svf-tools 1.0.983 → 1.0.985

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/package.json +1 -1
  2. package/svf/include/AE/Svfexe/AbstractInterpretation.h +1 -1
  3. package/svf/include/CFL/CFLAlias.h +3 -3
  4. package/svf/include/Graphs/CHG.h +13 -31
  5. package/svf/include/Graphs/ICFG.h +2 -2
  6. package/svf/include/Graphs/ICFGEdge.h +4 -16
  7. package/svf/include/Graphs/ICFGNode.h +58 -0
  8. package/svf/include/Graphs/ThreadCallGraph.h +6 -6
  9. package/svf/include/MTA/MHP.h +3 -3
  10. package/svf/include/MTA/TCT.h +1 -1
  11. package/svf/include/SVFIR/SVFFileSystem.h +0 -2
  12. package/svf/include/SVFIR/SVFValue.h +0 -131
  13. package/svf/include/Util/SVFUtil.h +20 -37
  14. package/svf/include/Util/ThreadAPI.h +5 -26
  15. package/svf/include/WPA/Andersen.h +3 -3
  16. package/svf/include/WPA/Steensgaard.h +3 -3
  17. package/svf/include/WPA/WPAPass.h +3 -3
  18. package/svf/lib/AE/Svfexe/AEDetector.cpp +14 -18
  19. package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp +66 -94
  20. package/svf/lib/CFL/CFLAlias.cpp +11 -12
  21. package/svf/lib/DDA/DDAClient.cpp +2 -2
  22. package/svf/lib/Graphs/CHG.cpp +33 -9
  23. package/svf/lib/Graphs/ICFG.cpp +13 -10
  24. package/svf/lib/MSSA/MemRegion.cpp +3 -3
  25. package/svf/lib/MTA/MHP.cpp +1 -1
  26. package/svf/lib/MemoryModel/PointerAnalysis.cpp +21 -23
  27. package/svf/lib/MemoryModel/PointerAnalysisImpl.cpp +2 -2
  28. package/svf/lib/SABER/SaberCondAllocator.cpp +1 -1
  29. package/svf/lib/SABER/SaberSVFGBuilder.cpp +1 -1
  30. package/svf/lib/SVFIR/SVFFileSystem.cpp +2 -20
  31. package/svf/lib/Util/SVFUtil.cpp +34 -18
  32. package/svf/lib/Util/ThreadAPI.cpp +32 -15
  33. package/svf/lib/WPA/Andersen.cpp +8 -9
  34. package/svf/lib/WPA/AndersenSCD.cpp +1 -2
  35. package/svf/lib/WPA/Steensgaard.cpp +8 -12
  36. package/svf/lib/WPA/TypeAnalysis.cpp +2 -3
  37. package/svf/lib/WPA/WPAPass.cpp +6 -13
  38. package/svf-llvm/include/SVF-LLVM/DCHG.h +7 -7
  39. package/svf-llvm/include/SVF-LLVM/LLVMUtil.h +0 -8
  40. package/svf-llvm/lib/CHGBuilder.cpp +4 -4
  41. package/svf-llvm/lib/DCHG.cpp +8 -7
  42. package/svf-llvm/lib/ICFGBuilder.cpp +2 -2
  43. package/svf-llvm/lib/LLVMModule.cpp +0 -2
  44. package/svf-llvm/lib/LLVMUtil.cpp +0 -58
  45. package/svf-llvm/lib/SVFIRExtAPI.cpp +2 -2
@@ -281,10 +281,9 @@ bool AndersenSCD::updateCallGraph(const PointerAnalysis::CallSiteToFunPtrMap& ca
281
281
  NodePairSet cpySrcNodes; /// nodes as a src of a generated new copy edge
282
282
  for(CallEdgeMap::iterator it = newEdges.begin(), eit = newEdges.end(); it!=eit; ++it )
283
283
  {
284
- CallSite cs = SVFUtil::getSVFCallSite(it->first);
285
284
  for(FunctionSet::iterator cit = it->second.begin(), ecit = it->second.end(); cit!=ecit; ++cit)
286
285
  {
287
- connectCaller2CalleeParams(cs,*cit,cpySrcNodes);
286
+ connectCaller2CalleeParams(it->first,*cit,cpySrcNodes);
288
287
  }
289
288
  }
290
289
 
@@ -135,12 +135,11 @@ bool Steensgaard::updateCallGraph(const CallSiteToFunPtrMap& callsites)
135
135
  for (CallEdgeMap::iterator it = newEdges.begin(), eit = newEdges.end();
136
136
  it != eit; ++it)
137
137
  {
138
- CallSite cs = SVFUtil::getSVFCallSite(it->first);
139
138
  for (FunctionSet::iterator cit = it->second.begin(),
140
139
  ecit = it->second.end();
141
140
  cit != ecit; ++cit)
142
141
  {
143
- connectCaller2CalleeParams(cs, *cit, cpySrcNodes);
142
+ connectCaller2CalleeParams(it->first, *cit, cpySrcNodes);
144
143
  }
145
144
  }
146
145
  for (NodePairSet::iterator it = cpySrcNodes.begin(),
@@ -156,11 +155,10 @@ bool Steensgaard::updateCallGraph(const CallSiteToFunPtrMap& callsites)
156
155
  return (!newEdges.empty());
157
156
  }
158
157
 
159
- void Steensgaard::heapAllocatorViaIndCall(CallSite cs, NodePairSet& cpySrcNodes)
158
+ void Steensgaard::heapAllocatorViaIndCall(const CallICFGNode* cs, NodePairSet& cpySrcNodes)
160
159
  {
161
160
  assert(SVFUtil::getCallee(cs) == nullptr && "not an indirect callsite?");
162
- RetICFGNode* retBlockNode =
163
- pag->getICFG()->getRetICFGNode(cs.getInstruction());
161
+ const RetICFGNode* retBlockNode = cs->getRetICFGNode();
164
162
  const PAGNode* cs_return = pag->getCallSiteRet(retBlockNode);
165
163
  NodeID srcret;
166
164
  CallSite2DummyValPN::const_iterator it = callsite2DummyValPN.find(cs);
@@ -171,7 +169,7 @@ void Steensgaard::heapAllocatorViaIndCall(CallSite cs, NodePairSet& cpySrcNodes)
171
169
  else
172
170
  {
173
171
  NodeID valNode = pag->addDummyValNode();
174
- NodeID objNode = pag->addDummyObjNode(cs.getType());
172
+ NodeID objNode = pag->addDummyObjNode(cs->getCallSite()->getType());
175
173
  addPts(valNode, objNode);
176
174
  callsite2DummyValPN.insert(std::make_pair(cs, valNode));
177
175
  consCG->addConstraintNode(new ConstraintNode(valNode), valNode);
@@ -187,7 +185,7 @@ void Steensgaard::heapAllocatorViaIndCall(CallSite cs, NodePairSet& cpySrcNodes)
187
185
  /*!
188
186
  * Connect formal and actual parameters for indirect callsites
189
187
  */
190
- void Steensgaard::connectCaller2CalleeParams(CallSite cs, const SVFFunction* F,
188
+ void Steensgaard::connectCaller2CalleeParams(const CallICFGNode* cs, const SVFFunction* F,
191
189
  NodePairSet& cpySrcNodes)
192
190
  {
193
191
  assert(F);
@@ -196,10 +194,8 @@ void Steensgaard::connectCaller2CalleeParams(CallSite cs, const SVFFunction* F,
196
194
  << cs.getInstruction()->toString() << " to callee "
197
195
  << *F << "\n");
198
196
 
199
- CallICFGNode* callBlockNode =
200
- pag->getICFG()->getCallICFGNode(cs.getInstruction());
201
- RetICFGNode* retBlockNode =
202
- pag->getICFG()->getRetICFGNode(cs.getInstruction());
197
+ const CallICFGNode* callBlockNode = cs;
198
+ const RetICFGNode* retBlockNode = cs->getRetICFGNode();
203
199
 
204
200
  if (SVFUtil::isHeapAllocExtFunViaRet(F) &&
205
201
  pag->callsiteHasRet(retBlockNode))
@@ -285,7 +281,7 @@ void Steensgaard::connectCaller2CalleeParams(CallSite cs, const SVFFunction* F,
285
281
  if (csArgIt != csArgEit)
286
282
  {
287
283
  writeWrnMsg("too many args to non-vararg func.");
288
- writeWrnMsg("(" + cs.getInstruction()->getSourceLoc() + ")");
284
+ writeWrnMsg("(" + cs->getSourceLoc() + ")");
289
285
  }
290
286
  }
291
287
  }
@@ -77,10 +77,9 @@ void TypeAnalysis::callGraphSolveBasedOnCHA(const CallSiteToFunPtrMap& callsites
77
77
  for(CallSiteToFunPtrMap::const_iterator iter = callsites.begin(), eiter = callsites.end(); iter!=eiter; ++iter)
78
78
  {
79
79
  const CallICFGNode* cbn = iter->first;
80
- CallSite cs = SVFUtil::getSVFCallSite(cbn);
81
- if (cs.isVirtualCall())
80
+ if (cbn->isVirtualCall())
82
81
  {
83
- const SVFValue* vtbl = cs.getVtablePtr();
82
+ const SVFValue* vtbl = cbn->getVtablePtr();
84
83
  (void)vtbl; // Suppress warning of unused variable under release build
85
84
  assert(pag->hasValueNode(vtbl));
86
85
  VFunSet vfns;
@@ -218,33 +218,26 @@ AliasResult WPAPass::alias(const SVFValue* V1, const SVFValue* V2)
218
218
  /*!
219
219
  * Return mod-ref result of a Callsite
220
220
  */
221
- ModRefInfo WPAPass::getModRefInfo(const CallSite callInst)
221
+ ModRefInfo WPAPass::getModRefInfo(const CallICFGNode* callInst)
222
222
  {
223
223
  assert(Options::PASelected(PointerAnalysis::AndersenWaveDiff_WPA) && Options::AnderSVFG() && "mod-ref query is only support with -ander and -svfg turned on");
224
- ICFG* icfg = _svfg->getPAG()->getICFG();
225
- const CallICFGNode* cbn = icfg->getCallICFGNode(callInst.getInstruction());
226
- return _svfg->getMSSA()->getMRGenerator()->getModRefInfo(cbn);
224
+ return _svfg->getMSSA()->getMRGenerator()->getModRefInfo(callInst);
227
225
  }
228
226
 
229
227
  /*!
230
228
  * Return mod-ref results of a Callsite to a specific memory location
231
229
  */
232
- ModRefInfo WPAPass::getModRefInfo(const CallSite callInst, const SVFValue* V)
230
+ ModRefInfo WPAPass::getModRefInfo(const CallICFGNode* callInst, const SVFValue* V)
233
231
  {
234
232
  assert(Options::PASelected(PointerAnalysis::AndersenWaveDiff_WPA) && Options::AnderSVFG() && "mod-ref query is only support with -ander and -svfg turned on");
235
- ICFG* icfg = _svfg->getPAG()->getICFG();
236
- const CallICFGNode* cbn = icfg->getCallICFGNode(callInst.getInstruction());
237
- return _svfg->getMSSA()->getMRGenerator()->getModRefInfo(cbn, V);
233
+ return _svfg->getMSSA()->getMRGenerator()->getModRefInfo(callInst, V);
238
234
  }
239
235
 
240
236
  /*!
241
237
  * Return mod-ref result between two CallInsts
242
238
  */
243
- ModRefInfo WPAPass::getModRefInfo(const CallSite callInst1, const CallSite callInst2)
239
+ ModRefInfo WPAPass::getModRefInfo(const CallICFGNode* callInst1, const CallICFGNode* callInst2)
244
240
  {
245
241
  assert(Options::PASelected(PointerAnalysis::AndersenWaveDiff_WPA) && Options::AnderSVFG() && "mod-ref query is only support with -ander and -svfg turned on");
246
- ICFG* icfg = _svfg->getPAG()->getICFG();
247
- const CallICFGNode* cbn1 = icfg->getCallICFGNode(callInst1.getInstruction());
248
- const CallICFGNode* cbn2 = icfg->getCallICFGNode(callInst2.getInstruction());
249
- return _svfg->getMSSA()->getMRGenerator()->getModRefInfo(cbn1, cbn2);
242
+ return _svfg->getMSSA()->getMRGenerator()->getModRefInfo(callInst1, callInst2);
250
243
  }
@@ -249,12 +249,12 @@ public:
249
249
 
250
250
  void print(void);
251
251
 
252
- virtual bool csHasVFnsBasedonCHA(CallSite cs) override
252
+ virtual bool csHasVFnsBasedonCHA(const CallICFGNode* cs) override
253
253
  {
254
254
  return csHasVtblsBasedonCHA(cs);
255
255
  }
256
256
 
257
- virtual const VFunSet &getCSVFsBasedonCHA(CallSite cs) override;
257
+ virtual const VFunSet &getCSVFsBasedonCHA(const CallICFGNode* cs) override;
258
258
 
259
259
  virtual bool csHasVtblsBasedonCHA(CallBase* cs)
260
260
  {
@@ -268,14 +268,14 @@ public:
268
268
  return getNode(type)->getVTable() != nullptr;
269
269
  }
270
270
 
271
- virtual bool csHasVtblsBasedonCHA(CallSite cs) override
271
+ virtual bool csHasVtblsBasedonCHA(const CallICFGNode* cs) override
272
272
  {
273
273
  assert(false && "not supported!");
274
274
  abort();
275
275
  }
276
276
 
277
- virtual const VTableSet &getCSVtblsBasedonCHA(CallSite cs) override;
278
- virtual void getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &virtualFunctions) override;
277
+ virtual const VTableSet &getCSVtblsBasedonCHA(const CallICFGNode* cs) override;
278
+ virtual void getVFnsFromVtbls(const SVFCallInst* cs, const VTableSet &vtbls, VFunSet &virtualFunctions) override;
279
279
 
280
280
  /// Returns true if a is a transitive base of b. firstField determines
281
281
  /// whether to consider first-field edges.
@@ -373,7 +373,7 @@ protected:
373
373
  /// Maps types to a set with their vtable and all their children's.
374
374
  Map<const DIType*, VTableSet> vtblCHAMap;
375
375
  /// Maps callsites to a set of potential virtual functions based on CHA.
376
- Map<CallSite, VFunSet> csCHAMap;
376
+ Map<const CallICFGNode*, VFunSet> csCHAMap;
377
377
  /// Maps types to their canonical type (many-to-one).
378
378
  Map<const DIType*, const DIType*> canonicalTypeMap;
379
379
  /// Set of all possible canonical types (i.e. values of canonicalTypeMap).
@@ -414,7 +414,7 @@ private:
414
414
  /// Retrieves the metadata associated with a *virtual* callsite.
415
415
  const DIType* getCSStaticType(CallBase* cs) const;
416
416
 
417
- const DIType *getCSStaticType(CallSite cs) const
417
+ const DIType *getCSStaticType(const CallICFGNode* cs) const
418
418
  {
419
419
  assert(false && "not supported!");
420
420
  abort();
@@ -287,14 +287,6 @@ inline static DataLayout* getDataLayout(Module* mod)
287
287
  return dl;
288
288
  }
289
289
 
290
- /// Get the next instructions following control flow
291
- void getNextInsts(const Instruction* curInst,
292
- std::vector<const SVFInstruction*>& instList);
293
-
294
- /// Get the previous instructions following control flow
295
- void getPrevInsts(const Instruction* curInst,
296
- std::vector<const SVFInstruction*>& instList);
297
-
298
290
  /// Get the next instructions following control flow
299
291
  void getNextInsts(const Instruction* curInst,
300
292
  std::vector<const Instruction*>& instList);
@@ -1,4 +1,4 @@
1
- //===----- CHGBuiler.cpp -- Class hierarchy graph builder ---------------------------//
1
+ //===----- CHGBuilder.cpp -- Class hierarchy graph builder ---------------------------//
2
2
  //
3
3
  // SVF: Static Value-Flow Analysis
4
4
  //
@@ -21,7 +21,7 @@
21
21
  //===----------------------------------------------------------------------===//
22
22
 
23
23
  /*
24
- * CHGBuiler.cpp
24
+ * CHGBuilder.cpp
25
25
  *
26
26
  * Created on: Jun 4, 2021
27
27
  * Author: Yulei Sui
@@ -679,10 +679,10 @@ void CHGBuilder::buildCSToCHAVtblsAndVfnsMap()
679
679
  }
680
680
  if (vtbls.size() > 0)
681
681
  {
682
- CallSite cs(LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(callInst));
682
+ const SVFInstruction* cs = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(callInst);
683
683
  chg->csToCHAVtblsMap[cs] = vtbls;
684
684
  VFunSet virtualFunctions;
685
- chg->getVFnsFromVtbls(cs, vtbls, virtualFunctions);
685
+ chg->getVFnsFromVtbls(SVFUtil::cast<SVFCallInst>(cs), vtbls, virtualFunctions);
686
686
  if (virtualFunctions.size() > 0)
687
687
  chg->csToCHAVFnsMap[cs] = virtualFunctions;
688
688
  }
@@ -544,7 +544,7 @@ void DCHGraph::buildCHG(bool extend)
544
544
  }
545
545
  }
546
546
 
547
- const VFunSet &DCHGraph::getCSVFsBasedonCHA(CallSite cs)
547
+ const VFunSet &DCHGraph::getCSVFsBasedonCHA(const CallICFGNode* cs)
548
548
  {
549
549
  if (csCHAMap.find(cs) != csCHAMap.end())
550
550
  {
@@ -553,7 +553,7 @@ const VFunSet &DCHGraph::getCSVFsBasedonCHA(CallSite cs)
553
553
 
554
554
  VFunSet vfns;
555
555
  const VTableSet &vtbls = getCSVtblsBasedonCHA(cs);
556
- getVFnsFromVtbls(cs, vtbls, vfns);
556
+ getVFnsFromVtbls(SVFUtil::cast<SVFCallInst>(cs->getCallSite()), vtbls, vfns);
557
557
 
558
558
  // Cache.
559
559
  csCHAMap.insert({cs, vfns});
@@ -561,7 +561,7 @@ const VFunSet &DCHGraph::getCSVFsBasedonCHA(CallSite cs)
561
561
  return csCHAMap[cs];
562
562
  }
563
563
 
564
- const VTableSet &DCHGraph::getCSVtblsBasedonCHA(CallSite cs)
564
+ const VTableSet &DCHGraph::getCSVtblsBasedonCHA(const CallICFGNode* cs)
565
565
  {
566
566
  const DIType *type = getCanonicalType(getCSStaticType(cs));
567
567
  // Check if we've already computed.
@@ -589,10 +589,11 @@ const VTableSet &DCHGraph::getCSVtblsBasedonCHA(CallSite cs)
589
589
  return vtblCHAMap[type];
590
590
  }
591
591
 
592
- void DCHGraph::getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &virtualFunctions)
592
+ void DCHGraph::getVFnsFromVtbls(const SVFCallInst* callsite, const VTableSet &vtbls, VFunSet &virtualFunctions)
593
593
  {
594
- size_t idx = cs.getFunIdxInVtable();
595
- std::string funName = cs.getFunNameOfVirtualCall();
594
+ const SVFVirtualCallInst* cs = SVFUtil::cast<SVFVirtualCallInst>(callsite);
595
+ size_t idx = cs->getFunIdxInVtable();
596
+ std::string funName = cs->getFunNameOfVirtualCall();
596
597
  for (const SVFGlobalValue *vtbl : vtbls)
597
598
  {
598
599
  assert(vtblToTypeMap.find(vtbl) != vtblToTypeMap.end() && "floating vtbl");
@@ -610,7 +611,7 @@ void DCHGraph::getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &vi
610
611
 
611
612
  const Function* callee = vfnV[idx];
612
613
  // Practically a copy of that in lib/MemoryModel/CHA.cpp
613
- if (cs.arg_size() == callee->arg_size() || (cs.isVarArg() && callee->isVarArg()))
614
+ if (cs->arg_size() == callee->arg_size() || (cs->isVarArg() && callee->isVarArg()))
614
615
  {
615
616
  cppUtil::DemangledName dname = cppUtil::demangle(callee->getName().str());
616
617
  std::string calleeName = dname.funcName;
@@ -258,8 +258,8 @@ void ICFGBuilder::addICFGInterEdges(const SVFInstruction* cs, const SVFFunction*
258
258
  {
259
259
  FunEntryICFGNode* calleeEntryNode = icfg->getFunEntryICFGNode(callee);
260
260
  FunExitICFGNode* calleeExitNode = icfg->getFunExitICFGNode(callee);
261
- icfg->addCallEdge(callICFGNode, calleeEntryNode, cs);
262
- icfg->addRetEdge(calleeExitNode, retBlockNode, cs);
261
+ icfg->addCallEdge(callICFGNode, calleeEntryNode);
262
+ icfg->addRetEdge(calleeExitNode, retBlockNode);
263
263
  }
264
264
  }
265
265
  /// indirect call (don't know callee)
@@ -373,8 +373,6 @@ void LLVMModuleSet::initSVFBasicBlock(const Function* func)
373
373
  svfcall->addArgument(svfval);
374
374
  }
375
375
  }
376
- LLVMUtil::getNextInsts(inst, getSVFInstruction(inst)->getSuccInstructions());
377
- LLVMUtil::getPrevInsts(inst, getSVFInstruction(inst)->getPredInstructions());
378
376
  }
379
377
  }
380
378
  // For no return functions, we set the last block as exit BB
@@ -297,64 +297,6 @@ const Value* LLVMUtil::stripAllCasts(const Value* val)
297
297
  return nullptr;
298
298
  }
299
299
 
300
- /// Get the next instructions following control flow
301
- void LLVMUtil::getNextInsts(const Instruction* curInst, std::vector<const SVFInstruction*>& instList)
302
- {
303
- if (!curInst->isTerminator())
304
- {
305
- const Instruction* nextInst = curInst->getNextNode();
306
- const SVFInstruction* svfNextInst = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(nextInst);
307
- if (LLVMUtil::isIntrinsicInst(nextInst))
308
- getNextInsts(nextInst, instList);
309
- else
310
- instList.push_back(svfNextInst);
311
- }
312
- else
313
- {
314
- const BasicBlock* BB = curInst->getParent();
315
- // Visit all successors of BB in the CFG
316
- for (succ_const_iterator it = succ_begin(BB), ie = succ_end(BB); it != ie; ++it)
317
- {
318
- const Instruction* nextInst = &((*it)->front());
319
- const SVFInstruction* svfNextInst = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(nextInst);
320
- if (LLVMUtil::isIntrinsicInst(nextInst))
321
- getNextInsts(nextInst, instList);
322
- else
323
- instList.push_back(svfNextInst);
324
- }
325
- }
326
- }
327
-
328
-
329
- /// Get the previous instructions following control flow
330
- void LLVMUtil::getPrevInsts(const Instruction* curInst, std::vector<const SVFInstruction*>& instList)
331
- {
332
-
333
- if (curInst != &(curInst->getParent()->front()))
334
- {
335
- const Instruction* prevInst = curInst->getPrevNode();
336
- const SVFInstruction* svfPrevInst = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(prevInst);
337
- if (LLVMUtil::isIntrinsicInst(prevInst))
338
- getPrevInsts(prevInst, instList);
339
- else
340
- instList.push_back(svfPrevInst);
341
- }
342
- else
343
- {
344
- const BasicBlock* BB = curInst->getParent();
345
- // Visit all successors of BB in the CFG
346
- for (const_pred_iterator it = pred_begin(BB), ie = pred_end(BB); it != ie; ++it)
347
- {
348
- const Instruction* prevInst = &((*it)->back());
349
- const SVFInstruction* svfPrevInst = LLVMModuleSet::getLLVMModuleSet()->getSVFInstruction(prevInst);
350
- if (LLVMUtil::isIntrinsicInst(prevInst))
351
- getPrevInsts(prevInst, instList);
352
- else
353
- instList.push_back(svfPrevInst);
354
- }
355
- }
356
- }
357
-
358
300
  /*
359
301
  * Get the first dominated cast instruction for heap allocations since they typically come from void* (i8*)
360
302
  * for example, %4 = call align 16 i8* @malloc(i64 10); %5 = bitcast i8* %4 to i32*
@@ -127,13 +127,13 @@ void SVFIRBuilder::handleExtCall(const CallBase* cs, const SVFFunction* svfCalle
127
127
  const SVFCallInst* svfCall = SVFUtil::cast<SVFCallInst>(svfInst);
128
128
  const CallICFGNode *callICFGNode = pag->getICFG()->getCallICFGNode(svfInst);
129
129
 
130
- if (isHeapAllocExtCallViaRet(svfCall))
130
+ if (isHeapAllocExtCallViaRet(callICFGNode))
131
131
  {
132
132
  NodeID val = pag->getValueNode(svfInst);
133
133
  NodeID obj = pag->getObjectNode(svfInst);
134
134
  addAddrWithHeapSz(obj, val, cs);
135
135
  }
136
- else if (isHeapAllocExtCallViaArg(svfCall))
136
+ else if (isHeapAllocExtCallViaArg(callICFGNode))
137
137
  {
138
138
  u32_t arg_pos = getHeapAllocHoldingArgPosition(svfCallee);
139
139
  const SVFValue* arg = svfCall->getArgOperand(arg_pos);