svf-tools 1.0.768 → 1.0.770

package/SVF-doxygen/html/html/structSVF_1_1SVFUtil_1_1make__void.html

@@ -89,7 +89,7 @@ struct SVF::SVFUtil::make_void&lt; Ts &gt;</h3>
 
 <p>void_t is not available until C++17. We define it here for C++11/14. </p>
 
-<p class="definition">Definition at line <a class="el" href="SVFUtil_8h_source.html#l00661">661</a> of file <a class="el" href="SVFUtil_8h_source.html">SVFUtil.h</a>.</p>
+<p class="definition">Definition at line <a class="el" href="SVFUtil_8h_source.html#l00627">627</a> of file <a class="el" href="SVFUtil_8h_source.html">SVFUtil.h</a>.</p>
 </div><h2 class="groupheader">Member Typedef Documentation</h2>
 <a id="ac2eb79d0fe9a0f94eb1992600ba91e36"></a>
 <h2 class="memtitle"><span class="permalink"><a href="#ac2eb79d0fe9a0f94eb1992600ba91e36">&#9670;&nbsp;</a></span>type</h2>
@@ -105,7 +105,7 @@ template&lt;typename... Ts&gt; </div>
       </table>
 </div><div class="memdoc">
 
-<p class="definition">Definition at line <a class="el" href="SVFUtil_8h_source.html#l00663">663</a> of file <a class="el" href="SVFUtil_8h_source.html">SVFUtil.h</a>.</p>
+<p class="definition">Definition at line <a class="el" href="SVFUtil_8h_source.html#l00629">629</a> of file <a class="el" href="SVFUtil_8h_source.html">SVFUtil.h</a>.</p>
 
 </div>
 </div>

package/SVF-doxygen/html/html/structstd_1_1hash_3_01SVF_1_1AccessPath_01_4.html

@@ -82,7 +82,7 @@ Public Member Functions</h2></td></tr>
 </table>
 <a name="details" id="details"></a><h2 class="groupheader">Detailed Description</h2>
 <div class="textblock">
-<p class="definition">Definition at line <a class="el" href="AccessPath_8h_source.html#l00147">147</a> of file <a class="el" href="AccessPath_8h_source.html">AccessPath.h</a>.</p>
+<p class="definition">Definition at line <a class="el" href="AccessPath_8h_source.html#l00153">153</a> of file <a class="el" href="AccessPath_8h_source.html">AccessPath.h</a>.</p>
 </div><h2 class="groupheader">Member Function Documentation</h2>
 <a id="a16b0806f551270a0078f71796a37f07f"></a>
 <h2 class="memtitle"><span class="permalink"><a href="#a16b0806f551270a0078f71796a37f07f">&#9670;&nbsp;</a></span>operator()()</h2>
@@ -108,13 +108,13 @@ Public Member Functions</h2></td></tr>
 </table>
 </div><div class="memdoc">
 
-<p class="definition">Definition at line <a class="el" href="AccessPath_8h_source.html#l00149">149</a> of file <a class="el" href="AccessPath_8h_source.html">AccessPath.h</a>.</p>
-<div class="fragment"><div class="line"><a name="l00150"></a><span class="lineno">  150</span>&#160;    {</div>
-<div class="line"><a name="l00151"></a><span class="lineno">  151</span>&#160;        <a class="code" href="structSVF_1_1Hash.html">SVF::Hash&lt;std::pair&lt;SVF::NodeID, SVF::NodeID&gt;</a>&gt; h;</div>
-<div class="line"><a name="l00152"></a><span class="lineno">  152</span>&#160;        std::hash&lt;SVF::AccessPath::OffsetVarAndGepTypePairs&gt; v;</div>
-<div class="line"><a name="l00153"></a><span class="lineno">  153</span>&#160;        <span class="keywordflow">return</span> h(std::make_pair(ap.<a class="code" href="classSVF_1_1AccessPath.html#a68e49bb797a84ea035ea338549f2e054">getConstantFieldIdx</a>(),</div>
-<div class="line"><a name="l00154"></a><span class="lineno">  154</span>&#160;                                v(ap.<a class="code" href="classSVF_1_1AccessPath.html#ab0641554924d44f16c2831cac63ccf8b">getOffsetVarAndGepTypePairVec</a>())));</div>
-<div class="line"><a name="l00155"></a><span class="lineno">  155</span>&#160;    }</div>
+<p class="definition">Definition at line <a class="el" href="AccessPath_8h_source.html#l00155">155</a> of file <a class="el" href="AccessPath_8h_source.html">AccessPath.h</a>.</p>
+<div class="fragment"><div class="line"><a name="l00156"></a><span class="lineno">  156</span>&#160;    {</div>
+<div class="line"><a name="l00157"></a><span class="lineno">  157</span>&#160;        <a class="code" href="structSVF_1_1Hash.html">SVF::Hash&lt;std::pair&lt;SVF::NodeID, SVF::NodeID&gt;</a>&gt; h;</div>
+<div class="line"><a name="l00158"></a><span class="lineno">  158</span>&#160;        std::hash&lt;SVF::AccessPath::OffsetVarAndGepTypePairs&gt; v;</div>
+<div class="line"><a name="l00159"></a><span class="lineno">  159</span>&#160;        <span class="keywordflow">return</span> h(std::make_pair(ap.<a class="code" href="classSVF_1_1AccessPath.html#a68e49bb797a84ea035ea338549f2e054">getConstantFieldIdx</a>(),</div>
+<div class="line"><a name="l00160"></a><span class="lineno">  160</span>&#160;                                v(ap.<a class="code" href="classSVF_1_1AccessPath.html#ab0641554924d44f16c2831cac63ccf8b">getOffsetVarAndGepTypePairVec</a>())));</div>
+<div class="line"><a name="l00161"></a><span class="lineno">  161</span>&#160;    }</div>
 </div><!-- fragment -->
 </div>
 </div>

package/SVF-doxygen/html/html/svf-ex_8cpp.html

@@ -418,7 +418,7 @@ Functions</h2></td></tr>
 <div class="ttc" id="aclassSVF_1_1SVFIR_html_abda052b73e869ed6d7c139ad1528da11"><div class="ttname"><a href="classSVF_1_1SVFIR.html#abda052b73e869ed6d7c139ad1528da11">SVF::SVFIR::getICFG</a></div><div class="ttdeci">ICFG * getICFG() const</div><div class="ttdef"><b>Definition:</b> <a href="SVFIR_8h_source.html#l00169">SVFIR.h:169</a></div></div>
 <div class="ttc" id="aclassSVF_1_1PTACallGraph_html"><div class="ttname"><a href="classSVF_1_1PTACallGraph.html">SVF::PTACallGraph</a></div><div class="ttdef"><b>Definition:</b> <a href="PTACallGraph_8h_source.html#l00218">PTACallGraph.h:218</a></div></div>
 <div class="ttc" id="aclassSVF_1_1SVFModule_html"><div class="ttname"><a href="classSVF_1_1SVFModule.html">SVF::SVFModule</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFModule_8h_source.html#l00040">SVFModule.h:40</a></div></div>
-<div class="ttc" id="aclassSVF_1_1SVFValue_html_a4a0cfe3a8f37d33ffcdca3d66026dcc3"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">SVF::SVFValue::toString</a></div><div class="ttdeci">std::string toString() const</div><div class="ttdoc">Needs to be implemented by a SVF front end.</div><div class="ttdef"><b>Definition:</b> <a href="LLVMUtil_8cpp_source.html#l01159">LLVMUtil.cpp:1159</a></div></div>
+<div class="ttc" id="aclassSVF_1_1SVFValue_html_a4a0cfe3a8f37d33ffcdca3d66026dcc3"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">SVF::SVFValue::toString</a></div><div class="ttdeci">std::string toString() const</div><div class="ttdoc">Needs to be implemented by a SVF front end.</div><div class="ttdef"><b>Definition:</b> <a href="LLVMUtil_8cpp_source.html#l01157">LLVMUtil.cpp:1157</a></div></div>
 <div class="ttc" id="aclassSVF_1_1VFGNode_html_a3c558955f60c237c558d8faafed781e8"><div class="ttname"><a href="classSVF_1_1VFGNode.html#a3c558955f60c237c558d8faafed781e8">SVF::VFGNode::const_iterator</a></div><div class="ttdeci">VFGEdge::VFGEdgeSetTy::const_iterator const_iterator</div><div class="ttdef"><b>Definition:</b> <a href="VFGNode_8h_source.html#l00060">VFGNode.h:60</a></div></div>
 <div class="ttc" id="aclassSVF_1_1ICFG_html"><div class="ttname"><a href="classSVF_1_1ICFG.html">SVF::ICFG</a></div><div class="ttdef"><b>Definition:</b> <a href="ICFG_8h_source.html#l00047">ICFG.h:47</a></div></div>
 <div class="ttc" id="aclassSVF_1_1PointsTo_html_ad5b582d2672617806c61e6170d0b5a7e"><div class="ttname"><a href="classSVF_1_1PointsTo.html#ad5b582d2672617806c61e6170d0b5a7e">SVF::PointsTo::begin</a></div><div class="ttdeci">const_iterator begin() const</div><div class="ttdef"><b>Definition:</b> <a href="PointsTo_8h_source.html#l00128">PointsTo.h:128</a></div></div>

package/SVF-doxygen/html/html/svf-ex_8cpp_source.html

@@ -283,7 +283,7 @@ $(function() {
 <div class="ttc" id="asvf-ex_8cpp_html_ad2f24f5ef6a8eaf0e4a77a8a4d31bc9f"><div class="ttname"><a href="svf-ex_8cpp.html#ad2f24f5ef6a8eaf0e4a77a8a4d31bc9f">aliasQuery</a></div><div class="ttdeci">SVF::AliasResult aliasQuery(PointerAnalysis *pta, SVFValue *v1, SVFValue *v2)</div><div class="ttdef"><b>Definition:</b> <a href="svf-ex_8cpp_source.html#l00042">svf-ex.cpp:42</a></div></div>
 <div class="ttc" id="aclassSVF_1_1PTACallGraph_html"><div class="ttname"><a href="classSVF_1_1PTACallGraph.html">SVF::PTACallGraph</a></div><div class="ttdef"><b>Definition:</b> <a href="PTACallGraph_8h_source.html#l00218">PTACallGraph.h:218</a></div></div>
 <div class="ttc" id="aclassSVF_1_1SVFModule_html"><div class="ttname"><a href="classSVF_1_1SVFModule.html">SVF::SVFModule</a></div><div class="ttdef"><b>Definition:</b> <a href="SVFModule_8h_source.html#l00040">SVFModule.h:40</a></div></div>
-<div class="ttc" id="aclassSVF_1_1SVFValue_html_a4a0cfe3a8f37d33ffcdca3d66026dcc3"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">SVF::SVFValue::toString</a></div><div class="ttdeci">std::string toString() const</div><div class="ttdoc">Needs to be implemented by a SVF front end.</div><div class="ttdef"><b>Definition:</b> <a href="LLVMUtil_8cpp_source.html#l01159">LLVMUtil.cpp:1159</a></div></div>
+<div class="ttc" id="aclassSVF_1_1SVFValue_html_a4a0cfe3a8f37d33ffcdca3d66026dcc3"><div class="ttname"><a href="classSVF_1_1SVFValue.html#a4a0cfe3a8f37d33ffcdca3d66026dcc3">SVF::SVFValue::toString</a></div><div class="ttdeci">std::string toString() const</div><div class="ttdoc">Needs to be implemented by a SVF front end.</div><div class="ttdef"><b>Definition:</b> <a href="LLVMUtil_8cpp_source.html#l01157">LLVMUtil.cpp:1157</a></div></div>
 <div class="ttc" id="aclassSVF_1_1VFGNode_html_a3c558955f60c237c558d8faafed781e8"><div class="ttname"><a href="classSVF_1_1VFGNode.html#a3c558955f60c237c558d8faafed781e8">SVF::VFGNode::const_iterator</a></div><div class="ttdeci">VFGEdge::VFGEdgeSetTy::const_iterator const_iterator</div><div class="ttdef"><b>Definition:</b> <a href="VFGNode_8h_source.html#l00060">VFGNode.h:60</a></div></div>
 <div class="ttc" id="aclassSVF_1_1ICFG_html"><div class="ttname"><a href="classSVF_1_1ICFG.html">SVF::ICFG</a></div><div class="ttdef"><b>Definition:</b> <a href="ICFG_8h_source.html#l00047">ICFG.h:47</a></div></div>
 <div class="ttc" id="aclassSVF_1_1PointsTo_html_ad5b582d2672617806c61e6170d0b5a7e"><div class="ttname"><a href="classSVF_1_1PointsTo.html#ad5b582d2672617806c61e6170d0b5a7e">SVF::PointsTo::begin</a></div><div class="ttdeci">const_iterator begin() const</div><div class="ttdef"><b>Definition:</b> <a href="PointsTo_8h_source.html#l00128">PointsTo.h:128</a></div></div>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.768",
+  "version": "1.0.770",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/AbstractExecution/SVFIR2ItvExeState.h

@@ -73,9 +73,23 @@ public:
     /// Return the field address given a pointer points to a struct object and an offset
     VAddrs getGepObjAddress(u32_t pointer, s32_t offset);
 
+    /// Return the byte offset from one gep param offset
+    std::pair<s32_t, s32_t> getBytefromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep, s32_t elem_bytesize);
+
+    /// Return the Index offset from one gep param offset
+    std::pair<s32_t, s32_t> getIndexfromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep);
+
+    /// Return the byte offset expression of a GepStmt
+    /// elemBytesize is the element byte size of an static alloc or heap alloc array
+    /// e.g. GepStmt* gep = **,
+    /// s32_t elemBytesize = LLVMUtil::SVFType2ByteSize(gep->getRHSVar()->getValue()->getType());
+    /// std::pair<s32_t, s32_t> byteOffset = getGepByteOffset(gep, elemBytesize);
+    std::pair<s32_t, s32_t> getGepByteOffset(const GepStmt *gep, s32_t elemBytesize);
+
     /// Return the offset expression of a GepStmt
     std::pair<s32_t, s32_t> getGepOffset(const GepStmt *gep);
 
+
     static z3::context &getContext()
     {
         return Z3Expr::getContext();

package/svf/include/MemoryModel/AccessPath.h

@@ -109,6 +109,12 @@ public:
     }
     //@}
 
+    /// Return accumulated constant byte offset given OffsetVarVec and elemByteSize
+    /// elemBytesize is the element byte size of an static alloc or heap alloc array
+    /// e.g. GepStmt* gep = **,
+    /// s32_t elemBytesize = LLVMUtil::SVFType2ByteSize(gep->getRHSVar()->getValue()->getType());
+    /// APOffset byteOffset = gep->accumulateConstantByteOffset(elemBytesize);
+    APOffset computeConstantByteOffset(u32_t elemBytesize) const;
     /// Return accumulated constant offset given OffsetVarVec
     APOffset computeConstantOffset() const;
 

package/svf/include/SVFIR/SVFStatements.h

@@ -500,6 +500,16 @@ public:
     {
         return getAccessPath().isConstantOffset();
     }
+    /// Return accumulated constant offset (when accessing array or struct) if this offset is a constant.
+    /// elemBytesize is the element byte size of an static alloc or heap alloc array
+    /// e.g. GepStmt* gep = **,
+    /// s32_t elemBytesize = LLVMUtil::SVFType2ByteSize(gep->getRHSVar()->getValue()->getType());
+    /// APOffset byteOffset = gep->accumulateConstantByteOffset(elemBytesize);
+    inline APOffset accumulateConstantByteOffset(u32_t elemBytesize) const
+    {
+        return getAccessPath().computeConstantByteOffset(elemBytesize);
+    }
+
     /// Return accumulated constant offset (when accessing array or struct) if this offset is a constant.
     inline APOffset accumulateConstantOffset() const
     {

package/svf/include/Util/SVFUtil.h

@@ -350,14 +350,6 @@ inline bool isReallocExtFun(const SVFFunction* fun)
     return fun && (ExtAPI::getExtAPI()->is_realloc(fun));
 }
 
-/// Return true if the call is a static global call
-//@{
-/// note that this function is not suppose to be used externally
-inline bool isStaticExtFun(const SVFFunction* fun)
-{
-    return fun && ExtAPI::getExtAPI()->has_static(fun);
-}
-
 /// Program entry function e.g. main
 //@{
 /// Return true if this is a program entry function (e.g. main)
@@ -494,32 +486,6 @@ inline bool isReallocExtCall(const SVFInstruction *inst)
 }
 //@}
 
-inline bool isStaticExtCall(const CallSite cs)
-{
-    bool isPtrTy = cs.getInstruction()->getType()->isPointerTy();
-    return isPtrTy && isStaticExtFun(getCallee(cs));
-}
-
-inline bool isStaticExtCall(const SVFInstruction *inst)
-{
-    bool isPtrTy = inst->getType()->isPointerTy();
-    return isPtrTy && isStaticExtFun(getCallee(inst));
-}
-//@}
-
-/// Return true if the call is a static global call
-//@{
-inline bool isHeapAllocOrStaticExtCall(const CallSite cs)
-{
-    return isStaticExtCall(cs) || isHeapAllocExtCall(cs);
-}
-
-inline bool isHeapAllocOrStaticExtCall(const SVFInstruction *inst)
-{
-    return isStaticExtCall(inst) || isHeapAllocExtCall(inst);
-}
-//@}
-
 /// Return true if this is a thread creation call
 ///@{
 inline bool isThreadForkCall(const CallSite cs)

package/svf/lib/AbstractExecution/SVFIR2ItvExeState.cpp

@@ -173,108 +173,187 @@ SVFIR2ItvExeState::VAddrs SVFIR2ItvExeState::getGepObjAddress(u32_t pointer, s32
     return ret;
 }
 
-std::pair<s32_t, s32_t> SVFIR2ItvExeState::getGepOffset(const GepStmt *gep)
+std::pair<s32_t, s32_t> SVFIR2ItvExeState::getBytefromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep, s32_t elemBytesize)
 {
-    /// for instant constant index, e.g.  gep arr, 1
-    if (gep->getOffsetVarAndGepTypePairVec().empty())
-        return std::make_pair(gep->getConstantFieldIdx(), gep->getConstantFieldIdx());
-
-    s32_t totalOffsetLb = 0;
-    s32_t totalOffsetUb = 0;
-    /// default value of MaxFieldLimit is 512
-    u32_t maxFieldLimit = Options::MaxFieldLimit() - 1;
-    /// for variable index and nested indexes, e.g. 1) gep arr, idx  2) gep arr idx0, idx1
-    for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
+    const SVFValue *value = gep_pair.first->getValue();
+    const SVFType *type = gep_pair.second;
+    const SVFConstantInt *op = SVFUtil::dyn_cast<SVFConstantInt>(value);
+    s32_t offsetLb = 0;
+    s32_t offsetUb = 0;
+    /// set largest byte offset is 0xFFFFFF in case of int32 overflow
+    s32_t maxFieldLimit = 0xFFFFFF;
+    /// offset is constant but stored in variable
+    if (op)
+    {
+        offsetLb = offsetUb = op->getSExtValue() >
+                              maxFieldLimit? maxFieldLimit: op->getSExtValue();
+    }
+    else
     {
-        const SVFValue *value = gep->getOffsetVarAndGepTypePairVec()[i].first->getValue();
-        const SVFType *type = gep->getOffsetVarAndGepTypePairVec()[i].second;
-        const SVFConstantInt *op = SVFUtil::dyn_cast<SVFConstantInt>(value);
-        s32_t offsetLb = 0;
-        s32_t offsetUb = 0;
-        /// offset is constant but stored in variable
-        if (op)
+        u32_t idx = _svfir->getValueNode(value);
+        IntervalValue &idxVal = _es[idx];
+        if (idxVal.isBottom() || idxVal.isTop())
+            return std::make_pair(0, maxFieldLimit);
+        // if idxVal is a concrete value
+        if (idxVal.is_numeral())
         {
-            offsetLb = offsetUb = op->getSExtValue();
+            offsetLb = offsetUb = idxVal.lb().getNumeral()>
+                                  maxFieldLimit? maxFieldLimit: idxVal.lb().getNumeral();
         }
-        /// offset is variable, the concrete value isn't sure util runtime, and maybe not a concrete value.
-        /// e.g.
         else
         {
-            u32_t idx = _svfir->getValueNode(value);
-            if (!inVarToIValTable(idx)) return std::make_pair(-1, -1);
-            IntervalValue &idxVal = _es[idx];
-            if (idxVal.isBottom() || idxVal.isTop()) return std::make_pair(0, (s32_t)Options::MaxFieldLimit());
-            // if idxVal is a concrete value
-            if (idxVal.is_numeral())
-            {
-                offsetLb = offsetUb = idxVal.lb().getNumeral();
-            }
-            else
-            {
-                // if inxVal is an interval. we should make sure that idxVal.lb>0 && idxVal.ub<MaxFieldLimit
-                offsetLb = idxVal.lb().getNumeral() < 0 ? 0 : idxVal.lb().getNumeral();
-                offsetLb = idxVal.lb().getNumeral() > maxFieldLimit ? maxFieldLimit : offsetLb;
-                offsetUb = idxVal.ub().getNumeral() < 0 ? 0 : idxVal.ub().getNumeral();
-                offsetUb = idxVal.ub().getNumeral() > maxFieldLimit ? maxFieldLimit : offsetUb;
-            }
+            offsetLb = idxVal.lb().getNumeral()> maxFieldLimit? maxFieldLimit:idxVal.lb().getNumeral() * elemBytesize ;
+            offsetUb = idxVal.ub().getNumeral() > maxFieldLimit? maxFieldLimit:idxVal.ub().getNumeral() * elemBytesize;
         }
-        if (type == nullptr)
+    }
+
+    if (type)
+    {
+        if (const SVFPointerType *pty = SVFUtil::dyn_cast<SVFPointerType>(type))
         {
-            if ((long long) (totalOffsetLb + offsetLb) > maxFieldLimit)
-            {
-                totalOffsetLb = maxFieldLimit;
-            }
-            else
-            {
-                totalOffsetLb += offsetLb;
-            }
+            offsetLb = offsetLb * gep->getAccessPath().getElementNum(pty->getPtrElementType())* elemBytesize;
+            offsetUb = offsetUb * gep->getAccessPath().getElementNum(pty->getPtrElementType())* elemBytesize;
+        }
+        else
+        {
+            offsetLb = offsetLb * elemBytesize;
+            offsetUb = offsetUb * elemBytesize;
+        }
+    }
+    return {offsetLb, offsetUb};
+}
 
-            if ((long long) (totalOffsetUb + offsetUb) > maxFieldLimit)
-            {
-                totalOffsetUb = maxFieldLimit;
-            }
-            else
-            {
-                totalOffsetUb += offsetUb;
-            }
-            continue;
+
+std::pair<s32_t, s32_t> SVFIR2ItvExeState::getIndexfromGepTypePair(const AccessPath::VarAndGepTypePair& gep_pair, const GepStmt *gep)
+{
+    const SVFValue *value = gep_pair.first->getValue();
+    const SVFType *type = gep_pair.second;
+    const SVFConstantInt *op = SVFUtil::dyn_cast<SVFConstantInt>(value);
+    s32_t offsetLb = 0;
+    s32_t offsetUb = 0;
+    s32_t maxFieldLimit = (s32_t)Options::MaxFieldLimit();
+    /// offset is constant but stored in variable
+    if (op)
+    {
+        offsetLb = offsetUb = op->getSExtValue() >
+                              maxFieldLimit? maxFieldLimit: op->getSExtValue();
+    }
+    else
+    {
+        u32_t idx = _svfir->getValueNode(value);
+        //if (!inVarToIValTable(idx)) return std::make_pair(-1, -1);
+        IntervalValue &idxVal = _es[idx];
+        if (idxVal.isBottom() || idxVal.isTop())
+            return std::make_pair(0, (s32_t)Options::MaxFieldLimit());
+        // if idxVal is a concrete value
+        if (idxVal.is_numeral())
+        {
+            offsetLb = offsetUb = idxVal.lb().getNumeral()>
+                                  maxFieldLimit? maxFieldLimit: idxVal.lb().getNumeral();
+        }
+        else
+        {
+            offsetLb = idxVal.lb().getNumeral() < 0
+                       ? 0
+                       : idxVal.lb().getNumeral();
+            offsetLb = idxVal.lb().getNumeral() > maxFieldLimit
+                       ? maxFieldLimit
+                       : offsetLb;
+            offsetUb = idxVal.ub().getNumeral() < 0
+                       ? 0
+                       : idxVal.ub().getNumeral();
+            offsetUb = idxVal.ub().getNumeral() > maxFieldLimit
+                       ? maxFieldLimit
+                       : offsetUb;
         }
+    }
 
+    if (type)
+    {
         if (const SVFPointerType *pty = SVFUtil::dyn_cast<SVFPointerType>(type))
         {
             offsetLb = offsetLb * gep->getAccessPath().getElementNum(pty->getPtrElementType());
             offsetUb = offsetUb * gep->getAccessPath().getElementNum(pty->getPtrElementType());
-
         }
         else
         {
-            const std::vector<u32_t> &so = SymbolTableInfo::SymbolInfo()->getTypeInfo(type)->getFlattenedElemIdxVec();
-            if (so.empty() || (u32_t) offsetUb >= so.size() || (u32_t) offsetLb >= so.size())
-                return std::make_pair(-1, -1);
-            offsetLb = SymbolTableInfo::SymbolInfo()->getFlattenedElemIdx(type, offsetLb);
-            offsetUb = SymbolTableInfo::SymbolInfo()->getFlattenedElemIdx(type, offsetUb);
+            const std::vector<u32_t>& so = SymbolTableInfo::SymbolInfo()
+                                           ->getTypeInfo(type)
+                                           ->getFlattenedElemIdxVec();
+            if (so.empty() || (u32_t)offsetUb >= so.size() ||
+                    (u32_t)offsetLb >= so.size())
+            {
+                offsetLb = 0;
+                offsetUb = maxFieldLimit;
+            }
+            else
+            {
+                offsetLb =
+                    SymbolTableInfo::SymbolInfo()->getFlattenedElemIdx(
+                        type, offsetLb);
+                offsetUb =
+                    SymbolTableInfo::SymbolInfo()->getFlattenedElemIdx(
+                        type, offsetUb);
+            }
         }
+    }
+    return {offsetLb, offsetUb};
+}
+
+
+std::pair<s32_t, s32_t> SVFIR2ItvExeState::getGepByteOffset(const GepStmt *gep, s32_t elemBytesize)
+{
+    /// for instant constant index, e.g.  gep arr, 1
+    if (gep->getOffsetVarAndGepTypePairVec().empty())
+        return std::make_pair(gep->getConstantFieldIdx(), gep->getConstantFieldIdx());
+    s32_t totalOffsetLb = 0;
+    s32_t totalOffsetUb = 0;
+    /// default value of MaxFieldLimit is 512
+    u32_t maxFieldLimit = 0xFFFFFF;
+    for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
+    {
+        std::pair<s32_t, s32_t> offsetIdx = getBytefromGepTypePair(
+                                                gep->getOffsetVarAndGepTypePairVec()[i], gep, elemBytesize);
+        s32_t offsetLb = offsetIdx.first;
+        s32_t offsetUb = offsetIdx.second;
         if ((long long) (totalOffsetLb + offsetLb) > maxFieldLimit)
-        {
             totalOffsetLb = maxFieldLimit;
-        }
         else
-        {
             totalOffsetLb += offsetLb;
-        }
         if ((long long) (totalOffsetUb + offsetUb) > maxFieldLimit)
-        {
             totalOffsetUb = maxFieldLimit;
-        }
         else
-        {
-            totalOffsetUb += offsetUb;
-        }
+            totalOffsetUb += offsetUb ;
+    }
+    return {totalOffsetLb, totalOffsetUb};
+}
+
+
+std::pair<s32_t, s32_t> SVFIR2ItvExeState::getGepOffset(const GepStmt *gep)
+{
+    /// for instant constant index, e.g.  gep arr, 1
+    if (gep->getOffsetVarAndGepTypePairVec().empty())
+        return std::make_pair(gep->getConstantFieldIdx(), gep->getConstantFieldIdx());
+    s32_t totalOffsetLb = 0;
+    s32_t totalOffsetUb = 0;
+    /// default value of MaxFieldLimit is 512
+    u32_t maxFieldLimit = Options::MaxFieldLimit() - 1;
+    for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
+    {
+        std::pair<s32_t, s32_t> offsetIdx = getIndexfromGepTypePair(
+                                                gep->getOffsetVarAndGepTypePairVec()[i], gep);
+        s32_t offsetLb = offsetIdx.first;
+        s32_t offsetUb = offsetIdx.second;
+        if ((long long) (totalOffsetLb + offsetLb) > maxFieldLimit)
+            totalOffsetLb = maxFieldLimit;
+        else
+            totalOffsetLb += offsetLb;
+        if ((long long) (totalOffsetUb + offsetUb) > maxFieldLimit)
+            totalOffsetUb = maxFieldLimit;
+        else
+            totalOffsetUb += offsetUb ;
     }
-    std::pair<s32_t, s32_t> offSetPair;
-    offSetPair.first = totalOffsetLb;
-    offSetPair.second = totalOffsetUb;
-    return offSetPair;
+    return {totalOffsetLb, totalOffsetUb};
 }
 
 /*!

package/svf/lib/MemoryModel/AccessPath.cpp

@@ -87,6 +87,45 @@ u32_t AccessPath::getElementNum(const SVFType* type) const
     }
 }
 
+/// Return accumulated constant offset
+///
+/// "value" is the offset variable (must be a constant)
+/// "type" is the location where we want to compute offset
+/// Given a vector and elem byte size: [(value1,type1), (value2,type2), (value3,type3)], bytesize
+/// totalConstByteOffset = ByteOffset(value1,type1) * ByteOffset(value2,type2) + ByteOffset(value3,type3)
+/// For a pointer type (e.g., t1 is PointerType), we will retrieve the pointee type and times the offset, i.e., getElementNum(t1) X off1
+APOffset AccessPath::computeConstantByteOffset(u32_t elemBytesize) const
+{
+    assert(isConstantOffset() && "not a constant offset");
+
+    if(offsetVarAndGepTypePairs.empty())
+        return getConstantFieldIdx() * elemBytesize;
+
+    APOffset totalConstOffset = 0;
+    for(int i = offsetVarAndGepTypePairs.size() - 1; i >= 0; i--)
+    {
+        const SVFValue* value = offsetVarAndGepTypePairs[i].first->getValue();
+        const SVFType* type = offsetVarAndGepTypePairs[i].second;
+        const SVFConstantInt* op = SVFUtil::dyn_cast<SVFConstantInt>(value);
+        assert(op && "not a constant offset?");
+        if(type==nullptr)
+        {
+            totalConstOffset += op->getSExtValue() * elemBytesize;
+            continue;
+        }
+
+        if(const SVFPointerType* pty = SVFUtil::dyn_cast<SVFPointerType>(type))
+            totalConstOffset += op->getSExtValue() * getElementNum(pty->getPtrElementType()) * elemBytesize;
+        else
+        {
+            APOffset offset = op->getSExtValue();
+            // if getByteOffset is false, it will retrieve flatten idx
+            totalConstOffset += offset * elemBytesize;
+        }
+    }
+    return totalConstOffset;
+}
+
 /// Return accumulated constant offset
 ///
 /// "value" is the offset variable (must be a constant)

package/svf/lib/Util/ExtAPI.cpp

@@ -144,12 +144,6 @@ bool ExtAPI::hasExtFuncAnnotation(const SVFFunction* fun, const std::string& fun
     return false;
 }
 
-// Does (F) have a static var X (unavailable to us) that its return points to?
-bool ExtAPI::has_static(const SVFFunction* F)
-{
-    return F && hasExtFuncAnnotation(F, "STATIC");
-}
-
 bool ExtAPI::is_memcpy(const SVFFunction *F)
 {
     return F && hasExtFuncAnnotation(F, "MEMCPY");

package/svf-llvm/include/SVF-LLVM/LLVMUtil.h

@@ -141,10 +141,10 @@ inline const PointerType *getRefTypeOfHeapAllocOrStatic(const CallBase* cs)
         if (const PointerType *argType = SVFUtil::dyn_cast<PointerType>(arg->getType()))
             refType = SVFUtil::dyn_cast<PointerType>(getPtrElementType(argType));
     }
-    // Case 2: heap/static object held by return value.
+    // Case 2: heap object held by return value.
     else
     {
-        assert((SVFUtil::isStaticExtCall(svfcs) || SVFUtil::isHeapAllocExtCallViaRet(svfcs))
+        assert(SVFUtil::isHeapAllocExtCallViaRet(svfcs)
                && "Must be heap alloc via ret, or static allocation site");
         refType = SVFUtil::dyn_cast<PointerType>(cs->getType());
     }
@@ -377,6 +377,23 @@ std::vector<const Function *> getCalledFunctions(const Function *F);
 std::vector<std::string> getFunAnnotations(const Function* fun);
 void removeFunAnnotations(std::vector<Function*>& removedFuncList);
 
+inline u32_t SVFType2ByteSize(const SVFType* type)
+{
+    const llvm::Type* llvm_rhs = LLVMModuleSet::getLLVMModuleSet()->getLLVMType(type);
+    u32_t llvm_rhs_size = LLVMUtil::getTypeSizeInBytes(llvm_rhs->getPointerElementType());
+    u32_t llvm_elem_size = -1;
+    if (llvm_rhs->getPointerElementType()->isArrayTy() && llvm_rhs_size > 0)
+    {
+        size_t array_len = llvm_rhs->getPointerElementType()->getArrayNumElements();
+        llvm_elem_size = llvm_rhs_size / array_len;
+    }
+    else
+    {
+        llvm_elem_size =llvm_rhs_size;
+    }
+    return llvm_elem_size;
+}
+
 inline void removeUnusedFuncsAndAnnotations(std::vector<Function*> removedFuncList)
 {
     /// Remove unused function annotations in extapi.bc

package/svf-llvm/lib/LLVMUtil.cpp

@@ -53,8 +53,6 @@ const std::string structName = "struct.";
  */
 bool LLVMUtil::isObject(const Value*  ref)
 {
-    if (SVFUtil::isa<Instruction>(ref) && SVFUtil::isStaticExtCall(LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(SVFUtil::cast<Instruction>(ref))) )
-        return true;
     if (SVFUtil::isa<Instruction>(ref) && SVFUtil::isHeapAllocExtCallViaRet(LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(SVFUtil::cast<Instruction>(ref))))
         return true;
     if (SVFUtil::isa<GlobalVariable>(ref))

package/svf-llvm/lib/SVFIRExtAPI.cpp

@@ -128,7 +128,7 @@ void SVFIRBuilder::handleExtCall(const CallBase* cs, const SVFFunction* svfCalle
     const SVFInstruction* svfInst = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(cs);
     const SVFCallInst* svfCall = SVFUtil::cast<SVFCallInst>(svfInst);
 
-    if (isHeapAllocExtCallViaRet(svfCall) || isStaticExtCall(svfCall))
+    if (isHeapAllocExtCallViaRet(svfCall))
     {
         NodeID val = pag->getValueNode(svfInst);
         NodeID obj = pag->getObjectNode(svfInst);

package/svf-llvm/lib/SymbolTableBuilder.cpp

@@ -750,15 +750,6 @@ void SymbolTableBuilder::initTypeInfo(ObjTypeInfo* typeinfo, const Value* val,
         // Heap object, label its field as infinite here
         objSize = typeinfo->getMaxFieldOffsetLimit();
     }
-    else if (SVFUtil::isa<Instruction>(val) &&
-             isStaticExtCall(
-                 LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(
-                     SVFUtil::cast<Instruction>(val))))
-    {
-        analyzeStaticObjType(typeinfo,val);
-        // static object allocated before main, label its field as infinite here
-        objSize = typeinfo->getMaxFieldOffsetLimit();
-    }
     else if(ArgInProgEntryFunction(val))
     {
         analyzeStaticObjType(typeinfo,val);