svf-tools 1.0.938 → 1.0.940

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.938",
+  "version": "1.0.940",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/AE/Core/AbstractValue.h

@@ -168,317 +168,36 @@ public:
     AbstractValue(const IntervalValue& ival) : type(IntervalType), interval(ival) {}
 
     AbstractValue(const AddressValue& addr) : type(AddressType), addr(addr) {}
-    // TODO: move constructor
+
     IntervalValue& getInterval()
     {
         if (isUnknown())
         {
             interval = IntervalValue::top();
         }
-        assert(isInterval());
+        assert(isInterval() && "Attempting to retrieve an AbstractValue that is not an Interval!");
         return interval;
     }
 
-    //
     const IntervalValue getInterval() const
     {
-        assert(isInterval());
+        assert(isInterval() && "Attempting to retrieve an AbstractValue that is not an Interval!");
         return interval;
     }
 
     AddressValue& getAddrs()
     {
-        assert(isAddr());
+        assert(isAddr() && "Attempting to retrieve an AbstractValue that is not an Address!");
         return addr;
     }
 
     const AddressValue getAddrs() const
     {
-        assert(isAddr());
+        assert(isAddr() && "Attempting to retrieve an AbstractValue that is not an Address!");
         return addr;
     }
-    ~AbstractValue() {};
-
-
-    // interval visit funcs
-    bool isTop() const
-    {
-        assert(isInterval());
-        return interval.isTop();
-    }
-
-    bool isBottom() const
-    {
-        assert(isInterval());
-        return interval.isBottom();
-    }
-
-    const BoundedInt& lb() const
-    {
-        assert(isInterval());
-        return interval.lb();
-    }
-
-    const BoundedInt& ub() const
-    {
-        assert(isInterval());
-        return interval.ub();
-    }
-
-    void setLb(const BoundedInt& lb)
-    {
-        assert(isInterval());
-        interval.setLb(lb);
-    }
-
-    void setUb(const BoundedInt& ub)
-    {
-        assert(isInterval());
-        interval.setUb(ub);
-    }
-
-    void setValue(const BoundedInt &lb, const BoundedInt &ub)
-    {
-        assert(isInterval());
-        interval.setValue(lb, ub);
-    }
-
-    bool is_zero() const
-    {
-        assert(isInterval());
-        return interval.is_zero();
-    }
-
-    bool is_infinite() const
-    {
-        assert(isInterval());
-        return interval.is_infinite();
-    }
-
-    bool is_int() const
-    {
-        assert(isInterval());
-        return interval.is_int();
-    }
-
-    bool is_real() const
-    {
-        assert(isInterval());
-        return interval.is_real();
-    }
-
-    s64_t getIntNumeral() const
-    {
-        assert(isInterval());
-        return interval.getIntNumeral();
-    }
-
-    double getRealNumeral() const
-    {
-        assert(isInterval());
-        return interval.getRealNumeral();
-    }
-
-    bool is_numeral() const
-    {
-        assert(isInterval());
-        return interval.is_numeral();
-    }
-
-    void set_to_bottom()
-    {
-        assert(isInterval());
-        interval.set_to_bottom();
-    }
-
-    void set_to_top()
-    {
-        assert(isInterval());
-        interval.set_to_top();
-    }
 
-    bool leq(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval.leq(other.interval);
-    }
-
-    bool geq(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval.geq(other.interval);
-    }
-
-    bool contains(s64_t n) const
-    {
-        assert(isInterval());
-        return interval.contains(n);
-    }
-    // operator +-*/%>< >= <= << >> & | ^
-    AbstractValue operator+(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval + other.interval;
-    }
-    AbstractValue operator+(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval + other;
-    }
-
-    AbstractValue operator-(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval - other.interval;
-    }
-    AbstractValue operator-(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval - other;
-    }
-
-    AbstractValue operator*(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval * other.interval;
-    }
-    AbstractValue operator*(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval * other;
-    }
-
-    AbstractValue operator/(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval / other.interval;
-    }
-    AbstractValue operator/(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval / other;
-    }
-
-    AbstractValue operator%(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval % other.interval;
-    }
-    AbstractValue operator%(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval % other;
-    }
-
-    AbstractValue operator>>(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval >> other.interval;
-    }
-    AbstractValue operator>>(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval >> other;
-    }
-
-    AbstractValue operator<<(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval << other.interval;
-    }
-    AbstractValue operator<<(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval << other;
-    }
-
-    AbstractValue operator&(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval & other.interval;
-    }
-    AbstractValue operator&(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval & other;
-    }
-
-    AbstractValue operator|(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval | other.interval;
-    }
-    AbstractValue operator|(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval | other;
-    }
-
-    AbstractValue operator^(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval ^ other.interval;
-    }
-    AbstractValue operator^(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval ^ other;
-    }
-
-    AbstractValue operator>(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval > other.interval;
-    }
-    AbstractValue operator>(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval > other;
-    }
-
-    AbstractValue operator<(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval < other.interval;
-    }
-    AbstractValue operator<(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval < other;
-    }
-
-    AbstractValue operator>=(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval >= other.interval;
-    }
-    AbstractValue operator>=(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval >= other;
-    }
-
-    AbstractValue operator<=(const AbstractValue &other) const
-    {
-        assert(isInterval() && other.isInterval());
-        return interval <= other.interval;
-    }
-    AbstractValue operator<=(const IntervalValue &other) const
-    {
-        assert(isInterval());
-        return interval <= other;
-    }
-
-
-    // address visit funcs
-    std::pair<AddressValue::AddrSet::iterator, bool> insertAddr(u32_t id)   // insertAddr
-    {
-        assert(isAddr());
-        return addr.insert(id);
-    }
-
-    // TODO: equals, join_with, meet_with, widen_with, narrow_with, toString,
-    // These should be merged with AddressValue
+    ~AbstractValue() {};
 
     bool equals(const AbstractValue &rhs) const
     {

package/svf/include/AE/Svfexe/AbstractInterpretation.h

@@ -264,9 +264,9 @@ protected:
     * e.g. source code str = "abc", return 3
     *
     * @param strValue SVFValue of string
-    * @return AbstractValue of string length
+    * @return IntervalValue of string length
     */
-    AbstractValue getStrlen(AbstractState& as, const SVF::SVFValue *strValue);
+    IntervalValue getStrlen(AbstractState& as, const SVF::SVFValue *strValue);
 
     /**
     * get memory allocation size
@@ -275,9 +275,9 @@ protected:
     *      memset(arr, 1, 10* sizeof(int))
     * when we trace the 'arr', we can get the alloc size [40, 40]
     * @param value to be traced
-    * @return AbstractValue of allocation size
+    * @return IntervalValue of allocation size
     */
-    AbstractValue traceMemoryAllocationSize(AbstractState& as, const SVFValue *value);
+    IntervalValue traceMemoryAllocationSize(AbstractState& as, const SVFValue *value);
     /**
     * execute strcpy in abstract execution
     * e.g  arr = new char[10]
@@ -304,7 +304,7 @@ protected:
     * we can set arr[3]='d', arr[4]='e', arr[5]='\0'
     * @param call callnode of memcpy like api
     */
-    virtual void handleMemcpy(AbstractState& as, const SVFValue* dst, const SVFValue* src, AbstractValue len, u32_t start_idx);
+    virtual void handleMemcpy(AbstractState& as, const SVFValue* dst, const SVFValue* src, IntervalValue len, u32_t start_idx);
     /**
     * execute memset in abstract execution
     * e.g  arr = new char[10]
@@ -312,7 +312,7 @@ protected:
     * we can set arr[0]='c', arr[1]='c', arr[2]='\0'
     * @param call callnode of memset like api
     */
-    virtual void handleMemset(AbstractState& as, const SVFValue* dst, AbstractValue elem, AbstractValue len);
+    virtual void handleMemset(AbstractState& as, const SVFValue* dst, IntervalValue elem, IntervalValue len);
 
     /**
     * if this NodeID in SVFIR is a pointer, get the pointee type

package/svf/include/AE/Svfexe/BufOverflowChecker.h

@@ -164,7 +164,7 @@ protected:
      * @param len the length of the buffer overflow checkpoint
      * @return true if the buffer overflow is detected
      */
-    bool canSafelyAccessMemory(const SVFValue *value, const AbstractValue &len, const ICFGNode *curNode);
+    bool canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode);
 
 private:
     /**

package/svf/include/AE/Svfexe/SVFIR2AbsState.h

@@ -81,10 +81,10 @@ public:
     /// e.g. GepStmt* gep = [i32*10], x, and x is [0,3]
     /// std::pair<s32_t, s32_t> byteOffset = getByteOffset(gep);
     /// byteOffset should be [0, 12] since i32 is 4 bytes.
-    AbstractValue getByteOffset(const AbstractState& es, const GepStmt *gep);
+    IntervalValue getByteOffset(const AbstractState& es, const GepStmt *gep);
 
     /// Return the offset expression of a GepStmt
-    AbstractValue getElementIndex(const AbstractState& es, const GepStmt *gep);
+    IntervalValue getElementIndex(const AbstractState& es, const GepStmt *gep);
 
 
     static z3::context &getContext()

package/svf/include/Graphs/ConsGNode.h

@@ -383,7 +383,16 @@ public:
     }
     //@}
 
+    virtual const std::string toString() const;
 
+    /// Overloading operator << for dumping node
+    //@{
+    friend OutStream &operator<<(OutStream &o, const ConstraintNode &node)
+    {
+        o << node.toString();
+        return o;
+    }
+    //@}
 };
 
 } // End namespace SVF

package/svf/lib/AE/Core/RelationSolver.cpp

@@ -201,13 +201,14 @@ Z3Expr RelationSolver::gamma_hat(const AbstractState& exeState) const
     Z3Expr res(Z3Expr::getContext().bool_val(true));
     for (auto& item : exeState.getVarToVal())
     {
-        if (item.second.isBottom())
+        IntervalValue interval = item.second.getInterval();
+        if (interval.isBottom())
             return Z3Expr::getContext().bool_val(false);
-        if (item.second.isTop())
+        if (interval.isTop())
             continue;
         Z3Expr v = toIntZ3Expr(item.first);
-        res = (res && v >= (int)item.second.lb().getNumeral() &&
-               v <= (int)item.second.ub().getNumeral()).simplify();
+        res = (res && v >= (int)interval.lb().getNumeral() &&
+               v <= (int)interval.ub().getNumeral()).simplify();
     }
     return res;
 }
@@ -236,8 +237,8 @@ Z3Expr RelationSolver::gamma_hat(u32_t id, const AbstractState& exeState) const
     assert(it != exeState.getVarToVal().end() && "id not in varToVal?");
     Z3Expr v = toIntZ3Expr(id);
     // Z3Expr v = Z3Expr::getContext().int_const(std::to_string(id).c_str());
-    Z3Expr res = (v >= (int)it->second.lb().getNumeral() &&
-                  v <= (int)it->second.ub().getNumeral());
+    Z3Expr res = (v >= (int)it->second.getInterval().lb().getNumeral() &&
+                  v <= (int)it->second.getInterval().ub().getNumeral());
     return res;
 }
 
@@ -281,31 +282,33 @@ AbstractState RelationSolver::BS(const AbstractState& domain, const Z3Expr &phi)
     /// init low, ret, high
     for (const auto& item: domain.getVarToVal())
     {
-        updateMap(ret, item.first, item.second.ub().getFVal());
-        if (item.second.lb().is_minus_infinity())
+        IntervalValue interval = item.second.getInterval();
+        updateMap(ret, item.first, interval.ub().getFVal());
+        if (interval.lb().is_minus_infinity())
             updateMap(low_values, item.first, -infinity);
         else
-            updateMap(low_values, item.first, item.second.lb().getFVal());
-        if (item.second.ub().is_plus_infinity())
+            updateMap(low_values, item.first, interval.lb().getFVal());
+        if (interval.ub().is_plus_infinity())
             updateMap(high_values, item.first, infinity);
         else
-            updateMap(high_values, item.first, item.second.ub().getFVal());
+            updateMap(high_values, item.first, interval.ub().getFVal());
         if (item.first > bias)
             bias = item.first + 1;
     }
     for (const auto& item: domain.getVarToVal())
     {
         /// init objects -x
+        IntervalValue interval = item.second.getInterval();
         u32_t reverse_key = item.first + bias;
-        updateMap(ret, reverse_key, -item.second.lb().getFVal());
-        if (item.second.ub().is_plus_infinity())
+        updateMap(ret, reverse_key, -interval.lb().getFVal());
+        if (interval.ub().is_plus_infinity())
             updateMap(low_values, reverse_key, -infinity);
         else
-            updateMap(low_values, reverse_key, -item.second.ub().getFVal());
-        if (item.second.lb().is_minus_infinity())
+            updateMap(low_values, reverse_key, -interval.ub().getFVal());
+        if (interval.lb().is_minus_infinity())
             updateMap(high_values, reverse_key, infinity);
         else
-            updateMap(high_values, reverse_key, -item.second.lb().getFVal());
+            updateMap(high_values, reverse_key, -interval.lb().getFVal());
         /// add a relation that x == -(x+bias)
         new_phi = (new_phi && (toIntZ3Expr(reverse_key) == -1 * toIntZ3Expr(item.first)));
     }

package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp

@@ -1153,11 +1153,11 @@ std::string AbstractInterpretation::strRead(AbstractState& as, const SVFValue* r
         }
         if (val.isUnknown())
             return str0;
-        if (!val.is_numeral())
+        if (!val.getInterval().is_numeral())
         {
             break;
         }
-        if ((char) val.getIntNumeral() == '\0')
+        if ((char) val.getInterval().getIntNumeral() == '\0')
         {
             break;
         }
@@ -1208,14 +1208,14 @@ void AbstractInterpretation::handleExtAPI(const CallICFGNode *call)
     // 1. memcpy functions like memcpy_chk, strncpy, annotate("MEMCPY"), annotate("BUF_CHECK:Arg0, Arg2"), annotate("BUF_CHECK:Arg1, Arg2")
     else if (extType == MEMCPY)
     {
-        AbstractValue len = as[_svfir->getValueNode(cs.getArgument(2))];
+        IntervalValue len = as[_svfir->getValueNode(cs.getArgument(2))].getInterval();
         handleMemcpy(as, cs.getArgument(0), cs.getArgument(1), len, 0);
     }
     else if (extType == MEMSET)
     {
         // memset dst is arg0, elem is arg1, size is arg2
-        AbstractValue len = as[_svfir->getValueNode(cs.getArgument(2))];
-        AbstractValue elem = as[_svfir->getValueNode(cs.getArgument(1))];
+        IntervalValue len = as[_svfir->getValueNode(cs.getArgument(2))].getInterval();
+        IntervalValue elem = as[_svfir->getValueNode(cs.getArgument(1))].getInterval();
         handleMemset(as,cs.getArgument(0), elem, len);
     }
     else if (extType == STRCPY)
@@ -1279,9 +1279,9 @@ void AbstractInterpretation::handleStrcpy(const CallICFGNode *call)
     CallSite cs = SVFUtil::getSVFCallSite(call->getCallSite());
     const SVFValue* arg0Val = cs.getArgument(0);
     const SVFValue* arg1Val = cs.getArgument(1);
-    AbstractValue strLen = getStrlen(as, arg1Val);
+    IntervalValue strLen = getStrlen(as, arg1Val);
     // no need to -1, since it has \0 as the last byte
-    handleMemcpy(as, arg0Val, arg1Val, strLen,strLen.lb().getIntNumeral());
+    handleMemcpy(as, arg0Val, arg1Val, strLen, strLen.lb().getIntNumeral());
 }
 
 u32_t AbstractInterpretation::getAllocaInstByteSize(AbstractState& as, const AddrStmt *addr)
@@ -1307,8 +1307,8 @@ u32_t AbstractInterpretation::getAllocaInstByteSize(AbstractState& as, const Add
                 {
                     as[_svfir->getValueNode(value)] = IntervalValue(Options::MaxFieldLimit());
                 }
-                AbstractValue itv =
-                    as[_svfir->getValueNode(value)];
+                IntervalValue itv =
+                    as[_svfir->getValueNode(value)].getInterval();
                 res = res * itv.ub().getIntNumeral() > Options::MaxFieldLimit()? Options::MaxFieldLimit(): res * itv.ub().getIntNumeral();
             }
             return (u32_t)res;
@@ -1318,7 +1318,7 @@ u32_t AbstractInterpretation::getAllocaInstByteSize(AbstractState& as, const Add
     abort();
 }
 
-AbstractValue AbstractInterpretation::traceMemoryAllocationSize(AbstractState& as, const SVFValue *value)
+IntervalValue AbstractInterpretation::traceMemoryAllocationSize(AbstractState& as, const SVFValue *value)
 {
     /// Usually called by a GepStmt overflow check, or external API (like memcpy) overflow check
     /// Defitions of Terms:
@@ -1400,7 +1400,7 @@ AbstractValue AbstractInterpretation::traceMemoryAllocationSize(AbstractState& a
                             else
                             {
                                 IntervalValue byteOffset =
-                                    _svfir2AbsState->getByteOffset(as, gep).getInterval();
+                                    _svfir2AbsState->getByteOffset(as, gep);
                             }
                             // for variable offset, join with accumulate gep offset
                             gep_offsets[gep->getICFGNode()] = byteOffset;
@@ -1451,9 +1451,9 @@ AbstractValue AbstractInterpretation::traceMemoryAllocationSize(AbstractState& a
 }
 
 
-AbstractValue AbstractInterpretation::getStrlen(AbstractState& as, const SVF::SVFValue *strValue)
+IntervalValue AbstractInterpretation::getStrlen(AbstractState& as, const SVF::SVFValue *strValue)
 {
-    AbstractValue dst_size = traceMemoryAllocationSize(as, strValue);
+    IntervalValue dst_size = traceMemoryAllocationSize(as, strValue);
     u32_t len = 0;
     NodeID dstid = _svfir->getValueNode(strValue);
     u32_t elemSize = 1;
@@ -1472,7 +1472,7 @@ AbstractValue AbstractInterpretation::getStrlen(AbstractState& as, const SVF::SV
             {
                 return IntervalValue((s64_t)0, (s64_t)Options::MaxFieldLimit());
             }
-            if (val.is_numeral() && (char) val.getIntNumeral() == '\0')
+            if (val.getInterval().is_numeral() && (char) val.getInterval().getIntNumeral() == '\0')
             {
                 break;
             }
@@ -1522,9 +1522,9 @@ void AbstractInterpretation::handleStrcat(const SVF::CallICFGNode *call)
         CallSite cs = SVFUtil::getSVFCallSite(call->getCallSite());
         const SVFValue* arg0Val = cs.getArgument(0);
         const SVFValue* arg1Val = cs.getArgument(1);
-        AbstractValue strLen0 = getStrlen(as, arg0Val);
-        AbstractValue strLen1 = getStrlen(as, arg1Val);
-        AbstractValue totalLen = strLen0 + strLen1;
+        IntervalValue strLen0 = getStrlen(as, arg0Val);
+        IntervalValue strLen1 = getStrlen(as, arg1Val);
+        IntervalValue totalLen = strLen0 + strLen1;
         handleMemcpy(as, arg0Val, arg1Val, strLen1, strLen0.lb().getIntNumeral());
         // do memcpy
     }
@@ -1534,9 +1534,9 @@ void AbstractInterpretation::handleStrcat(const SVF::CallICFGNode *call)
         const SVFValue* arg0Val = cs.getArgument(0);
         const SVFValue* arg1Val = cs.getArgument(1);
         const SVFValue* arg2Val = cs.getArgument(2);
-        AbstractValue arg2Num = as[_svfir->getValueNode(arg2Val)];
-        AbstractValue strLen0 = getStrlen(as, arg0Val);
-        AbstractValue totalLen = strLen0 + arg2Num;
+        IntervalValue arg2Num = as[_svfir->getValueNode(arg2Val)].getInterval();
+        IntervalValue strLen0 = getStrlen(as, arg0Val);
+        IntervalValue totalLen = strLen0 + arg2Num;
         handleMemcpy(as, arg0Val, arg1Val, arg2Num, strLen0.lb().getIntNumeral());
         // do memcpy
     }
@@ -1546,7 +1546,7 @@ void AbstractInterpretation::handleStrcat(const SVF::CallICFGNode *call)
     }
 }
 
-void AbstractInterpretation::handleMemcpy(AbstractState& as, const SVF::SVFValue *dst, const SVF::SVFValue *src, AbstractValue len,  u32_t start_idx)
+void AbstractInterpretation::handleMemcpy(AbstractState& as, const SVF::SVFValue *dst, const SVF::SVFValue *src, IntervalValue len,  u32_t start_idx)
 {
     u32_t dstId = _svfir->getValueNode(dst); // pts(dstId) = {objid}  objbar objtypeinfo->getType().
     u32_t srcId = _svfir->getValueNode(src);
@@ -1625,7 +1625,7 @@ const SVFType* AbstractInterpretation::getPointeeElement(AbstractState& as, Node
     return nullptr;
 }
 
-void AbstractInterpretation::handleMemset(AbstractState& as, const SVF::SVFValue *dst, AbstractValue elem, AbstractValue len)
+void AbstractInterpretation::handleMemset(AbstractState& as, const SVF::SVFValue *dst, IntervalValue elem, IntervalValue len)
 {
     u32_t dstId = _svfir->getValueNode(dst);
     u32_t size = std::min((u32_t)Options::MaxFieldLimit(), (u32_t) len.lb().getIntNumeral());

package/svf/lib/AE/Svfexe/BufOverflowChecker.cpp

@@ -128,7 +128,7 @@ bool BufOverflowChecker::detectStrcpy(const CallICFGNode *call)
     CallSite cs = SVFUtil::getSVFCallSite(call->getCallSite());
     const SVFValue* arg0Val = cs.getArgument(0);
     const SVFValue* arg1Val = cs.getArgument(1);
-    AbstractValue strLen = getStrlen(as, arg1Val);
+    IntervalValue strLen = getStrlen(as, arg1Val);
     // no need to -1, since it has \0 as the last byte
     return canSafelyAccessMemory(arg0Val, strLen, call);
 }
@@ -202,9 +202,9 @@ void BufOverflowChecker::initExtFunMap()
         AbstractState&as = getAbsState(callNode);
         u32_t block_count_id = _svfir->getValueNode(cs.getArgument(2));
         u32_t block_size_id = _svfir->getValueNode(cs.getArgument(1));
-        AbstractValue block_count = as[block_count_id];
-        AbstractValue block_size = as[block_size_id];
-        AbstractValue block_byte = block_count * block_size;
+        IntervalValue block_count = as[block_count_id].getInterval();
+        IntervalValue block_size = as[block_size_id].getInterval();
+        IntervalValue block_byte = block_count * block_size;
         canSafelyAccessMemory(cs.getArgument(0), block_byte, _svfir->getICFG()->getICFGNode(cs.getInstruction()));
     };
     _func_map["fread"] = sse_fread;
@@ -236,7 +236,7 @@ void BufOverflowChecker::initExtFunMap()
             return;
             // assert(false && "we cannot support this type");
         }
-        AbstractValue size = as[size_id] * IntervalValue(elemSize) - IntervalValue(1);
+        IntervalValue size = as[size_id].getInterval() * IntervalValue(elemSize) - IntervalValue(1);
         if (!as.inVarToAddrsTable(dst_id))
         {
             if (Options::BufferOverflowCheck())
@@ -273,7 +273,7 @@ void BufOverflowChecker::initExtFunMap()
 
         u32_t num = (u32_t) as[num_id].getInterval().getNumeral();
         std::string snum = std::to_string(num);
-        canSafelyAccessMemory(cs.getArgument(1), AbstractValue((s32_t)snum.size()), _svfir->getICFG()->getICFGNode(cs.getInstruction()));
+        canSafelyAccessMemory(cs.getArgument(1), IntervalValue((s32_t)snum.size()), _svfir->getICFG()->getICFGNode(cs.getInstruction()));
     };
     _func_map["itoa"] = sse_itoa;
 
@@ -285,7 +285,7 @@ void BufOverflowChecker::initExtFunMap()
         const SVFValue* strValue = cs.getArgument(0);
         const CallICFGNode* callNode = SVFUtil::dyn_cast<CallICFGNode>(_svfir->getICFG()->getICFGNode(cs.getInstruction()));
         AbstractState& as = getAbsState(callNode);
-        AbstractValue dst_size = getStrlen(as, strValue);
+        IntervalValue dst_size = getStrlen(as, strValue);
         u32_t elemSize = 1;
         if (strValue->getType()->isArrayTy())
         {
@@ -311,7 +311,7 @@ void BufOverflowChecker::initExtFunMap()
         const CallICFGNode* callNode = SVFUtil::dyn_cast<CallICFGNode>(_svfir->getICFG()->getICFGNode(cs.getInstruction()));
         AbstractState&as = getAbsState(callNode);
         u32_t len_id = _svfir->getValueNode(cs.getArgument(2));
-        AbstractValue len = as[len_id] - IntervalValue(1);
+        IntervalValue len = as[len_id].getInterval() - IntervalValue(1);
         u32_t lhsId = _svfir->getValueNode(cs.getInstruction());
         as[lhsId] = len;
         canSafelyAccessMemory(cs.getArgument(1), len, _svfir->getICFG()->getICFGNode(cs.getInstruction()));;
@@ -326,7 +326,7 @@ void BufOverflowChecker::initExtFunMap()
         if (cs.arg_size() < 2) return;
         AbstractState&as = getAbsState(callNode);
         u32_t size_id = _svfir->getValueNode(cs.getArgument(1));
-        AbstractValue val = as[size_id];
+        IntervalValue val = as[size_id].getInterval();
         if (val.isBottom())
         {
             val = IntervalValue(0);
@@ -356,7 +356,7 @@ void BufOverflowChecker::initExtFunMap()
         if (cs.arg_size() < 2) return;
         AbstractState&as = getAbsState(callNode);
         u32_t size_id = _svfir->getValueNode(cs.getArgument(1));
-        AbstractValue val = as[size_id];
+        IntervalValue val = as[size_id].getInterval();
         if (val.isBottom())
         {
             assert(false && "UNSAFE_BUFACCESS size is bottom");
@@ -400,9 +400,9 @@ bool BufOverflowChecker::detectStrcat(const CallICFGNode *call)
         CallSite cs = SVFUtil::getSVFCallSite(call->getCallSite());
         const SVFValue* arg0Val = cs.getArgument(0);
         const SVFValue* arg1Val = cs.getArgument(1);
-        AbstractValue strLen0 = getStrlen(as, arg0Val);
-        AbstractValue strLen1 = getStrlen(as, arg1Val);
-        AbstractValue totalLen = strLen0 + strLen1;
+        IntervalValue strLen0 = getStrlen(as, arg0Val);
+        IntervalValue strLen1 = getStrlen(as, arg1Val);
+        IntervalValue totalLen = strLen0 + strLen1;
         return canSafelyAccessMemory(arg0Val, totalLen, call);
     }
     else if (std::find(strncatGroup.begin(), strncatGroup.end(), fun->getName()) != strncatGroup.end())
@@ -410,9 +410,9 @@ bool BufOverflowChecker::detectStrcat(const CallICFGNode *call)
         CallSite cs = SVFUtil::getSVFCallSite(call->getCallSite());
         const SVFValue* arg0Val = cs.getArgument(0);
         const SVFValue* arg2Val = cs.getArgument(2);
-        AbstractValue arg2Num = as[_svfir->getValueNode(arg2Val)];
-        AbstractValue strLen0 = getStrlen(as, arg0Val);
-        AbstractValue totalLen = strLen0 + arg2Num;
+        IntervalValue arg2Num = as[_svfir->getValueNode(arg2Val)].getInterval();
+        IntervalValue strLen0 = getStrlen(as, arg0Val);
+        IntervalValue totalLen = strLen0 + arg2Num;
         return canSafelyAccessMemory(arg0Val, totalLen, call);
     }
     else
@@ -462,7 +462,7 @@ void BufOverflowChecker::handleExtAPI(const CallICFGNode *call)
         // loop the args and check the offset
         for (auto arg: args)
         {
-            AbstractValue offset = as[_svfir->getValueNode(cs.getArgument(arg.second))] - IntervalValue(1);
+            IntervalValue offset = as[_svfir->getValueNode(cs.getArgument(arg.second))].getInterval() - IntervalValue(1);
             canSafelyAccessMemory(cs.getArgument(arg.first), offset, call);
         }
     }
@@ -479,7 +479,7 @@ void BufOverflowChecker::handleExtAPI(const CallICFGNode *call)
         // loop the args and check the offset
         for (auto arg: args)
         {
-            AbstractValue offset = as[_svfir->getValueNode(cs.getArgument(arg.second))] - IntervalValue(1);
+            IntervalValue offset = as[_svfir->getValueNode(cs.getArgument(arg.second))].getInterval() - IntervalValue(1);
             canSafelyAccessMemory(cs.getArgument(arg.first), offset, call);
         }
     }
@@ -498,7 +498,7 @@ void BufOverflowChecker::handleExtAPI(const CallICFGNode *call)
     return;
 }
 
-bool BufOverflowChecker::canSafelyAccessMemory(const SVFValue *value, const AbstractValue &len, const ICFGNode *curNode)
+bool BufOverflowChecker::canSafelyAccessMemory(const SVFValue *value, const IntervalValue &len, const ICFGNode *curNode)
 {
     AbstractState& as = getAbsState(curNode);
     const SVFValue *firstValue = value;
@@ -514,7 +514,7 @@ bool BufOverflowChecker::canSafelyAccessMemory(const SVFValue *value, const Abst
     Set<const SVFValue *> visited;
     visited.insert(value);
     Map<const ICFGNode *, IntervalValue> gep_offsets;
-    IntervalValue total_bytes = len.getInterval();
+    IntervalValue total_bytes = len;
     worklist.push(value);
     std::vector<const CallICFGNode *> callstack = _callSiteStack;
     while (!worklist.empty())
@@ -569,7 +569,7 @@ bool BufOverflowChecker::canSafelyAccessMemory(const SVFValue *value, const Abst
                     else
                     {
                         byteOffset =
-                            _svfir2AbsState->getByteOffset(as, gep).getInterval();
+                            _svfir2AbsState->getByteOffset(as, gep);
                     }
                     // for variable offset, join with accumulate gep offset
                     gep_offsets[gep->getICFGNode()] = byteOffset;

package/svf/lib/AE/Svfexe/SVFIR2AbsState.cpp

@@ -361,19 +361,19 @@ AbstractValue SVFIR2AbsState::getGepObjAddress(AbstractState& es, u32_t pointer,
 {
     assert(!getAddrs(es, pointer).getAddrs().empty());
     AbstractValue addrs = getAddrs(es, pointer);
-    AbstractValue ret = AddressValue();
+    AddressValue ret = AddressValue();
     for (const auto &addr: addrs.getAddrs())
     {
         s64_t baseObj = getInternalID(addr);
         if (baseObj == 0)
         {
-            ret.insertAddr(getVirtualMemAddress(0));
+            ret.insert(getVirtualMemAddress(0));
             continue;
         }
         assert(SVFUtil::isa<ObjVar>(_svfir->getGNode(baseObj)) && "Fail to get the base object address!");
         NodeID gepObj = _svfir->getGepObjVar(baseObj, offset);
         initSVFVar(es, gepObj);
-        ret.insertAddr(getVirtualMemAddress(gepObj));
+        ret.insert(getVirtualMemAddress(gepObj));
     }
     return ret;
 }
@@ -400,11 +400,11 @@ AbstractValue SVFIR2AbsState::getGepObjAddress(AbstractState& es, u32_t pointer,
 *  Therefore the final byteoffset is [8+4*var1.lb(), 8+4*var1.ub()]
  *
  */
-AbstractValue SVFIR2AbsState::getByteOffset(const AbstractState& es, const GepStmt *gep)
+IntervalValue SVFIR2AbsState::getByteOffset(const AbstractState& es, const GepStmt *gep)
 {
     if (gep->isConstantOffset())
         return IntervalValue((s64_t)gep->accumulateConstantByteOffset());
-    AbstractValue res = IntervalValue(0); // Initialize the result interval 'res' to 0.
+    IntervalValue res = IntervalValue(0); // Initialize the result interval 'res' to 0.
     // Loop through the offsetVarAndGepTypePairVec in reverse order.
     for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
     {
@@ -470,11 +470,11 @@ AbstractValue SVFIR2AbsState::getByteOffset(const AbstractState& es, const GepSt
  *
  * @return      A pair of APOffset values representing the offset range.
  */
-AbstractValue SVFIR2AbsState::getElementIndex(const AbstractState& es, const GepStmt *gep)
+IntervalValue SVFIR2AbsState::getElementIndex(const AbstractState& es, const GepStmt *gep)
 {
     if (gep->isConstantOffset())
         return IntervalValue((s64_t)gep->accumulateConstantOffset());
-    AbstractValue res = IntervalValue(0);
+    IntervalValue res = IntervalValue(0);
     for (int i = gep->getOffsetVarAndGepTypePairVec().size() - 1; i >= 0; i--)
     {
         AccessPath::IdxOperandPair IdxVarAndType =
@@ -632,8 +632,8 @@ void SVFIR2AbsState::handleBinary(AbstractState& es, const BinaryOPStmt *binary)
     if (!inVarToValTable(es, op1)) es[op1] = IntervalValue::top();
     if (inVarToValTable(es, op0) && inVarToValTable(es, op1))
     {
-        AbstractValue &lhs = es[op0], &rhs = es[op1];
-        AbstractValue resVal;
+        IntervalValue &lhs = es[op0].getInterval(), &rhs = es[op1].getInterval();
+        IntervalValue resVal;
         switch (binary->getOpcode())
         {
         case BinaryOPStmt::Add:
@@ -692,8 +692,8 @@ void SVFIR2AbsState::handleCmp(AbstractState& es, const CmpStmt *cmp)
     u32_t res = cmp->getResID();
     if (inVarToValTable(es, op0) && inVarToValTable(es, op1))
     {
-        AbstractValue resVal;
-        AbstractValue &lhs = es[op0], &rhs = es[op1];
+        IntervalValue resVal;
+        IntervalValue &lhs = es[op0].getInterval(), &rhs = es[op1].getInterval();
         //AbstractValue
         auto predicate = cmp->getPredicate();
         switch (predicate)
@@ -1010,7 +1010,7 @@ void SVFIR2AbsState::handleGep(AbstractState& es, const GepStmt *gep)
     if (!inVarToAddrsTable(es, rhs)) return;
     AbstractValue &rhsVal = es[rhs];
     assert(!rhsVal.getAddrs().empty());
-    AbstractValue offsetPair = getElementIndex(es, gep);
+    IntervalValue offsetPair = getElementIndex(es, gep);
     if (!isVirtualMemAddress(*rhsVal.getAddrs().begin()))
         return;
     else

package/svf/lib/Graphs/ConsG.cpp

@@ -717,6 +717,11 @@ ConstraintNode::const_iterator ConstraintNode::directInEdgeEnd() const
 }
 //@}
 
+const std::string ConstraintNode::toString() const
+{
+    return SVFIR::getPAG()->getGNode(getId())->toString();
+}
+
 /*!
  * GraphTraits specialization for constraint graph
  */

package/svf-llvm/tools/AE/ae.cpp

@@ -111,7 +111,7 @@ public:
         // var1 := var0 + 1;
         relation[1] =
             getContext().int_const("1") == getContext().int_const("0") + 1;
-        itv[1] = itv[0] + IntervalValue(1);
+        itv[1] = itv[0].getInterval() + IntervalValue(1);
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[1], res);
@@ -145,7 +145,7 @@ public:
         // var1 := var0 + 1;
         relation[1] =
             getContext().int_const("1") == getContext().int_const("0") * 2;
-        itv[1] = itv[0] * IntervalValue(2);
+        itv[1] = itv[0].getInterval() * IntervalValue(2);
 
         // Test extract sub vars
         Set<u32_t> res;
@@ -184,7 +184,7 @@ public:
         // var2 := var1 - var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") - getContext().int_const("0");
-        itv[2] = itv[1] - itv[0];
+        itv[2] = itv[1].getInterval() - itv[0].getInterval();
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[2], res);
@@ -226,7 +226,7 @@ public:
         // var2 := var1 - var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") - getContext().int_const("0");
-        itv[2] = itv[1] - itv[0];
+        itv[2] = itv[1].getInterval() - itv[0].getInterval();
 
         // Test extract sub vars
         Set<u32_t> res;
@@ -269,7 +269,7 @@ public:
         // var2 := var1 - var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") - getContext().int_const("0");
-        itv[2] = itv[1] - itv[0];
+        itv[2] = itv[1].getInterval() - itv[0].getInterval();
 
         // Test extract sub vars
         Set<u32_t> res;
@@ -312,7 +312,7 @@ public:
         // var2 := var1 - var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") - getContext().int_const("0");
-        itv[2] = itv[1] - itv[0];
+        itv[2] = itv[1].getInterval() - itv[0].getInterval();
 
         // Test extract sub vars
         Set<u32_t> res;
@@ -355,7 +355,7 @@ public:
         // var2 := var1 - var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") - getContext().int_const("0");
-        itv[2] = itv[1] - itv[0];
+        itv[2] = itv[1].getInterval() - itv[0].getInterval();
 
         // Test extract sub vars
         Set<u32_t> res;
@@ -398,7 +398,7 @@ public:
         // var2 := var1 / var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") / getContext().int_const("0");
-        itv[2] = itv[1] / itv[0];
+        itv[2] = itv[1].getInterval() / itv[0].getInterval();
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[2], res);
@@ -440,7 +440,7 @@ public:
         // var2 := var1 / var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") / getContext().int_const("0");
-        itv[2] = itv[1] / itv[0];
+        itv[2] = itv[1].getInterval() / itv[0].getInterval();
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[2], res);
@@ -482,7 +482,7 @@ public:
         // var2 := var1 / var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") / getContext().int_const("0");
-        itv[2] = itv[1] / itv[0];
+        itv[2] = itv[1].getInterval() / itv[0].getInterval();
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[2], res);
@@ -523,7 +523,7 @@ public:
         // var2 := var1 / var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") / getContext().int_const("0");
-        itv[2] = itv[1] / itv[0];
+        itv[2] = itv[1].getInterval() / itv[0].getInterval();
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[2], res);
@@ -565,7 +565,7 @@ public:
         // var2 := var1 / var0;
         relation[2] = getContext().int_const("2") ==
                       getContext().int_const("1") / getContext().int_const("0");
-        itv[2] = itv[1] / itv[0];
+        itv[2] = itv[1].getInterval() / itv[0].getInterval();
         // Test extract sub vars
         Set<u32_t> res;
         relation.extractSubVars(relation[2], res);