt(srcID, dstID, nullptr);

package/lib/MemoryModel/SVFIR.cpp

@@ -84,24 +84,45 @@ CopyStmt* SVFIR::addCopyStmt(NodeID src, NodeID dst)
 /*!
  * Add Phi statement 
  */
-PhiStmt* SVFIR::addPhiStmt(NodeID res, NodeID opnd)
+PhiStmt* SVFIR::addPhiStmt(NodeID res, NodeID opnd, const ICFGNode* pred)
 {
     SVFVar* opNode = getGNode(opnd);
     SVFVar* resNode = getGNode(res);
     PHINodeMap::iterator it = phiNodeMap.find(resNode);
     if(it == phiNodeMap.end()){
-        PhiStmt* phi = new PhiStmt(resNode, {opNode});
+        PhiStmt* phi = new PhiStmt(resNode, {opNode}, {pred});
         addToStmt2TypeMap(phi);
         addEdge(opNode, resNode, phi);
         phiNodeMap[resNode] = phi;
         return phi;
     }
     else{
-        it->second->addOpVar(opNode);
+        it->second->addOpVar(opNode,pred);
         return it->second;
     }
 }
 
+/*!
+ * Add Phi statement 
+ */
+SelectStmt* SVFIR::addSelectStmt(NodeID res, NodeID op1, NodeID op2, NodeID cond)
+{
+    SVFVar* op1Node = getGNode(op1);
+    SVFVar* op2Node = getGNode(op2);
+    SVFVar* dstNode = getGNode(res);
+    SVFVar* condNode = getGNode(cond);
+    if(SVFStmt* edge = hasLabeledEdge(op1Node, dstNode, SVFStmt::Select, op2Node))
+        return SVFUtil::cast<SelectStmt>(edge);
+    else
+    {
+        std::vector<SVFVar*> opnds = {op1Node, op2Node};
+        SelectStmt* select = new SelectStmt(dstNode, opnds, condNode);
+        addToStmt2TypeMap(select);
+        addEdge(op1Node, dstNode, select);
+        return select;
+    }
+}
+
 /*!
  * Add Compare edge
  */
@@ -219,7 +240,7 @@ StoreStmt* SVFIR::addStoreStmt(NodeID src, NodeID dst, const IntraICFGNode* curV
 /*!
  * Add Call edge
  */
-CallPE* SVFIR::addCallPE(NodeID src, NodeID dst, const CallICFGNode* cs)
+CallPE* SVFIR::addCallPE(NodeID src, NodeID dst, const CallICFGNode* cs, const FunEntryICFGNode* entry)
 {
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
@@ -227,7 +248,7 @@ CallPE* SVFIR::addCallPE(NodeID src, NodeID dst, const CallICFGNode* cs)
         return SVFUtil::cast<CallPE>(edge);
     else
     {
-        CallPE* callPE = new CallPE(srcNode, dstNode, cs);
+        CallPE* callPE = new CallPE(srcNode, dstNode, cs,entry);
         addToStmt2TypeMap(callPE);
         addEdge(srcNode,dstNode, callPE);
         return callPE;
@@ -237,7 +258,7 @@ CallPE* SVFIR::addCallPE(NodeID src, NodeID dst, const CallICFGNode* cs)
 /*!
  * Add Return edge
  */
-RetPE* SVFIR::addRetPE(NodeID src, NodeID dst, const CallICFGNode* cs)
+RetPE* SVFIR::addRetPE(NodeID src, NodeID dst, const CallICFGNode* cs, const FunExitICFGNode* exit)
 {
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
@@ -245,7 +266,7 @@ RetPE* SVFIR::addRetPE(NodeID src, NodeID dst, const CallICFGNode* cs)
         return SVFUtil::cast<RetPE>(edge);
     else
     {
-        RetPE* retPE = new RetPE(srcNode, dstNode, cs);
+        RetPE* retPE = new RetPE(srcNode, dstNode, cs, exit);
         addToStmt2TypeMap(retPE);
         addEdge(srcNode,dstNode, retPE);
         return retPE;
@@ -266,7 +287,7 @@ SVFStmt* SVFIR::addBlackHoleAddrStmt(NodeID node)
 /*!
  * Add Thread fork edge for parameter passing from a spawner to its spawnees
  */
-TDForkPE* SVFIR::addThreadForkPE(NodeID src, NodeID dst, const CallICFGNode* cs)
+TDForkPE* SVFIR::addThreadForkPE(NodeID src, NodeID dst, const CallICFGNode* cs, const FunEntryICFGNode* entry)
 {
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
@@ -274,7 +295,7 @@ TDForkPE* SVFIR::addThreadForkPE(NodeID src, NodeID dst, const CallICFGNode* cs)
         return SVFUtil::cast<TDForkPE>(edge);
     else
     {
-        TDForkPE* forkPE = new TDForkPE(srcNode, dstNode, cs);
+        TDForkPE* forkPE = new TDForkPE(srcNode, dstNode, cs, entry);
         addToStmt2TypeMap(forkPE);
         addEdge(srcNode,dstNode, forkPE);
         return forkPE;
@@ -284,7 +305,7 @@ TDForkPE* SVFIR::addThreadForkPE(NodeID src, NodeID dst, const CallICFGNode* cs)
 /*!
  * Add Thread fork edge for parameter passing from a spawnee back to its spawners
  */
-TDJoinPE* SVFIR::addThreadJoinPE(NodeID src, NodeID dst, const CallICFGNode* cs)
+TDJoinPE* SVFIR::addThreadJoinPE(NodeID src, NodeID dst, const CallICFGNode* cs, const FunExitICFGNode* exit)
 {
     SVFVar* srcNode = getGNode(src);
     SVFVar* dstNode = getGNode(dst);
@@ -292,7 +313,7 @@ TDJoinPE* SVFIR::addThreadJoinPE(NodeID src, NodeID dst, const CallICFGNode* cs)
         return SVFUtil::cast<TDJoinPE>(edge);
     else
     {
-        TDJoinPE* joinPE = new TDJoinPE(srcNode, dstNode, cs);
+        TDJoinPE* joinPE = new TDJoinPE(srcNode, dstNode, cs, exit);
         addToStmt2TypeMap(joinPE);
         addEdge(srcNode,dstNode, joinPE);
         return joinPE;

package/lib/MemoryModel/SVFStatements.cpp

@@ -101,6 +101,20 @@ const std::string PhiStmt::toString() const{
     return rawstr.str();
 }
 
+const std::string SelectStmt::toString() const{
+    std::string str;
+    raw_string_ostream rawstr(str);
+    rawstr << "SelectStmt: (Condition Var" <<  getCondition()->getId() << ") [Var" << getResID() << " <-- (Var";
+    for(const SVFVar* op : getOpndVars())
+        rawstr << op->getId() << ",";
+    rawstr << ")]\t";
+    if (Options::ShowSVFIRValue) {
+        rawstr << "\n";
+        rawstr << value2String(getValue());
+    }
+    return rawstr.str();
+}
+
 const std::string CmpStmt::toString() const{
     std::string str;
     raw_string_ostream rawstr(str);

package/lib/SVF-FE/SVFIRBuilder.cpp

@@ -369,11 +369,11 @@ void SVFIRBuilder::processCE(const Value *val)
             const Value* cval = getCurrentValue();
             const BasicBlock* cbb = getCurrentBB();
             setCurrentLocation(selectce, nullptr);
+            NodeID cond = pag->getValueNode(selectce->getOperand(0));
             NodeID nsrc1 = pag->getValueNode(src1);
             NodeID nsrc2 = pag->getValueNode(src2);
             NodeID nres = pag->getValueNode(selectce);
-            addPhiStmt(nres,nsrc1);
-            addPhiStmt(nres,nsrc2);
+            addSelectStmt(nres,nsrc1, nsrc2, cond);
             setCurrentLocation(cval, cbb);
         }
         // if we meet a int2ptr, then it points-to black hole
@@ -629,9 +629,10 @@ void SVFIRBuilder::visitPHINode(PHINode &inst)
         const Value* val = inst.getIncomingValue(i);
         const Instruction* incomingInst = SVFUtil::dyn_cast<Instruction>(val);
         assert((incomingInst==nullptr) || (incomingInst->getFunction() == inst.getFunction()));
-
+        const Instruction* predInst = &inst.getIncomingBlock(i)->front();
+        const ICFGNode* icfgNode = pag->getICFG()->getICFGNode(predInst);
         NodeID src = getValueNode(val);
-        addPhiStmt(dst,src);
+        addPhiStmt(dst,src,icfgNode);
     }
 }
 
@@ -772,10 +773,9 @@ void SVFIRBuilder::visitSelectInst(SelectInst &inst)
     NodeID dst = getValueNode(&inst);
     NodeID src1 = getValueNode(inst.getTrueValue());
     NodeID src2 = getValueNode(inst.getFalseValue());
-
+    NodeID cond = getValueNode(inst.getCondition());
     /// Two operands have same incoming basic block, both are the current BB
-    addPhiStmt(dst,src1);
-    addPhiStmt(dst,src2);
+    addSelectStmt(dst,src1,src2, cond);
 }
 
 /*
@@ -841,8 +841,9 @@ void SVFIRBuilder::visitReturnInst(ReturnInst &inst)
 
         NodeID rnF = getReturnNode(F);
         NodeID vnS = getValueNode(src);
+        const ICFGNode* icfgNode = pag->getICFG()->getICFGNode(&inst);
         //vnS may be null if src is a null ptr
-        addPhiStmt(rnF,vnS);
+        addPhiStmt(rnF,vnS,icfgNode);
     }
 }
 
@@ -892,7 +893,7 @@ void SVFIRBuilder::visitBranchInst(BranchInst &inst){
     BranchStmt::SuccAndCondPairVec successors;
     for (u32_t i = 0; i < inst.getNumSuccessors(); ++i)
     {
-        const Instruction* succInst = &inst.getSuccessor(i)->front();
+        const Instruction* succInst = &inst.getSuccessor(i)->back();
         const ICFGNode* icfgNode = pag->getICFG()->getICFGNode(succInst);
         successors.push_back(std::make_pair(icfgNode, 1-i));
     }
@@ -960,8 +961,9 @@ void SVFIRBuilder::handleDirectCall(CallSite cs, const SVFFunction *F)
     if (!cs.getType()->isVoidTy())
     {
         NodeID srcret = getReturnNode(F);
-        CallICFGNode* icfgNode = pag->getICFG()->getCallICFGNode(cs.getInstruction());
-        addRetEdge(srcret, dstrec,icfgNode);
+        CallICFGNode* callICFGNode = pag->getICFG()->getCallICFGNode(cs.getInstruction());
+        FunExitICFGNode* exitICFGNode = pag->getICFG()->getFunExitICFGNode(F);
+        addRetEdge(srcret, dstrec,callICFGNode, exitICFGNode);
     }
     //Iterators for the actual and formal parameters
     CallSite::arg_iterator itA = cs.arg_begin(), ieA = cs.arg_end();
@@ -983,7 +985,8 @@ void SVFIRBuilder::handleDirectCall(CallSite cs, const SVFFunction *F)
         NodeID dstFA = getValueNode(FA);
         NodeID srcAA = getValueNode(AA);
         CallICFGNode* icfgNode = pag->getICFG()->getCallICFGNode(cs.getInstruction());
-        addCallEdge(srcAA, dstFA, icfgNode);
+        FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(F);
+        addCallEdge(srcAA, dstFA, icfgNode, entry);
     }
     //Any remaining actual args must be varargs.
     if (F->getLLVMFun()->isVarArg())
@@ -995,7 +998,8 @@ void SVFIRBuilder::handleDirectCall(CallSite cs, const SVFFunction *F)
             Value *AA = *itA;
             NodeID vnAA = getValueNode(AA);
             CallICFGNode* icfgNode = pag->getICFG()->getCallICFGNode(cs.getInstruction());
-            addCallEdge(vnAA,vaF, icfgNode);
+            FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(F);
+            addCallEdge(vnAA,vaF, icfgNode,entry);
         }
     }
     if(itA != ieA)
@@ -1478,7 +1482,8 @@ void SVFIRBuilder::handleExtCall(CallSite cs, const SVFFunction *callee)
                     if(SVFUtil::isa<PointerType>(actualParm->getType()) && SVFUtil::isa<PointerType>(formalParm->getType()) )
                     {
                         CallICFGNode* icfgNode = pag->getICFG()->getCallICFGNode(inst);
-                        addThreadForkEdge(pag->getValueNode(actualParm), pag->getValueNode(formalParm),icfgNode);
+                        FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(LLVMModuleSet::getLLVMModuleSet()->getSVFFunction(forkedFun));
+                        addThreadForkEdge(pag->getValueNode(actualParm), pag->getValueNode(formalParm),icfgNode, entry);
                     }
                 }
             }
@@ -1507,7 +1512,8 @@ void SVFIRBuilder::handleExtCall(CallSite cs, const SVFFunction *callee)
                 if(SVFUtil::isa<PointerType>(actualParm->getType()) && SVFUtil::isa<PointerType>(formalParm->getType()) )
                 {
                     CallICFGNode* icfgNode = pag->getICFG()->getCallICFGNode(inst);
-                    addThreadForkEdge(pag->getValueNode(actualParm), pag->getValueNode(formalParm),icfgNode);
+                    FunEntryICFGNode* entry = pag->getICFG()->getFunEntryICFGNode(LLVMModuleSet::getLLVMModuleSet()->getSVFFunction(taskFunc));
+                    addThreadForkEdge(pag->getValueNode(actualParm), pag->getValueNode(formalParm),icfgNode, entry);
                 }
             }
             else
@@ -1635,12 +1641,16 @@ void SVFIRBuilder::setCurrentBBAndValueForPAGEdge(PAGEdge* edge)
             assert(curBB && "instruction does not have a basic block??");
 
         /// We will have one unique function exit ICFGNode for all returns
-        if(const ReturnInst* retInst = SVFUtil::dyn_cast<ReturnInst>(curVal)){
+        if(const ReturnInst* retInst = SVFUtil::dyn_cast<ReturnInst>(curInst)){
             const SVFFunction *fun = LLVMModuleSet::getLLVMModuleSet()->getSVFFunction(retInst->getParent()->getParent());
             icfgNode = pag->getICFG()->getFunExitICFGNode(fun);
         }
-        else
-            icfgNode = pag->getICFG()->getICFGNode(curInst);
+        else{
+            if(SVFUtil::isa<RetPE>(edge))
+                icfgNode = pag->getICFG()->getRetICFGNode(curInst);
+            else
+                icfgNode = pag->getICFG()->getICFGNode(curInst);
+        }
     }
     else if (const Argument* arg = SVFUtil::dyn_cast<Argument>(curVal))
     {
@@ -1656,12 +1666,20 @@ void SVFIRBuilder::setCurrentBBAndValueForPAGEdge(PAGEdge* edge)
     		icfgNode = pag->getICFG()->getICFGNode(&curBB->front());
     }
     else if (SVFUtil::isa<GlobalVariable>(curVal) ||
-             SVFUtil::isa<Function>(curVal) ||
              SVFUtil::isa<Constant>(curVal) ||
 			 SVFUtil::isa<MetadataAsValue>(curVal))
     {
         pag->addGlobalPAGEdge(edge);
     }
+    else if(const Function* fun = SVFUtil::dyn_cast<Function>(curVal)){
+        const SVFFunction* f = LLVMModuleSet::getLLVMModuleSet()->getSVFFunction(fun);
+        if((&fun->getEntryBlock() == curBB) && isExtCall(f)){
+            /// all external function connected to a indirect call, we will put SVFStmts in the FunctionEntryICFGNode
+            icfgNode = pag->getICFG()->getFunEntryICFGNode(f);
+        }
+        else
+            pag->addGlobalPAGEdge(edge);
+    }
     else
     {
         assert(false && "what else value can we have?");
@@ -1702,16 +1720,19 @@ void SVFIRBuilder::updateCallGraph(PTACallGraph* callgraph){
     {
         const CallICFGNode* callBlock = iter->first;
         CallSite cs = getLLVMCallSite(callBlock->getCallSite());
-        setCurrentLocation(callBlock->getCallSite(), callBlock->getCallSite()->getParent());
         assert(callBlock->isIndirectCall() && "this is not an indirect call?");
         const PTACallGraph::FunctionSet & functions = iter->second;
         for (PTACallGraph::FunctionSet::const_iterator func_iter = functions.begin(); func_iter != functions.end(); func_iter++)
         {
             const SVFFunction*  callee = *func_iter;
-            if (isExtCall(callee))
+            if (isExtCall(callee)){
+                setCurrentLocation(callee->getLLVMFun(), &callee->getLLVMFun()->getEntryBlock());
                 handleExtCall(cs, callee);
-            else
+            }
+            else{
+                setCurrentLocation(callBlock->getCallSite(), callBlock->getCallSite()->getParent());
                 handleDirectCall(cs, callee);
+            }
         }
     }
 

package/lib/SVF-FE/SymbolTableBuilder.cpp

@@ -130,6 +130,7 @@ void SymbolTableBuilder::buildMemModel(SVFModule* svfModule)
             {
                 collectSym(sel->getTrueValue());
                 collectSym(sel->getFalseValue());
+                collectSym(sel->getCondition());
             }
             else if (const BinaryOperator *binary = SVFUtil::dyn_cast<BinaryOperator>(inst))
             {