svf-tools 1.0.984 → 1.0.985

package/svf/include/WPA/Andersen.h

@@ -171,7 +171,7 @@ class Andersen:  public AndersenBase
 
 public:
     typedef SCCDetection<ConstraintGraph*> CGSCC;
-    typedef OrderedMap<CallSite, NodeID> CallSite2DummyValPN;
+    typedef OrderedMap<const CallICFGNode*, NodeID> CallSite2DummyValPN;
 
     /// Constructor
     Andersen(SVFIR* _pag, PTATY type = Andersen_WPA, bool alias_check = true)
@@ -243,7 +243,7 @@ public:
 protected:
 
     CallSite2DummyValPN callsite2DummyValPN;        ///< Map an instruction to a dummy obj which created at an indirect callsite, which invokes a heap allocator
-    void heapAllocatorViaIndCall(CallSite cs,NodePairSet &cpySrcNodes);
+    void heapAllocatorViaIndCall(const CallICFGNode* cs,NodePairSet &cpySrcNodes);
 
     /// Handle diff points-to set.
     virtual inline void computeDiffPts(NodeID id)
@@ -315,7 +315,7 @@ protected:
     virtual bool updateCallGraph(const CallSiteToFunPtrMap& callsites);
 
     /// Connect formal and actual parameters for indirect callsites
-    void connectCaller2CalleeParams(CallSite cs, const SVFFunction* F, NodePairSet& cpySrcNodes);
+    void connectCaller2CalleeParams(const CallICFGNode* cs, const SVFFunction* F, NodePairSet& cpySrcNodes);
 
     /// Merge sub node to its rep
     virtual void mergeNodeToRep(NodeID nodeId,NodeID newRepId);

package/svf/include/WPA/Steensgaard.h

@@ -23,7 +23,7 @@ class Steensgaard : public AndersenBase
 public:
     typedef Map<NodeID, NodeID> NodeToEquivClassMap;
     typedef Map<NodeID, Set<NodeID>> NodeToSubsMap;
-    typedef OrderedMap<CallSite, NodeID> CallSite2DummyValPN;
+    typedef OrderedMap<const CallICFGNode*, NodeID> CallSite2DummyValPN;
 
     /// Constructor
     Steensgaard(SVFIR* _pag) : AndersenBase(_pag, Steensgaard_WPA, true) {}
@@ -121,13 +121,13 @@ protected:
     callsite2DummyValPN; ///< Map an instruction to a dummy obj which
     ///< created at an indirect callsite, which invokes
     ///< a heap allocator
-    void heapAllocatorViaIndCall(CallSite cs, NodePairSet& cpySrcNodes);
+    void heapAllocatorViaIndCall(const CallICFGNode* cs, NodePairSet& cpySrcNodes);
 
     /// Update call graph for the input indirect callsites
     virtual bool updateCallGraph(const CallSiteToFunPtrMap& callsites);
 
     /// Connect formal and actual parameters for indirect callsites
-    void connectCaller2CalleeParams(CallSite cs, const SVFFunction* F,
+    void connectCaller2CalleeParams(const CallICFGNode* cs, const SVFFunction* F,
                                     NodePairSet& cpySrcNodes);
 
 private:

package/svf/include/WPA/WPAPass.h

@@ -86,7 +86,7 @@ public:
     virtual void PrintAliasPairs(PointerAnalysis* pta);
 
     /// Interface of mod-ref analysis to determine whether a CallSite instruction can mod or ref any memory location
-    virtual ModRefInfo getModRefInfo(const CallSite callInst);
+    virtual ModRefInfo getModRefInfo(const CallICFGNode* callInst);
 
     /// Interface of mod-ref analysis to determine whether a CallSite instruction can mod or ref a specific memory location, given Location infos
     // virtual inline ModRefInfo getModRefInfo(const CallSite callInst, const MemoryLocation& Loc)
@@ -95,10 +95,10 @@ public:
     // }
 
     /// Interface of mod-ref analysis to determine whether a CallSite instruction can mod or ref a specific memory location, given Value infos
-    virtual ModRefInfo getModRefInfo(const CallSite callInst, const SVFValue* V);
+    virtual ModRefInfo getModRefInfo(const CallICFGNode* callInst, const SVFValue* V);
 
     /// Interface of mod-ref analysis between two CallSite instructions
-    virtual ModRefInfo getModRefInfo(const CallSite callInst1, const CallSite callInst2);
+    virtual ModRefInfo getModRefInfo(const CallICFGNode* callInst1, const CallICFGNode* callInst2);
 
     /// Run pointer analysis on SVFModule
     virtual void runOnModule(SVFIR* svfModule);

package/svf/lib/AE/Svfexe/AEDetector.cpp

@@ -148,7 +148,6 @@ void BufOverflowDetector::detectExtAPI(AbstractState& as,
     SVFIR* svfir = PAG::getPAG();
     const SVFFunction *fun = SVFUtil::getCallee(call->getCallSite());
     assert(fun && "SVFFunction* is nullptr");
-    CallSite cs = SVFUtil::getSVFCallSite(call);
 
     AbstractInterpretation::ExtAPIType extType = AbstractInterpretation::UNCLASSIFIED;
 
@@ -177,10 +176,10 @@ void BufOverflowDetector::detectExtAPI(AbstractState& as,
                                               extAPIBufOverflowCheckRules.at(fun->getName());
         for (auto arg : args)
         {
-            IntervalValue offset = as[svfir->getValueNode(cs.getArgument(arg.second))].getInterval() - IntervalValue(1);
-            if (!canSafelyAccessMemory(as, cs.getArgument(arg.first), offset))
+            IntervalValue offset = as[svfir->getValueNode(call->getArgument(arg.second))].getInterval() - IntervalValue(1);
+            if (!canSafelyAccessMemory(as, call->getArgument(arg.first), offset))
             {
-                AEException bug(call->getCallSite()->toString());
+                AEException bug(call->toString());
                 addBugToReporter(bug, call);
             }
         }
@@ -196,10 +195,10 @@ void BufOverflowDetector::detectExtAPI(AbstractState& as,
                                               extAPIBufOverflowCheckRules.at(fun->getName());
         for (auto arg : args)
         {
-            IntervalValue offset = as[svfir->getValueNode(cs.getArgument(arg.second))].getInterval() - IntervalValue(1);
-            if (!canSafelyAccessMemory(as, cs.getArgument(arg.first), offset))
+            IntervalValue offset = as[svfir->getValueNode(call->getArgument(arg.second))].getInterval() - IntervalValue(1);
+            if (!canSafelyAccessMemory(as, call->getArgument(arg.first), offset))
             {
-                AEException bug(call->getCallSite()->toString());
+                AEException bug(call->toString());
                 addBugToReporter(bug, call);
             }
         }
@@ -208,7 +207,7 @@ void BufOverflowDetector::detectExtAPI(AbstractState& as,
     {
         if (!detectStrcpy(as, call))
         {
-            AEException bug(call->getCallSite()->toString());
+            AEException bug(call->toString());
             addBugToReporter(bug, call);
         }
     }
@@ -216,7 +215,7 @@ void BufOverflowDetector::detectExtAPI(AbstractState& as,
     {
         if (!detectStrcat(as, call))
         {
-            AEException bug(call->getCallSite()->toString());
+            AEException bug(call->toString());
             addBugToReporter(bug, call);
         }
     }
@@ -322,9 +321,8 @@ void BufOverflowDetector::updateGepObjOffsetFromBase(SVF::AddressValue gepAddrs,
  */
 bool BufOverflowDetector::detectStrcpy(AbstractState& as, const CallICFGNode *call)
 {
-    CallSite cs = SVFUtil::getSVFCallSite(call);
-    const SVFValue* arg0Val = cs.getArgument(0);
-    const SVFValue* arg1Val = cs.getArgument(1);
+    const SVFValue* arg0Val = call->getArgument(0);
+    const SVFValue* arg1Val = call->getArgument(1);
     IntervalValue strLen = AbstractInterpretation::getAEInstance().getStrlen(as, arg1Val);
     return canSafelyAccessMemory(as, arg0Val, strLen);
 }
@@ -349,9 +347,8 @@ bool BufOverflowDetector::detectStrcat(AbstractState& as, const CallICFGNode *ca
 
     if (std::find(strcatGroup.begin(), strcatGroup.end(), fun->getName()) != strcatGroup.end())
     {
-        CallSite cs = SVFUtil::getSVFCallSite(call);
-        const SVFValue* arg0Val = cs.getArgument(0);
-        const SVFValue* arg1Val = cs.getArgument(1);
+        const SVFValue* arg0Val = call->getArgument(0);
+        const SVFValue* arg1Val = call->getArgument(1);
         IntervalValue strLen0 = AbstractInterpretation::getAEInstance().getStrlen(as, arg0Val);
         IntervalValue strLen1 = AbstractInterpretation::getAEInstance().getStrlen(as, arg1Val);
         IntervalValue totalLen = strLen0 + strLen1;
@@ -359,9 +356,8 @@ bool BufOverflowDetector::detectStrcat(AbstractState& as, const CallICFGNode *ca
     }
     else if (std::find(strncatGroup.begin(), strncatGroup.end(), fun->getName()) != strncatGroup.end())
     {
-        CallSite cs = SVFUtil::getSVFCallSite(call);
-        const SVFValue* arg0Val = cs.getArgument(0);
-        const SVFValue* arg2Val = cs.getArgument(2);
+        const SVFValue* arg0Val = call->getArgument(0);
+        const SVFValue* arg2Val = call->getArgument(2);
         IntervalValue arg2Num = as[svfir->getValueNode(arg2Val)].getInterval();
         IntervalValue strLen0 = AbstractInterpretation::getAEInstance().getStrlen(as, arg0Val);
         IntervalValue totalLen = strLen0 + arg2Num;

package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp

@@ -906,7 +906,7 @@ void AEStat::finializeStat()
         }
         if (const CallICFGNode *callNode = dyn_cast<CallICFGNode>(it.second))
         {
-            if (!isExtCall(callNode->getCallSite()))
+            if (!isExtCall(callNode))
             {
                 callSiteNum++;
             }
@@ -965,13 +965,12 @@ void AbstractInterpretation::initExtFunMap()
 #define SSE_FUNC_PROCESS(LLVM_NAME ,FUNC_NAME) \
         auto sse_##FUNC_NAME = [this](const CallICFGNode *callNode) { \
         /* run real ext function */            \
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode); \
         AbstractState& as = getAbsStateFromTrace(callNode); \
-        u32_t rhs_id = svfir->getValueNode(cs.getArgument(0)); \
+        u32_t rhs_id = svfir->getValueNode(callNode->getArgument(0)); \
         if (!as.inVarToValTable(rhs_id)) return; \
         u32_t rhs = as[rhs_id].getInterval().lb().getIntNumeral(); \
         s32_t res = FUNC_NAME(rhs);            \
-        u32_t lhsId = svfir->getValueNode(cs.getInstruction());               \
+        u32_t lhsId = svfir->getValueNode(callNode->getCallSite());               \
         as[lhsId] = IntervalValue(res);           \
         return; \
     };                                                                         \
@@ -999,7 +998,7 @@ void AbstractInterpretation::initExtFunMap()
     auto sse_svf_assert = [this](const CallICFGNode* callNode)
     {
         checkpoints.erase(callNode);
-        u32_t arg0 = svfir->getValueNode(SVFUtil::getSVFCallSite(callNode).getArgument(0));
+        u32_t arg0 = svfir->getValueNode(callNode->getArgument(0));
         AbstractState&as = getAbsStateFromTrace(callNode);
         as[arg0].getInterval().meet_with(IntervalValue(1, 1));
         if (as[arg0].getInterval().equals(IntervalValue(1, 1)))
@@ -1017,14 +1016,13 @@ void AbstractInterpretation::initExtFunMap()
 
     auto svf_print = [&](const CallICFGNode* callNode)
     {
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 2) return;
+        if (callNode->arg_size() < 2) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t num_id = svfir->getValueNode(cs.getArgument(0));
-        std::string text = strRead(as, cs.getArgument(1));
+        u32_t num_id = svfir->getValueNode(callNode->getArgument(0));
+        std::string text = strRead(as, callNode->getArgument(1));
         assert(as.inVarToValTable(num_id) && "print() should pass integer");
         IntervalValue itv = as[num_id].getInterval();
-        std::cout << "Text: " << text <<", Value: " << cs.getArgument(0)->toString() << ", PrintVal: " << itv.toString() << std::endl;
+        std::cout << "Text: " << text <<", Value: " << callNode->getArgument(0)->toString() << ", PrintVal: " << itv.toString() << std::endl;
         return;
     };
     func_map["svf_print"] = svf_print;
@@ -1033,11 +1031,10 @@ void AbstractInterpretation::initExtFunMap()
     auto sse_scanf = [&](const CallICFGNode* callNode)
     {
         AbstractState& as = getAbsStateFromTrace(callNode);
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
         //scanf("%d", &data);
-        if (cs.arg_size() < 2) return;
+        if (callNode->arg_size() < 2) return;
 
-        u32_t dst_id = svfir->getValueNode(cs.getArgument(1));
+        u32_t dst_id = svfir->getValueNode(callNode->getArgument(1));
         if (!as.inVarToAddrsTable(dst_id))
         {
             return;
@@ -1056,10 +1053,9 @@ void AbstractInterpretation::initExtFunMap()
     auto sse_fscanf = [&](const CallICFGNode* callNode)
     {
         //fscanf(stdin, "%d", &data);
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 3) return;
+        if (callNode->arg_size() < 3) return;
         AbstractState& as = getAbsStateFromTrace(callNode);
-        u32_t dst_id = svfir->getValueNode(cs.getArgument(2));
+        u32_t dst_id = svfir->getValueNode(callNode->getArgument(2));
         if (!as.inVarToAddrsTable(dst_id))
         {
         }
@@ -1086,11 +1082,10 @@ void AbstractInterpretation::initExtFunMap()
 
     auto sse_fread = [&](const CallICFGNode *callNode)
     {
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 3) return;
+        if (callNode->arg_size() < 3) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t block_count_id = svfir->getValueNode(cs.getArgument(2));
-        u32_t block_size_id = svfir->getValueNode(cs.getArgument(1));
+        u32_t block_count_id = svfir->getValueNode(callNode->getArgument(2));
+        u32_t block_size_id = svfir->getValueNode(callNode->getArgument(1));
         IntervalValue block_count = as[block_count_id].getInterval();
         IntervalValue block_size = as[block_size_id].getInterval();
         IntervalValue block_byte = block_count * block_size;
@@ -1104,20 +1099,19 @@ void AbstractInterpretation::initExtFunMap()
 
     auto sse_snprintf = [&](const CallICFGNode *callNode)
     {
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 2) return;
+        if (callNode->arg_size() < 2) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t size_id = svfir->getValueNode(cs.getArgument(1));
-        u32_t dst_id = svfir->getValueNode(cs.getArgument(0));
+        u32_t size_id = svfir->getValueNode(callNode->getArgument(1));
+        u32_t dst_id = svfir->getValueNode(callNode->getArgument(0));
         // get elem size of arg2
         u32_t elemSize = 1;
-        if (cs.getArgument(2)->getType()->isArrayTy())
+        if (callNode->getArgument(2)->getType()->isArrayTy())
         {
-            elemSize = SVFUtil::dyn_cast<SVFArrayType>(cs.getArgument(2)->getType())->getTypeOfElement()->getByteSize();
+            elemSize = SVFUtil::dyn_cast<SVFArrayType>(callNode->getArgument(2)->getType())->getTypeOfElement()->getByteSize();
         }
-        else if (cs.getArgument(2)->getType()->isPointerTy())
+        else if (callNode->getArgument(2)->getType()->isPointerTy())
         {
-            elemSize = as.getPointeeElement(svfir->getValueNode(cs.getArgument(2)))->getByteSize();
+            elemSize = as.getPointeeElement(svfir->getValueNode(callNode->getArgument(2)))->getByteSize();
         }
         else
         {
@@ -1145,10 +1139,9 @@ void AbstractInterpretation::initExtFunMap()
     {
         // itoa(num, ch, 10);
         // num: int, ch: char*, 10 is decimal
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 3) return;
+        if (callNode->arg_size() < 3) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t num_id = svfir->getValueNode(cs.getArgument(0));
+        u32_t num_id = svfir->getValueNode(callNode->getArgument(0));
 
         u32_t num = (u32_t) as[num_id].getInterval().getNumeral();
         std::string snum = std::to_string(num);
@@ -1159,12 +1152,11 @@ void AbstractInterpretation::initExtFunMap()
     auto sse_strlen = [&](const CallICFGNode *callNode)
     {
         // check the arg size
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 1) return;
-        const SVFValue* strValue = cs.getArgument(0);
+        if (callNode->arg_size() < 1) return;
+        const SVFValue* strValue = callNode->getArgument(0);
         AbstractState& as = getAbsStateFromTrace(callNode);
         NodeID value_id = svfir->getValueNode(strValue);
-        u32_t lhsId = svfir->getValueNode(cs.getInstruction());
+        u32_t lhsId = svfir->getValueNode(callNode->getCallSite());
         u32_t dst_size = 0;
         for (const auto& addr : as[value_id].getAddrs())
         {
@@ -1220,24 +1212,22 @@ void AbstractInterpretation::initExtFunMap()
     auto sse_recv = [&](const CallICFGNode *callNode)
     {
         // recv(sockfd, buf, len, flags);
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
-        if (cs.arg_size() < 4) return;
+        if (callNode->arg_size() < 4) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t len_id = svfir->getValueNode(cs.getArgument(2));
+        u32_t len_id = svfir->getValueNode(callNode->getArgument(2));
         IntervalValue len = as[len_id].getInterval() - IntervalValue(1);
-        u32_t lhsId = svfir->getValueNode(cs.getInstruction());
+        u32_t lhsId = svfir->getValueNode(callNode->getCallSite());
         as[lhsId] = len;
     };
     func_map["recv"] = sse_recv;
     func_map["__recv"] = sse_recv;
     auto safe_bufaccess = [&](const CallICFGNode *callNode)
     {
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
         checkpoints.erase(callNode);
         //void SAFE_BUFACCESS(void* data, int size);
-        if (cs.arg_size() < 2) return;
+        if (callNode->arg_size() < 2) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t size_id = svfir->getValueNode(cs.getArgument(1));
+        u32_t size_id = svfir->getValueNode(callNode->getArgument(1));
         IntervalValue val = as[size_id].getInterval();
         if (val.isBottom())
         {
@@ -1250,7 +1240,7 @@ void AbstractInterpretation::initExtFunMap()
             if (SVFUtil::isa<BufOverflowDetector>(detector))
             {
                 BufOverflowDetector* bufDetector = SVFUtil::cast<BufOverflowDetector>(detector.get());
-                bool isSafe = bufDetector->canSafelyAccessMemory(as, cs.getArgument(0), val);
+                bool isSafe = bufDetector->canSafelyAccessMemory(as, callNode->getArgument(0), val);
                 if (isSafe)
                 {
                     std::cout << "safe buffer access success: " << callNode->toString() << std::endl;
@@ -1259,7 +1249,7 @@ void AbstractInterpretation::initExtFunMap()
                 else
                 {
                     std::string err_msg = "this SAFE_BUFACCESS should be a safe access but detected buffer overflow. Pos: ";
-                    err_msg += cs.getInstruction()->getSourceLoc();
+                    err_msg += callNode->getSourceLoc();
                     std::cerr << err_msg << std::endl;
                     assert(false);
                 }
@@ -1270,12 +1260,11 @@ void AbstractInterpretation::initExtFunMap()
 
     auto unsafe_bufaccess = [&](const CallICFGNode *callNode)
     {
-        const CallSite& cs = SVFUtil::getSVFCallSite(callNode);
         checkpoints.erase(callNode);
         //void UNSAFE_BUFACCESS(void* data, int size);
-        if (cs.arg_size() < 2) return;
+        if (callNode->arg_size() < 2) return;
         AbstractState&as = getAbsStateFromTrace(callNode);
-        u32_t size_id = svfir->getValueNode(cs.getArgument(1));
+        u32_t size_id = svfir->getValueNode(callNode->getArgument(1));
         IntervalValue val = as[size_id].getInterval();
         if (val.isBottom())
         {
@@ -1287,7 +1276,7 @@ void AbstractInterpretation::initExtFunMap()
             if (SVFUtil::isa<BufOverflowDetector>(detector))
             {
                 BufOverflowDetector* bufDetector = SVFUtil::cast<BufOverflowDetector>(detector.get());
-                bool isSafe = bufDetector->canSafelyAccessMemory(as, cs.getArgument(0), val);
+                bool isSafe = bufDetector->canSafelyAccessMemory(as, callNode->getArgument(0), val);
                 if (!isSafe)
                 {
                     std::cout << "detect buffer overflow success: " << callNode->toString() << std::endl;
@@ -1296,7 +1285,7 @@ void AbstractInterpretation::initExtFunMap()
                 else
                 {
                     std::string err_msg = "this UNSAFE_BUFACCESS should be a buffer overflow but not detected. Pos: ";
-                    err_msg += cs.getInstruction()->getSourceLoc();
+                    err_msg += callNode->getSourceLoc();
                     std::cerr << err_msg << std::endl;
                     assert(false);
                 }
@@ -1346,7 +1335,6 @@ void AbstractInterpretation::handleExtAPI(const CallICFGNode *call)
     AbstractState& as = getAbsStateFromTrace(call);
     const SVFFunction *fun = SVFUtil::getCallee(call->getCallSite());
     assert(fun && "SVFFunction* is nullptr");
-    CallSite cs = SVFUtil::getSVFCallSite(call);
     ExtAPIType extType = UNCLASSIFIED;
     // get type of mem api
     for (const std::string &annotation: fun->getAnnotations())
@@ -1368,7 +1356,7 @@ void AbstractInterpretation::handleExtAPI(const CallICFGNode *call)
         }
         else
         {
-            u32_t lhsId = svfir->getValueNode(SVFUtil::getSVFCallSite(call).getInstruction());
+            u32_t lhsId = svfir->getValueNode(call->getCallSite());
             if (as.inVarToAddrsTable(lhsId))
             {
 
@@ -1383,15 +1371,15 @@ void AbstractInterpretation::handleExtAPI(const CallICFGNode *call)
     // 1. memcpy functions like memcpy_chk, strncpy, annotate("MEMCPY"), annotate("BUF_CHECK:Arg0, Arg2"), annotate("BUF_CHECK:Arg1, Arg2")
     else if (extType == MEMCPY)
     {
-        IntervalValue len = as[svfir->getValueNode(cs.getArgument(2))].getInterval();
-        handleMemcpy(as, cs.getArgument(0), cs.getArgument(1), len, 0);
+        IntervalValue len = as[svfir->getValueNode(call->getArgument(2))].getInterval();
+        handleMemcpy(as, call->getArgument(0), call->getArgument(1), len, 0);
     }
     else if (extType == MEMSET)
     {
         // memset dst is arg0, elem is arg1, size is arg2
-        IntervalValue len = as[svfir->getValueNode(cs.getArgument(2))].getInterval();
-        IntervalValue elem = as[svfir->getValueNode(cs.getArgument(1))].getInterval();
-        handleMemset(as,cs.getArgument(0), elem, len);
+        IntervalValue len = as[svfir->getValueNode(call->getArgument(2))].getInterval();
+        IntervalValue elem = as[svfir->getValueNode(call->getArgument(1))].getInterval();
+        handleMemset(as,call->getArgument(0), elem, len);
     }
     else if (extType == STRCPY)
     {
@@ -1450,9 +1438,8 @@ void AbstractInterpretation::handleStrcpy(const CallICFGNode *call)
     // strcpy, __strcpy_chk, stpcpy , wcscpy, __wcscpy_chk
     // get the dst and src
     AbstractState& as = getAbsStateFromTrace(call);
-    CallSite cs = SVFUtil::getSVFCallSite(call);
-    const SVFValue* arg0Val = cs.getArgument(0);
-    const SVFValue* arg1Val = cs.getArgument(1);
+    const SVFValue* arg0Val = call->getArgument(0);
+    const SVFValue* arg1Val = call->getArgument(1);
     IntervalValue strLen = getStrlen(as, arg1Val);
     // no need to -1, since it has \0 as the last byte
     handleMemcpy(as, arg0Val, arg1Val, strLen, strLen.lb().getIntNumeral());
@@ -1545,9 +1532,8 @@ void AbstractInterpretation::handleStrcat(const SVF::CallICFGNode *call)
     const std::vector<std::string> strncatGroup = {"__strncat_chk", "strncat", "__wcsncat_chk", "wcsncat"};
     if (std::find(strcatGroup.begin(), strcatGroup.end(), fun->getName()) != strcatGroup.end())
     {
-        CallSite cs = SVFUtil::getSVFCallSite(call);
-        const SVFValue* arg0Val = cs.getArgument(0);
-        const SVFValue* arg1Val = cs.getArgument(1);
+        const SVFValue* arg0Val = call->getArgument(0);
+        const SVFValue* arg1Val = call->getArgument(1);
         IntervalValue strLen0 = getStrlen(as, arg0Val);
         IntervalValue strLen1 = getStrlen(as, arg1Val);
         IntervalValue totalLen = strLen0 + strLen1;
@@ -1556,10 +1542,9 @@ void AbstractInterpretation::handleStrcat(const SVF::CallICFGNode *call)
     }
     else if (std::find(strncatGroup.begin(), strncatGroup.end(), fun->getName()) != strncatGroup.end())
     {
-        CallSite cs = SVFUtil::getSVFCallSite(call);
-        const SVFValue* arg0Val = cs.getArgument(0);
-        const SVFValue* arg1Val = cs.getArgument(1);
-        const SVFValue* arg2Val = cs.getArgument(2);
+        const SVFValue* arg0Val = call->getArgument(0);
+        const SVFValue* arg1Val = call->getArgument(1);
+        const SVFValue* arg2Val = call->getArgument(2);
         IntervalValue arg2Num = as[svfir->getValueNode(arg2Val)].getInterval();
         IntervalValue strLen0 = getStrlen(as, arg0Val);
         IntervalValue totalLen = strLen0 + arg2Num;

package/svf/lib/CFL/CFLAlias.cpp

@@ -42,9 +42,9 @@ void CFLAlias::onTheFlyCallGraphSolve(const CallSiteToFunPtrMap& callsites, Call
     {
         const CallICFGNode* cs = iter->first;
 
-        if (SVFUtil::getSVFCallSite(cs).isVirtualCall())
+        if (cs->isVirtualCall())
         {
-            const SVFValue* vtbl = SVFUtil::getSVFCallSite(cs).getVtablePtr();
+            const SVFValue* vtbl = cs->getVtablePtr();
             assert(pag->hasValueNode(vtbl));
             NodeID vtblId = pag->getValueNode(vtbl);
             resolveCPPIndCalls(cs, getCFLPts(vtblId), newEdges);
@@ -58,14 +58,14 @@ void CFLAlias::onTheFlyCallGraphSolve(const CallSiteToFunPtrMap& callsites, Call
  * Connect formal and actual parameters for indirect callsites
  */
 
-void CFLAlias::connectCaller2CalleeParams(CallSite cs, const SVFFunction* F)
+void CFLAlias::connectCaller2CalleeParams(const CallICFGNode* cs, const SVFFunction* F)
 {
     assert(F);
 
-    DBOUT(DAndersen, outs() << "connect parameters from indirect callsite " << cs.getInstruction()->toString() << " to callee " << *F << "\n");
+    DBOUT(DAndersen, outs() << "connect parameters from indirect callsite " << cs->toString() << " to callee " << *F << "\n");
 
-    CallICFGNode* callBlockNode = svfir->getICFG()->getCallICFGNode(cs.getInstruction());
-    RetICFGNode* retBlockNode = svfir->getICFG()->getRetICFGNode(cs.getInstruction());
+    const CallICFGNode* callBlockNode = cs;
+    const RetICFGNode* retBlockNode = cs->getRetICFGNode();
 
     if(SVFUtil::isHeapAllocExtFunViaRet(F) && svfir->callsiteHasRet(retBlockNode))
     {
@@ -136,15 +136,15 @@ void CFLAlias::connectCaller2CalleeParams(CallSite cs, const SVFFunction* F)
         if(csArgIt != csArgEit)
         {
             writeWrnMsg("too many args to non-vararg func.");
-            writeWrnMsg("(" + cs.getInstruction()->getSourceLoc() + ")");
+            writeWrnMsg("(" + cs->getSourceLoc() + ")");
         }
     }
 }
 
-void CFLAlias::heapAllocatorViaIndCall(CallSite cs)
+void CFLAlias::heapAllocatorViaIndCall(const CallICFGNode* cs)
 {
     assert(SVFUtil::getCallee(cs) == nullptr && "not an indirect callsite?");
-    RetICFGNode* retBlockNode = svfir->getICFG()->getRetICFGNode(cs.getInstruction());
+    const RetICFGNode* retBlockNode = cs->getRetICFGNode();
     const PAGNode* cs_return = svfir->getCallSiteRet(retBlockNode);
     NodeID srcret;
     CallSite2DummyValPN::const_iterator it = callsite2DummyValPN.find(cs);
@@ -155,7 +155,7 @@ void CFLAlias::heapAllocatorViaIndCall(CallSite cs)
     else
     {
         NodeID valNode = svfir->addDummyValNode();
-        NodeID objNode = svfir->addDummyObjNode(cs.getType());
+        NodeID objNode = svfir->addDummyObjNode(cs->getCallSite()->getType());
         callsite2DummyValPN.insert(std::make_pair(cs,valNode));
         graph->addCFLNode(valNode, new CFLNode(valNode));
         graph->addCFLNode(objNode, new CFLNode(objNode));
@@ -175,10 +175,9 @@ bool CFLAlias::updateCallGraph(const CallSiteToFunPtrMap& callsites)
     onTheFlyCallGraphSolve(callsites,newEdges);
     for(CallEdgeMap::iterator it = newEdges.begin(), eit = newEdges.end(); it!=eit; ++it )
     {
-        CallSite cs = SVFUtil::getSVFCallSite(it->first);
         for(FunctionSet::iterator cit = it->second.begin(), ecit = it->second.end(); cit!=ecit; ++cit)
         {
-            connectCaller2CalleeParams(cs,*cit);
+            connectCaller2CalleeParams(it->first,*cit);
         }
     }
 

package/svf/lib/DDA/DDAClient.cpp

@@ -81,9 +81,9 @@ OrderedNodeSet& FunptrDDAClient::collectCandidateQueries(SVFIR* p)
     for(SVFIR::CallSiteToFunPtrMap::const_iterator it = pag->getIndirectCallsites().begin(),
             eit = pag->getIndirectCallsites().end(); it!=eit; ++it)
     {
-        if (SVFUtil::getSVFCallSite(it->first).isVirtualCall())
+        if (it->first->isVirtualCall())
         {
-            const SVFValue* vtblPtr = SVFUtil::getSVFCallSite(it->first).getVtablePtr();
+            const SVFValue* vtblPtr = it->first->getVtablePtr();
             assert(pag->hasValueNode(vtblPtr) && "not a vtable pointer?");
             NodeID vtblId = pag->getValueNode(vtblPtr);
             addCandidate(vtblId);

package/svf/lib/Graphs/CHG.cpp

@@ -29,6 +29,7 @@
 
 #include "Graphs/CHG.h"
 #include "Util/SVFUtil.h"
+#include "Graphs/ICFG.h"
 
 using namespace SVF;
 using namespace SVFUtil;
@@ -48,16 +49,16 @@ static bool hasEdge(const CHNode *src, const CHNode *dst,
     return false;
 }
 
-static bool checkArgTypes(CallSite cs, const SVFFunction* fn)
+static bool checkArgTypes(const SVFCallInst* cs, const SVFFunction* fn)
 {
 
     // here we skip the first argument (i.e., this pointer)
-    u32_t arg_size = (fn->arg_size() > cs.arg_size()) ? cs.arg_size(): fn->arg_size();
+    u32_t arg_size = (fn->arg_size() > cs->arg_size()) ? cs->arg_size(): fn->arg_size();
     if(arg_size > 1)
     {
         for (unsigned i = 1; i < arg_size; i++)
         {
-            auto cs_arg = cs.getArgOperand(i);
+            auto cs_arg = cs->getArgOperand(i);
             auto fn_arg = fn->getArg(i);
             if (cs_arg->getType() != fn_arg->getType())
             {
@@ -69,6 +70,29 @@ static bool checkArgTypes(CallSite cs, const SVFFunction* fn)
     return true;
 }
 
+bool CHGraph::csHasVtblsBasedonCHA(const CallICFGNode* cs)
+{
+    CallSiteToVTableSetMap::const_iterator it = csToCHAVtblsMap.find(cs->getCallSite());
+    return it != csToCHAVtblsMap.end();
+}
+bool CHGraph::csHasVFnsBasedonCHA(const CallICFGNode* cs)
+{
+    CallSiteToVFunSetMap::const_iterator it = csToCHAVFnsMap.find(cs->getCallSite());
+    return it != csToCHAVFnsMap.end();
+}
+const VTableSet& CHGraph::getCSVtblsBasedonCHA(const CallICFGNode* cs)
+{
+    CallSiteToVTableSetMap::const_iterator it = csToCHAVtblsMap.find(cs->getCallSite());
+    assert(it != csToCHAVtblsMap.end() && "cs does not have vtabls based on CHA.");
+    return it->second;
+}
+const VFunSet& CHGraph::getCSVFsBasedonCHA(const CallICFGNode* cs)
+{
+    CallSiteToVFunSetMap::const_iterator it = csToCHAVFnsMap.find(cs->getCallSite());
+    assert(it != csToCHAVFnsMap.end() && "cs does not have vfns based on CHA.");
+    return it->second;
+}
+
 void CHGraph::addEdge(const string className, const string baseClassName,
                       CHEdge::CHEDGETYPE edgeType)
 {
@@ -96,13 +120,13 @@ CHNode *CHGraph::getNode(const string name) const
  * Get virtual functions for callsite "cs" based on vtbls (calculated
  * based on pointsto set)
  */
-void CHGraph::getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &virtualFunctions)
+void CHGraph::getVFnsFromVtbls(const SVFCallInst* callsite, const VTableSet &vtbls, VFunSet &virtualFunctions)
 {
-
+    const SVFVirtualCallInst* cs = SVFUtil::cast<SVFVirtualCallInst>(callsite);
     /// get target virtual functions
-    size_t idx = cs.getFunIdxInVtable();
+    size_t idx = cs->getFunIdxInVtable();
     /// get the function name of the virtual callsite
-    string funName = cs.getFunNameOfVirtualCall();
+    string funName = cs->getFunNameOfVirtualCall();
     for (const SVFGlobalValue *vt : vtbls)
     {
         const CHNode *child = getNode(vt->getName());
@@ -114,8 +138,8 @@ void CHGraph::getVFnsFromVtbls(CallSite cs, const VTableSet &vtbls, VFunSet &vir
                 feit = vfns.end(); fit != feit; ++fit)
         {
             const SVFFunction* callee = *fit;
-            if (cs.arg_size() == callee->arg_size() ||
-                    (cs.isVarArg() && callee->isVarArg()))
+            if (cs->arg_size() == callee->arg_size() ||
+                    (cs->isVarArg() && callee->isVarArg()))
             {
 
                 // if argument types do not match