svf-tools 1.0.962 → 1.0.964

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.962",
+  "version": "1.0.964",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/AE/Core/AbstractState.h

@@ -39,6 +39,9 @@
  *         \    \        \        /      /
  *                          ⊥
  */
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 
 #ifndef Z3_EXAMPLE_INTERVAL_DOMAIN_H
 #define Z3_EXAMPLE_INTERVAL_DOMAIN_H

package/svf/include/AE/Core/AbstractValue.h

@@ -20,6 +20,10 @@
 //
 //===----------------------------------------------------------------------===//
 
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
+
 #include "AE/Core/IntervalValue.h"
 #include "AE/Core/AddressValue.h"
 #include "Util/SVFUtil.h"

package/svf/include/AE/Core/IntervalValue.h

@@ -26,7 +26,9 @@
  *      Author: Jiawei Wang, Xiao Cheng
  *
  */
-
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 
 #ifndef Z3_EXAMPLE_IntervalValue_H
 #define Z3_EXAMPLE_IntervalValue_H

package/svf/include/AE/Core/NumericValue.h

@@ -26,6 +26,9 @@
  *      Author: Xiao Cheng, Jiawei Ren
  *
  */
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 
 #ifndef SVF_NUMERICVALUE_H
 #define SVF_NUMERICVALUE_H

package/svf/include/AE/Svfexe/AbstractInterpretation.h

@@ -18,14 +18,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 //
-// The implementation is based on
-// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
-// 46th International Conference on Software Engineering. (ICSE24)
 //===----------------------------------------------------------------------===//
 
 
 //
 // Created by Jiawei Wang on 2024/1/10.
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 //
 
 #include "AE/Core/ICFGWTO.h"

package/svf/include/AE/Svfexe/BufOverflowChecker.h

@@ -18,14 +18,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 //
-// The implementation is based on
-// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
-// 46th International Conference on Software Engineering. (ICSE24)
 //===----------------------------------------------------------------------===//
 
 
 //
 // Created by Jiawei Wang on 2024/1/12.
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 //
 
 #include "AE/Svfexe/AbstractInterpretation.h"

package/svf/include/AE/Svfexe/ICFGSimplification.h

@@ -18,15 +18,15 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 //
-// The implementation is based on
-// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
-// 46th International Conference on Software Engineering. (ICSE24)
 //===----------------------------------------------------------------------===//
 
 
 //
 // Created by Jiawei Wang on 2024/2/25.
 //
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 #include "AE/Svfexe/SVFIR2AbsState.h"
 #include "Graphs/ICFG.h"
 

package/svf/include/AE/Svfexe/SVFIR2AbsState.h

@@ -18,9 +18,6 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 //
-// The implementation is based on
-// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
-// 46th International Conference on Software Engineering. (ICSE24)
 //===----------------------------------------------------------------------===//
 /*
  * SVFIR2AbsState.h
@@ -29,6 +26,9 @@
  *      Author: Jiawei Wang, Xiao Cheng
  *
  */
+// The implementation is based on
+// Xiao Cheng, Jiawei Wang and Yulei Sui. Precise Sparse Abstract Execution via Cross-Domain Interaction.
+// 46th International Conference on Software Engineering. (ICSE24)
 
 #ifndef Z3_EXAMPLE_SVFIR2ITVEXESTATE_H
 #define Z3_EXAMPLE_SVFIR2ITVEXESTATE_H

package/svf-llvm/lib/ObjTypeInference.cpp

@@ -161,271 +161,325 @@ const Type *ObjTypeInference::inferObjType(const Value *var)
  */
 const Type *ObjTypeInference::fwInferObjType(const Value *var)
 {
-    // consult cache
-    auto tIt = _valueToType.find(var);
-    if (tIt != _valueToType.end())
+    if (const AllocaInst *allocaInst = SVFUtil::dyn_cast<AllocaInst>(var))
     {
-        return tIt->second ? tIt->second : defaultType(var);
+        // stack object
+        return infersiteToType(allocaInst);
     }
-
-    // simulate the call stack, the second element indicates whether we should update valueTypes for current value
-    FILOWorkList<ValueBoolPair> workList;
-    Set<ValueBoolPair> visited;
-    workList.push({var, false});
-
-    while (!workList.empty())
+    else if (const GlobalValue *global = SVFUtil::dyn_cast<GlobalValue>(var))
     {
-        auto curPair = workList.pop();
-        if (visited.count(curPair)) continue;
-        visited.insert(curPair);
-        const Value *curValue = curPair.first;
-        bool canUpdate = curPair.second;
-        Set<const Value *> infersites;
+        // global object
+        return infersiteToType(global);
+    }
+    else
+    {
+        // for heap or static object, we forward infer its type
 
-        auto insertInferSite = [&infersites, &canUpdate](const Value *infersite)
+        // consult cache
+        auto tIt = _valueToType.find(var);
+        if (tIt != _valueToType.end())
         {
-            if (canUpdate) infersites.insert(infersite);
-        };
-        auto insertInferSitesOrPushWorklist = [this, &infersites, &workList, &canUpdate](const auto &pUser)
+            return tIt->second ? tIt->second : defaultType(var);
+        }
+
+        // simulate the call stack, the second element indicates whether we should update valueTypes for current value
+        FILOWorkList<ValueBoolPair> workList;
+        Set<ValueBoolPair> visited;
+        workList.push({var, false});
+
+        while (!workList.empty())
         {
-            auto vIt = _valueToInferSites.find(pUser);
-            if (canUpdate)
+            auto curPair = workList.pop();
+            if (visited.count(curPair))
+                continue;
+            visited.insert(curPair);
+            const Value* curValue = curPair.first;
+            bool canUpdate = curPair.second;
+            Set<const Value*> infersites;
+
+            auto insertInferSite = [&infersites,
+                                    &canUpdate](const Value* infersite)
             {
-                if (vIt != _valueToInferSites.end())
+                if (canUpdate)
+                    infersites.insert(infersite);
+            };
+            auto insertInferSitesOrPushWorklist =
+                [this, &infersites, &workList, &canUpdate](const auto& pUser)
+            {
+                auto vIt = _valueToInferSites.find(pUser);
+                if (canUpdate)
                 {
-                    infersites.insert(vIt->second.begin(), vIt->second.end());
+                    if (vIt != _valueToInferSites.end())
+                    {
+                        infersites.insert(vIt->second.begin(),
+                                          vIt->second.end());
+                    }
                 }
-            }
-            else
-            {
-                if (vIt == _valueToInferSites.end()) workList.push({pUser, false});
-            }
-        };
-        if (!canUpdate && !_valueToInferSites.count(curValue))
-        {
-            workList.push({curValue, true});
-        }
-        if (const auto *gepInst = SVFUtil::dyn_cast<GetElementPtrInst>(curValue))
-            insertInferSite(gepInst);
-        for (const auto it: curValue->users())
-        {
-            if (const auto *loadInst = SVFUtil::dyn_cast<LoadInst>(it))
+                else
+                {
+                    if (vIt == _valueToInferSites.end())
+                        workList.push({pUser, false});
+                }
+            };
+            if (!canUpdate && !_valueToInferSites.count(curValue))
             {
-                /*
-                 * infer based on load, e.g.,
-                 %call = call i8* malloc()
-                 %1 = bitcast i8* %call to %struct.MyStruct*
-                 %q = load %struct.MyStruct, %struct.MyStruct* %1
-                 */
-                insertInferSite(loadInst);
+                workList.push({curValue, true});
             }
-            else if (const auto *storeInst = SVFUtil::dyn_cast<StoreInst>(it))
+            if (const auto* gepInst =
+                        SVFUtil::dyn_cast<GetElementPtrInst>(curValue))
+                insertInferSite(gepInst);
+            for (const auto it : curValue->users())
             {
-                if (storeInst->getPointerOperand() == curValue)
+                if (const auto* loadInst = SVFUtil::dyn_cast<LoadInst>(it))
                 {
                     /*
-                     * infer based on store (pointer operand), e.g.,
+                     * infer based on load, e.g.,
                      %call = call i8* malloc()
                      %1 = bitcast i8* %call to %struct.MyStruct*
-                     store %struct.MyStruct .., %struct.MyStruct* %1
+                     %q = load %struct.MyStruct, %struct.MyStruct* %1
                      */
-                    insertInferSite(storeInst);
+                    insertInferSite(loadInst);
                 }
-                else
+                else if (const auto* storeInst =
+                             SVFUtil::dyn_cast<StoreInst>(it))
                 {
-                    for (const auto nit: storeInst->getPointerOperand()->users())
+                    if (storeInst->getPointerOperand() == curValue)
                     {
                         /*
-                         * propagate across store (value operand) and load
+                         * infer based on store (pointer operand), e.g.,
                          %call = call i8* malloc()
-                         store i8* %call, i8** %p
-                         %q = load i8*, i8** %p
-                         ..infer based on %q..
-                        */
-                        if (SVFUtil::isa<LoadInst>(nit))
-                            insertInferSitesOrPushWorklist(nit);
+                         %1 = bitcast i8* %call to %struct.MyStruct*
+                         store %struct.MyStruct .., %struct.MyStruct* %1
+                         */
+                        insertInferSite(storeInst);
                     }
-                    /*
-                     * infer based on store (value operand) <- gep (result element)
-                      */
-                    if (const auto *gepInst = SVFUtil::dyn_cast<GetElementPtrInst>(
-                                                  storeInst->getPointerOperand()))
+                    else
                     {
+                        for (const auto nit :
+                                storeInst->getPointerOperand()->users())
+                        {
+                            /*
+                             * propagate across store (value operand) and load
+                             %call = call i8* malloc()
+                             store i8* %call, i8** %p
+                             %q = load i8*, i8** %p
+                             ..infer based on %q..
+                            */
+                            if (SVFUtil::isa<LoadInst>(nit))
+                                insertInferSitesOrPushWorklist(nit);
+                        }
                         /*
-                          %call1 = call i8* @TYPE_MALLOC(i32 noundef 16, i32 noundef 2), !dbg !39
-                          %2 = bitcast i8* %call1 to %struct.MyStruct*, !dbg !41
-                          %3 = load %struct.MyStruct*, %struct.MyStruct** %p, align 8, !dbg !42
-                          %next = getelementptr inbounds %struct.MyStruct, %struct.MyStruct* %3, i32 0, i32 1, !dbg !43
-                          store %struct.MyStruct* %2, %struct.MyStruct** %next, align 8, !dbg !44
-                          %5 = load %struct.MyStruct*, %struct.MyStruct** %p, align 8, !dbg !48
-                          %next3 = getelementptr inbounds %struct.MyStruct, %struct.MyStruct* %5, i32 0, i32 1, !dbg !49
-                          %6 = load %struct.MyStruct*, %struct.MyStruct** %next3, align 8, !dbg !49
-                          infer site -> %f1 = getelementptr inbounds %struct.MyStruct, %struct.MyStruct* %6, i32 0, i32 0, !dbg !50
+                        * infer based on store (value operand) <- gep (result element)
                          */
-                        const Value *gepBase = gepInst->getPointerOperand();
-                        if(const auto *load = SVFUtil::dyn_cast<LoadInst>(gepBase))
+                        if (const auto* gepInst =
+                                    SVFUtil::dyn_cast<GetElementPtrInst>(
+                                        storeInst->getPointerOperand()))
                         {
-                            for (const auto loadUse: load->getPointerOperand()->users())
+                            /*
+                              %call1 = call i8* @TYPE_MALLOC(i32 noundef 16, i32
+                              noundef 2), !dbg !39 %2 = bitcast i8* %call1 to
+                              %struct.MyStruct*, !dbg !41 %3 = load
+                              %struct.MyStruct*, %struct.MyStruct** %p, align 8,
+                              !dbg !42 %next = getelementptr inbounds
+                              %struct.MyStruct, %struct.MyStruct* %3, i32 0, i32
+                              1, !dbg !43 store %struct.MyStruct* %2,
+                              %struct.MyStruct** %next, align 8, !dbg !44 %5 =
+                              load %struct.MyStruct*, %struct.MyStruct** %p,
+                              align 8, !dbg !48 %next3 = getelementptr inbounds
+                              %struct.MyStruct, %struct.MyStruct* %5, i32 0, i32
+                              1, !dbg !49 %6 = load %struct.MyStruct*,
+                              %struct.MyStruct** %next3, align 8, !dbg !49 infer
+                              site -> %f1 = getelementptr inbounds
+                              %struct.MyStruct, %struct.MyStruct* %6, i32 0, i32
+                              0, !dbg !50
+                             */
+                            const Value* gepBase = gepInst->getPointerOperand();
+                            if (const auto* load =
+                                        SVFUtil::dyn_cast<LoadInst>(gepBase))
                             {
-                                if (loadUse == load || !SVFUtil::isa<LoadInst>(loadUse))
-                                    continue;
-                                for (const auto gepUse: loadUse->users())
+                                for (const auto loadUse :
+                                        load->getPointerOperand()->users())
                                 {
-                                    if (!SVFUtil::isa<GetElementPtrInst>(gepUse)) continue;
-                                    for (const auto loadUse2: gepUse->users())
+                                    if (loadUse == load ||
+                                            !SVFUtil::isa<LoadInst>(loadUse))
+                                        continue;
+                                    for (const auto gepUse : loadUse->users())
                                     {
-                                        if (SVFUtil::isa<LoadInst>(loadUse2))
+                                        if (!SVFUtil::isa<GetElementPtrInst>(
+                                                    gepUse))
+                                            continue;
+                                        for (const auto loadUse2 :
+                                                gepUse->users())
                                         {
-                                            insertInferSitesOrPushWorklist(loadUse2);
+                                            if (SVFUtil::isa<LoadInst>(
+                                                        loadUse2))
+                                            {
+                                                insertInferSitesOrPushWorklist(
+                                                    loadUse2);
+                                            }
                                         }
                                     }
                                 }
                             }
-                        }
-                        else if (const auto *alloc = SVFUtil::dyn_cast<AllocaInst>(gepBase))
-                        {
-                            /*
-                              %2 = alloca %struct.ll, align 8
-                              store i32 0, ptr %1, align 4
-                              %3 = call noalias noundef nonnull ptr @_Znwm(i64 noundef 16) #2
-                              %4 = getelementptr inbounds %struct.ll, ptr %2, i32 0, i32 1
-                              store ptr %3, ptr %4, align 8
-                              %5 = getelementptr inbounds %struct.ll, ptr %2, i32 0, i32 1
-                              %6 = load ptr, ptr %5, align 8
-                              %7 = getelementptr inbounds %struct.ll, ptr %6, i32 0, i32 0
-                             */
-                            for (const auto gepUse: alloc->users())
+                            else if (const auto* alloc =
+                                         SVFUtil::dyn_cast<AllocaInst>(gepBase))
                             {
-                                if (!SVFUtil::isa<GetElementPtrInst>(gepUse)) continue;
-                                for (const auto loadUse2: gepUse->users())
+                                /*
+                                  %2 = alloca %struct.ll, align 8
+                                  store i32 0, ptr %1, align 4
+                                  %3 = call noalias noundef nonnull ptr
+                                  @_Znwm(i64 noundef 16) #2 %4 = getelementptr
+                                  inbounds %struct.ll, ptr %2, i32 0, i32 1
+                                  store ptr %3, ptr %4, align 8
+                                  %5 = getelementptr inbounds %struct.ll, ptr
+                                  %2, i32 0, i32 1 %6 = load ptr, ptr %5, align
+                                  8 %7 = getelementptr inbounds %struct.ll, ptr
+                                  %6, i32 0, i32 0
+                                 */
+                                for (const auto gepUse : alloc->users())
                                 {
-                                    if (SVFUtil::isa<LoadInst>(loadUse2))
+                                    if (!SVFUtil::isa<GetElementPtrInst>(
+                                                gepUse))
+                                        continue;
+                                    for (const auto loadUse2 : gepUse->users())
                                     {
-                                        insertInferSitesOrPushWorklist(loadUse2);
+                                        if (SVFUtil::isa<LoadInst>(loadUse2))
+                                        {
+                                            insertInferSitesOrPushWorklist(
+                                                loadUse2);
+                                        }
                                     }
                                 }
                             }
                         }
                     }
                 }
-
-            }
-            else if (const auto *gepInst = SVFUtil::dyn_cast<GetElementPtrInst>(it))
-            {
-                /*
-                 * infer based on gep (pointer operand)
-                 %call = call i8* malloc()
-                 %1 = bitcast i8* %call to %struct.MyStruct*
-                 %next = getelementptr inbounds %struct.MyStruct, %struct.MyStruct* %1, i32 0..
-                 */
-                if (gepInst->getPointerOperand() == curValue)
-                    insertInferSite(gepInst);
-            }
-            else if (const auto *bitcast = SVFUtil::dyn_cast<BitCastInst>(it))
-            {
-                // continue on bitcast
-                insertInferSitesOrPushWorklist(bitcast);
-            }
-            else if (const auto *phiNode = SVFUtil::dyn_cast<PHINode>(it))
-            {
-                // continue on bitcast
-                insertInferSitesOrPushWorklist(phiNode);
-            }
-            else if (const auto *retInst = SVFUtil::dyn_cast<ReturnInst>(it))
-            {
-                /*
-                 * propagate from return to caller
-                  Function Attrs: noinline nounwind optnone uwtable
-                  define dso_local i8* @malloc_wrapper() #0 !dbg !22 {
-                      entry:
-                      %call = call i8* @malloc(i32 noundef 16), !dbg !25
-                      ret i8* %call, !dbg !26
-                 }
-                 %call = call i8* @malloc_wrapper()
-                 ..infer based on %call..
-                */
-                for (const auto callsite: retInst->getFunction()->users())
+                else if (const auto* gepInst =
+                             SVFUtil::dyn_cast<GetElementPtrInst>(it))
                 {
-                    if (const auto *callBase = SVFUtil::dyn_cast<CallBase>(callsite))
+                    /*
+                     * infer based on gep (pointer operand)
+                     %call = call i8* malloc()
+                     %1 = bitcast i8* %call to %struct.MyStruct*
+                     %next = getelementptr inbounds %struct.MyStruct,
+                     %struct.MyStruct* %1, i32 0..
+                     */
+                    if (gepInst->getPointerOperand() == curValue)
+                        insertInferSite(gepInst);
+                }
+                else if (const auto* bitcast =
+                             SVFUtil::dyn_cast<BitCastInst>(it))
+                {
+                    // continue on bitcast
+                    insertInferSitesOrPushWorklist(bitcast);
+                }
+                else if (const auto* phiNode = SVFUtil::dyn_cast<PHINode>(it))
+                {
+                    // continue on bitcast
+                    insertInferSitesOrPushWorklist(phiNode);
+                }
+                else if (const auto* retInst =
+                             SVFUtil::dyn_cast<ReturnInst>(it))
+                {
+                    /*
+                     * propagate from return to caller
+                      Function Attrs: noinline nounwind optnone uwtable
+                      define dso_local i8* @malloc_wrapper() #0 !dbg !22 {
+                          entry:
+                          %call = call i8* @malloc(i32 noundef 16), !dbg !25
+                          ret i8* %call, !dbg !26
+                     }
+                     %call = call i8* @malloc_wrapper()
+                     ..infer based on %call..
+                    */
+                    for (const auto callsite : retInst->getFunction()->users())
                     {
-                        // skip function as parameter
-                        // e.g., call void @foo(%struct.ssl_ctx_st* %9, i32 (i8*, i32, i32, i8*)* @passwd_callback)
-                        if (callBase->getCalledFunction() != retInst->getFunction()) continue;
-                        insertInferSitesOrPushWorklist(callBase);
+                        if (const auto* callBase =
+                                    SVFUtil::dyn_cast<CallBase>(callsite))
+                        {
+                            // skip function as parameter
+                            // e.g., call void @foo(%struct.ssl_ctx_st* %9, i32 (i8*, i32, i32, i8*)* @passwd_callback)
+                            if (callBase->getCalledFunction() !=
+                                    retInst->getFunction())
+                                continue;
+                            insertInferSitesOrPushWorklist(callBase);
+                        }
                     }
                 }
-            }
-            else if (const auto *callBase = SVFUtil::dyn_cast<CallBase>(it))
-            {
-                /*
-                 * propagate from callsite to callee
-                  %call = call i8* @malloc(i32 noundef 16)
-                  %0 = bitcast i8* %call to %struct.Node*, !dbg !43
-                  call void @foo(%struct.Node* noundef %0), !dbg !45
-
-                  define dso_local void @foo(%struct.Node* noundef %param) #0 !dbg !22 {...}
-                  ..infer based on the formal param %param..
-                 */
-                // skip global function value -> callsite
-                // e.g., def @foo() -> call @foo()
-                // we don't skip function as parameter, e.g., def @foo() -> call @bar(..., @foo)
-                if (SVFUtil::isa<Function>(curValue) && curValue == callBase->getCalledFunction()) continue;
-                // skip indirect call
-                // e.g., %0 = ... -> call %0(...)
-                if (!callBase->hasArgument(curValue)) continue;
-                if (Function *calleeFunc = callBase->getCalledFunction())
+                else if (const auto* callBase = SVFUtil::dyn_cast<CallBase>(it))
                 {
-                    u32_t pos = getArgPosInCall(callBase, curValue);
-                    // for varargs function, we cannot directly get the value-flow between actual and formal args
-                    // e.g., consider the following vararg function @callee
-                    // 1: call void @callee(%arg)
-                    // 2: define dso_local i32 @callee(...) #0 !dbg !17 {
-                    // 3:  .......
-                    // 4:  %5 = load i32, ptr %vaarg.addr, align 4, !dbg !55
-                    // 5:  .......
-                    // 6: }
-                    // it is challenging to precisely identify the forward value-flow of %arg (Line 2)
-                    // because the function definition of callee (Line 2) does not have any formal args related to the actual arg %arg
-                    // therefore we track all possible instructions like ``load i32, ptr %vaarg.addr''
-                    if (calleeFunc->isVarArg())
+                    /*
+                     * propagate from callsite to callee
+                      %call = call i8* @malloc(i32 noundef 16)
+                      %0 = bitcast i8* %call to %struct.Node*, !dbg !43
+                      call void @foo(%struct.Node* noundef %0), !dbg !45
+
+                      define dso_local void @foo(%struct.Node* noundef %param)
+                     #0 !dbg !22 {...}
+                      ..infer based on the formal param %param..
+                     */
+                    // skip global function value -> callsite
+                    // e.g., def @foo() -> call @foo()
+                    // we don't skip function as parameter, e.g., def @foo() -> call @bar(..., @foo)
+                    if (SVFUtil::isa<Function>(curValue) &&
+                            curValue == callBase->getCalledFunction())
+                        continue;
+                    // skip indirect call
+                    // e.g., %0 = ... -> call %0(...)
+                    if (!callBase->hasArgument(curValue))
+                        continue;
+                    if (Function* calleeFunc = callBase->getCalledFunction())
                     {
-                        // conservatively track all var args
-                        for (auto &I: instructions(calleeFunc))
+                        u32_t pos = getArgPosInCall(callBase, curValue);
+                        // for varargs function, we cannot directly get the value-flow between actual and formal args e.g., consider the following vararg function @callee 1: call void @callee(%arg) 2: define dso_local i32 @callee(...) #0 !dbg !17 { 3:  ....... 4:  %5 = load i32, ptr %vaarg.addr, align 4, !dbg !55 5:  .......
+                        // 6: }
+                        // it is challenging to precisely identify the forward value-flow of %arg (Line 2) because the function definition of callee (Line 2) does not have any formal args related to the actual arg %arg therefore we track all possible instructions like ``load i32, ptr %vaarg.addr''
+                        if (calleeFunc->isVarArg())
                         {
-                            if (auto *load = llvm::dyn_cast<llvm::LoadInst>(&I))
+                            // conservatively track all var args
+                            for (auto& I : instructions(calleeFunc))
                             {
-                                llvm::Value* loadPointer = load->getPointerOperand();
-                                if (loadPointer->getName().compare("vaarg.addr") == 0)
+                                if (auto* load =
+                                            llvm::dyn_cast<llvm::LoadInst>(&I))
                                 {
-                                    insertInferSitesOrPushWorklist(load);
+                                    llvm::Value* loadPointer =
+                                        load->getPointerOperand();
+                                    if (loadPointer->getName().compare(
+                                                "vaarg.addr") == 0)
+                                    {
+                                        insertInferSitesOrPushWorklist(load);
+                                    }
                                 }
                             }
                         }
-                    }
-                    else if (!calleeFunc->isDeclaration())
-                    {
-                        insertInferSitesOrPushWorklist(calleeFunc->getArg(pos));
+                        else if (!calleeFunc->isDeclaration())
+                        {
+                            insertInferSitesOrPushWorklist(
+                                calleeFunc->getArg(pos));
+                        }
                     }
                 }
             }
+            if (canUpdate)
+            {
+                Set<const Type*> types;
+                std::transform(infersites.begin(), infersites.end(),
+                               std::inserter(types, types.begin()),
+                               infersiteToType);
+                _valueToInferSites[curValue] = SVFUtil::move(infersites);
+                _valueToType[curValue] = selectLargestSizedType(types);
+            }
         }
-        if (canUpdate)
+        const Type* type = _valueToType[var];
+        if (type == nullptr)
         {
-            Set<const Type *> types;
-            std::transform(infersites.begin(), infersites.end(), std::inserter(types, types.begin()),
-                           infersiteToType);
-            _valueToInferSites[curValue] = SVFUtil::move(infersites);
-            _valueToType[curValue] = selectLargestSizedType(types);
+            type = defaultType(var);
+            WARN_MSG("Using default type, trace ID is " +
+                     std::to_string(traceId) + ":" + dumpValueAndDbgInfo(var));
         }
+        ABORT_IFNOT(type, "type cannot be a null ptr");
+        return type;
     }
-    const Type *type = _valueToType[var];
-    if (type == nullptr)
-    {
-        type = defaultType(var);
-        WARN_MSG("Using default type, trace ID is " + std::to_string(traceId) + ":" + dumpValueAndDbgInfo(var));
-    }
-    ABORT_IFNOT(type, "type cannot be a null ptr");
-    return type;
 }
 
 /*!