svf-tools 1.0.986 → 1.0.988

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "svf-tools",
-  "version": "1.0.986",
+  "version": "1.0.988",
   "description": "* <b>[TypeClone](https://github.com/SVF-tools/SVF/wiki/TypeClone) published in our [ECOOP paper](https://yuleisui.github.io/publications/ecoop20.pdf) is now available in SVF </b> * <b>SVF now uses a single script for its build. Just type [`source ./build.sh`](https://github.com/SVF-tools/SVF/blob/master/build.sh) in your terminal, that's it!</b> * <b>SVF now supports LLVM-10.0.0! </b> * <b>We thank [bsauce](https://github.com/bsauce) for writing a user manual of SVF ([link1](https://www.jianshu.com/p/068a08ec749c) and [link2](https://www.jianshu.com/p/777c30d4240e)) in Chinese </b> * <b>SVF now supports LLVM-9.0.0 (Thank [Byoungyoung Lee](https://github.com/SVF-tools/SVF/issues/142) for his help!). </b> * <b>SVF now supports a set of [field-sensitive pointer analyses](https://yuleisui.github.io/publications/sas2019a.pdf). </b> * <b>[Use SVF as an external lib](https://github.com/SVF-tools/SVF/wiki/Using-SVF-as-a-lib-in-your-own-tool) for your own project (Contributed by [Hongxu Chen](https://github.com/HongxuChen)). </b> * <b>SVF now supports LLVM-7.0.0. </b> * <b>SVF now supports Docker. [Try SVF in Docker](https://github.com/SVF-tools/SVF/wiki/Try-SVF-in-Docker)! </b> * <b>SVF now supports [LLVM-6.0.0](https://github.com/svf-tools/SVF/pull/38) (Contributed by [Jack Anthony](https://github.com/jackanth)). </b> * <b>SVF now supports [LLVM-4.0.0](https://github.com/svf-tools/SVF/pull/23) (Contributed by Jared Carlson. Thank [Jared](https://github.com/jcarlson23) and [Will](https://github.com/dtzWill) for their in-depth [discussions](https://github.com/svf-tools/SVF/pull/18) about updating SVF!) </b> * <b>SVF now supports analysis for C++ programs.</b> <br />",
   "main": "index.js",
   "scripts": {

package/svf/include/SVFIR/SVFValue.h

@@ -319,7 +319,6 @@ private:
     const SVFFunction* realDefFun;  /// the definition of a function across multiple modules
     std::vector<const SVFBasicBlock*> allBBs;   /// all BasicBlocks of this function
     std::vector<const SVFArgument*> allArgs;    /// all formal arguments of this function
-    std::vector<std::string> annotations; /// annotations of this function
     SVFBasicBlock *exitBlock;             /// a 'single' basic block having no successors and containing return instruction in a function
 
 protected:
@@ -463,16 +462,6 @@ public:
         return  !isNotRet;
     }
 
-    inline const std::vector<std::string>& getAnnotations() const
-    {
-        return annotations;
-    }
-
-    inline void setAnnotations(std::vector<std::string>& annotations)
-    {
-        this->annotations = annotations;
-    }
-
     inline void getExitBlocksOfLoop(const SVFBasicBlock* bb, BBList& exitbbs) const
     {
         return loopAndDom->getExitBlocksOfLoop(bb,exitbbs);

package/svf/include/Util/ExtAPI.h

@@ -43,10 +43,14 @@ namespace SVF
 
 class ExtAPI
 {
+    friend class LLVMModuleSet;
 private:
 
     static ExtAPI *extOp;
 
+    // Map SVFFunction to its annotations
+    Map<const SVFFunction*, std::vector<std::string>> func2Annotations;
+
     // extapi.bc file path
     static std::string extBcPath;
 
@@ -67,6 +71,8 @@ public:
     // Get the annotation of (F)
     std::string getExtFuncAnnotation(const SVFFunction* fun, const std::string& funcAnnotation);
 
+    const std::vector<std::string>& getExtFuncAnnotations(const SVFFunction* fun);
+
     // Does (F) have some annotation?
     bool hasExtFuncAnnotation(const SVFFunction* fun, const std::string& funcAnnotation);
 
@@ -94,6 +100,10 @@ public:
     // Should (F) be considered "external" (either not defined in the program
     //   or a user-defined version of a known alloc or no-op)?
     bool is_ext(const SVFFunction *F);
+
+private:
+    // Set the annotation of (F)
+    void setExtFuncAnnotations(const SVFFunction* fun, const std::vector<std::string>& funcAnnotations);
 };
 } // End namespace SVF
 

package/svf/include/Util/SVFUtil.h

@@ -391,19 +391,13 @@ bool isExtCall(const ICFGNode* node);
 
 bool isHeapAllocExtCallViaArg(const CallICFGNode* cs);
 
-bool isHeapAllocExtCallViaArg(const SVFInstruction *inst);
-
-bool isHeapAllocExtCallViaRet(const SVFInstruction *inst);
 
 /// interfaces to be used externally
 bool isHeapAllocExtCallViaRet(const CallICFGNode* cs);
 
 bool isHeapAllocExtCall(const ICFGNode* cs);
 
-inline bool isHeapAllocExtCall(const SVFInstruction *inst)
-{
-    return isHeapAllocExtCallViaRet(inst) || isHeapAllocExtCallViaArg(inst);
-}
+
 
 //@}
 

package/svf/lib/AE/Svfexe/AEDetector.cpp

@@ -150,7 +150,7 @@ void BufOverflowDetector::detectExtAPI(AbstractState& as,
     AbstractInterpretation::ExtAPIType extType = AbstractInterpretation::UNCLASSIFIED;
 
     // Determine the type of external memory API
-    for (const std::string &annotation : call->getCalledFunction()->getAnnotations())
+    for (const std::string &annotation : ExtAPI::getExtAPI()->getExtFuncAnnotations(call->getCalledFunction()))
     {
         if (annotation.find("MEMCPY") != std::string::npos)
             extType = AbstractInterpretation::MEMCPY;

package/svf/lib/AE/Svfexe/AbstractInterpretation.cpp

@@ -995,7 +995,6 @@ void AbstractInterpretation::initExtFunMap()
         checkpoints.erase(callNode);
         u32_t arg0 = svfir->getValueNode(callNode->getArgument(0));
         AbstractState&as = getAbsStateFromTrace(callNode);
-        as[arg0].getInterval().meet_with(IntervalValue(1, 1));
         if (as[arg0].getInterval().equals(IntervalValue(1, 1)))
         {
             SVFUtil::errs() << SVFUtil::sucMsg("The assertion is successfully verified!!\n");
@@ -1009,6 +1008,25 @@ void AbstractInterpretation::initExtFunMap()
     };
     func_map["svf_assert"] = sse_svf_assert;
 
+    auto svf_assert_eq = [this](const CallICFGNode* callNode)
+    {
+        checkpoints.erase(callNode);
+        u32_t arg0 = svfir->getValueNode(callNode->getArgument(0));
+        u32_t arg1 = svfir->getValueNode(callNode->getArgument(1));
+        AbstractState&as = getAbsStateFromTrace(callNode);
+        if (as[arg0].getInterval().equals(as[arg1].getInterval()))
+        {
+            SVFUtil::errs() << SVFUtil::sucMsg("The assertion is successfully verified!!\n");
+        }
+        else
+        {
+            SVFUtil::errs() <<"svf_assert_eq Fail. " << callNode->toString() << "\n";
+            assert(false);
+        }
+        return;
+    };
+    func_map["svf_assert_eq"] = svf_assert_eq;
+
     auto svf_print = [&](const CallICFGNode* callNode)
     {
         if (callNode->arg_size() < 2) return;
@@ -1017,11 +1035,38 @@ void AbstractInterpretation::initExtFunMap()
         std::string text = strRead(as, callNode->getArgument(1));
         assert(as.inVarToValTable(num_id) && "print() should pass integer");
         IntervalValue itv = as[num_id].getInterval();
-        std::cout << "Text: " << text <<", Value: " << callNode->getArgument(0)->toString() << ", PrintVal: " << itv.toString() << std::endl;
+        std::cout << "Text: " << text <<", Value: " << callNode->getArgument(0)->toString()
+                  << ", PrintVal: " << itv.toString() << ", Loc:" << callNode->getSourceLoc() << std::endl;
         return;
     };
     func_map["svf_print"] = svf_print;
 
+    auto svf_set_value = [&](const CallICFGNode* callNode)
+    {
+        if (callNode->arg_size() < 2) return;
+        AbstractState&as = getAbsStateFromTrace(callNode);
+        AbstractValue& num = as[svfir->getValueNode(callNode->getArgument(0))];
+        AbstractValue& lb = as[svfir->getValueNode(callNode->getArgument(1))];
+        AbstractValue& ub = as[svfir->getValueNode(callNode->getArgument(2))];
+        assert(lb.getInterval().is_numeral() && ub.getInterval().is_numeral());
+        num.getInterval().set_to_top();
+        num.getInterval().meet_with(IntervalValue(lb.getInterval().lb(), ub.getInterval().ub()));
+        if (icfg->hasICFGNode(SVFUtil::cast<SVFInstruction>(callNode->getArgument(0))))
+        {
+            const ICFGNode* node = icfg->getICFGNode(SVFUtil::cast<SVFInstruction>(callNode->getArgument(0)));
+            for (const SVFStmt* stmt: node->getSVFStmts())
+            {
+                if (SVFUtil::isa<LoadStmt>(stmt))
+                {
+                    const LoadStmt* load = SVFUtil::cast<LoadStmt>(stmt);
+                    NodeID rhsId = load->getRHSVarID();
+                    as.storeValue(rhsId, num);
+                }
+            }
+        }
+        return;
+    };
+    func_map["set_value"] = svf_set_value;
 
     auto sse_scanf = [&](const CallICFGNode* callNode)
     {
@@ -1332,7 +1377,7 @@ void AbstractInterpretation::handleExtAPI(const CallICFGNode *call)
     assert(fun && "SVFFunction* is nullptr");
     ExtAPIType extType = UNCLASSIFIED;
     // get type of mem api
-    for (const std::string &annotation: fun->getAnnotations())
+    for (const std::string &annotation: ExtAPI::getExtAPI()->getExtFuncAnnotations(fun))
     {
         if (annotation.find("MEMCPY") != std::string::npos)
             extType =  MEMCPY;
@@ -1708,8 +1753,27 @@ void AbstractInterpretation::updateStateOnPhi(const PhiStmt *phi)
         const ICFGNode* opICFGNode = phi->getOpICFGNode(i);
         if (hasAbsStateFromTrace(opICFGNode))
         {
+            AbstractState tmpEs = abstractTrace[opICFGNode];
             AbstractState& opAs = getAbsStateFromTrace(opICFGNode);
-            rhs.join_with(opAs[curId]);
+            const ICFGEdge* edge =  icfg->getICFGEdge(opICFGNode, icfgNode, ICFGEdge::IntraCF);
+            // if IntraEdge, check the condition, if it is feasible, join the value
+            // if IntraEdge but not conditional edge, join the value
+            // if not IntraEdge, join the value
+            if (edge)
+            {
+                const IntraCFGEdge* intraEdge = SVFUtil::cast<IntraCFGEdge>(edge);
+                if (intraEdge->getCondition())
+                {
+                    if (isBranchFeasible(intraEdge, tmpEs))
+                        rhs.join_with(opAs[curId]);
+                }
+                else
+                    rhs.join_with(opAs[curId]);
+            }
+            else
+            {
+                rhs.join_with(opAs[curId]);
+            }
         }
     }
     as[res] = rhs;
@@ -1810,181 +1874,209 @@ void AbstractInterpretation::updateStateOnCmp(const CmpStmt *cmp)
     AbstractState& as = getAbsStateFromTrace(cmp->getICFGNode());
     u32_t op0 = cmp->getOpVarID(0);
     u32_t op1 = cmp->getOpVarID(1);
-    if (!as.inVarToValTable(op0)) as[op0] = IntervalValue::top();
-    if (!as.inVarToValTable(op1)) as[op1] = IntervalValue::top();
-    u32_t res = cmp->getResID();
-    if (as.inVarToValTable(op0) && as.inVarToValTable(op1))
+    // if it is address
+    if (as.inVarToAddrsTable(op0) && as.inVarToAddrsTable(op1))
     {
         IntervalValue resVal;
-        if (as[op0].isInterval() && as[op1].isInterval())
+        AddressValue addrOp0 = as[op0].getAddrs();
+        AddressValue addrOp1 = as[op1].getAddrs();
+        u32_t res = cmp->getResID();
+        if (addrOp0.equals(addrOp1))
         {
-            IntervalValue &lhs = as[op0].getInterval(), &rhs = as[op1].getInterval();
-            //AbstractValue
-            auto predicate = cmp->getPredicate();
-            switch (predicate)
-            {
-            case CmpStmt::ICMP_EQ:
-            case CmpStmt::FCMP_OEQ:
-            case CmpStmt::FCMP_UEQ:
-                resVal = (lhs == rhs);
-                // resVal = (lhs.getInterval() == rhs.getInterval());
-                break;
-            case CmpStmt::ICMP_NE:
-            case CmpStmt::FCMP_ONE:
-            case CmpStmt::FCMP_UNE:
-                resVal = (lhs != rhs);
-                break;
-            case CmpStmt::ICMP_UGT:
-            case CmpStmt::ICMP_SGT:
-            case CmpStmt::FCMP_OGT:
-            case CmpStmt::FCMP_UGT:
-                resVal = (lhs > rhs);
-                break;
-            case CmpStmt::ICMP_UGE:
-            case CmpStmt::ICMP_SGE:
-            case CmpStmt::FCMP_OGE:
-            case CmpStmt::FCMP_UGE:
-                resVal = (lhs >= rhs);
-                break;
-            case CmpStmt::ICMP_ULT:
-            case CmpStmt::ICMP_SLT:
-            case CmpStmt::FCMP_OLT:
-            case CmpStmt::FCMP_ULT:
-                resVal = (lhs < rhs);
-                break;
-            case CmpStmt::ICMP_ULE:
-            case CmpStmt::ICMP_SLE:
-            case CmpStmt::FCMP_OLE:
-            case CmpStmt::FCMP_ULE:
-                resVal = (lhs <= rhs);
-                break;
-            case CmpStmt::FCMP_FALSE:
-                resVal = IntervalValue(0, 0);
-                break;
-            case CmpStmt::FCMP_TRUE:
-                resVal = IntervalValue(1, 1);
-                break;
-            default:
-            {
-                assert(false && "undefined compare: ");
-            }
-            }
-            as[res] = resVal;
+            resVal = IntervalValue(1, 1);
         }
-        else if (as[op0].isAddr() && as[op1].isAddr())
+        else if (addrOp0.hasIntersect(addrOp1))
         {
-            AddressValue &lhs = as[op0].getAddrs(), &rhs = as[op1].getAddrs();
-            auto predicate = cmp->getPredicate();
-            switch (predicate)
-            {
-            case CmpStmt::ICMP_EQ:
-            case CmpStmt::FCMP_OEQ:
-            case CmpStmt::FCMP_UEQ:
+            resVal = IntervalValue(0, 1);
+        }
+        else
+        {
+            resVal = IntervalValue(0, 0);
+        }
+        as[res] = resVal;
+    }
+    else
+    {
+        if (!as.inVarToValTable(op0))
+            as[op0] = IntervalValue::top();
+        if (!as.inVarToValTable(op1))
+            as[op1] = IntervalValue::top();
+        u32_t res = cmp->getResID();
+        if (as.inVarToValTable(op0) && as.inVarToValTable(op1))
+        {
+            IntervalValue resVal;
+            if (as[op0].isInterval() && as[op1].isInterval())
             {
-                if (lhs.hasIntersect(rhs))
-                {
-                    resVal = IntervalValue(0, 1);
-                }
-                else if (lhs.empty() && rhs.empty())
-                {
-                    resVal = IntervalValue(1, 1);
-                }
-                else
+                IntervalValue &lhs = as[op0].getInterval(),
+                               &rhs = as[op1].getInterval();
+                // AbstractValue
+                auto predicate = cmp->getPredicate();
+                switch (predicate)
                 {
+                case CmpStmt::ICMP_EQ:
+                case CmpStmt::FCMP_OEQ:
+                case CmpStmt::FCMP_UEQ:
+                    resVal = (lhs == rhs);
+                    // resVal = (lhs.getInterval() == rhs.getInterval());
+                    break;
+                case CmpStmt::ICMP_NE:
+                case CmpStmt::FCMP_ONE:
+                case CmpStmt::FCMP_UNE:
+                    resVal = (lhs != rhs);
+                    break;
+                case CmpStmt::ICMP_UGT:
+                case CmpStmt::ICMP_SGT:
+                case CmpStmt::FCMP_OGT:
+                case CmpStmt::FCMP_UGT:
+                    resVal = (lhs > rhs);
+                    break;
+                case CmpStmt::ICMP_UGE:
+                case CmpStmt::ICMP_SGE:
+                case CmpStmt::FCMP_OGE:
+                case CmpStmt::FCMP_UGE:
+                    resVal = (lhs >= rhs);
+                    break;
+                case CmpStmt::ICMP_ULT:
+                case CmpStmt::ICMP_SLT:
+                case CmpStmt::FCMP_OLT:
+                case CmpStmt::FCMP_ULT:
+                    resVal = (lhs < rhs);
+                    break;
+                case CmpStmt::ICMP_ULE:
+                case CmpStmt::ICMP_SLE:
+                case CmpStmt::FCMP_OLE:
+                case CmpStmt::FCMP_ULE:
+                    resVal = (lhs <= rhs);
+                    break;
+                case CmpStmt::FCMP_FALSE:
                     resVal = IntervalValue(0, 0);
-                }
-                break;
-            }
-            case CmpStmt::ICMP_NE:
-            case CmpStmt::FCMP_ONE:
-            case CmpStmt::FCMP_UNE:
-            {
-                if (lhs.hasIntersect(rhs))
-                {
-                    resVal = IntervalValue(0, 1);
-                }
-                else if (lhs.empty() && rhs.empty())
+                    break;
+                case CmpStmt::FCMP_TRUE:
+                    resVal = IntervalValue(1, 1);
+                    break;
+                default:
                 {
-                    resVal = IntervalValue(0, 0);
+                    assert(false && "undefined compare: ");
                 }
-                else
-                {
-                    resVal = IntervalValue(1, 1);
                 }
-                break;
+                as[res] = resVal;
             }
-            case CmpStmt::ICMP_UGT:
-            case CmpStmt::ICMP_SGT:
-            case CmpStmt::FCMP_OGT:
-            case CmpStmt::FCMP_UGT:
+            else if (as[op0].isAddr() && as[op1].isAddr())
             {
-                if (lhs.size() == 1 && rhs.size() == 1)
+                AddressValue &lhs = as[op0].getAddrs(),
+                              &rhs = as[op1].getAddrs();
+                auto predicate = cmp->getPredicate();
+                switch (predicate)
                 {
-                    resVal = IntervalValue(*lhs.begin() > *rhs.begin());
-                }
-                else
+                case CmpStmt::ICMP_EQ:
+                case CmpStmt::FCMP_OEQ:
+                case CmpStmt::FCMP_UEQ:
                 {
-                    resVal = IntervalValue(0, 1);
+                    if (lhs.hasIntersect(rhs))
+                    {
+                        resVal = IntervalValue(0, 1);
+                    }
+                    else if (lhs.empty() && rhs.empty())
+                    {
+                        resVal = IntervalValue(1, 1);
+                    }
+                    else
+                    {
+                        resVal = IntervalValue(0, 0);
+                    }
+                    break;
                 }
-                break;
-            }
-            case CmpStmt::ICMP_UGE:
-            case CmpStmt::ICMP_SGE:
-            case CmpStmt::FCMP_OGE:
-            case CmpStmt::FCMP_UGE:
-            {
-                if (lhs.size() == 1 && rhs.size() == 1)
+                case CmpStmt::ICMP_NE:
+                case CmpStmt::FCMP_ONE:
+                case CmpStmt::FCMP_UNE:
                 {
-                    resVal = IntervalValue(*lhs.begin() >= *rhs.begin());
+                    if (lhs.hasIntersect(rhs))
+                    {
+                        resVal = IntervalValue(0, 1);
+                    }
+                    else if (lhs.empty() && rhs.empty())
+                    {
+                        resVal = IntervalValue(0, 0);
+                    }
+                    else
+                    {
+                        resVal = IntervalValue(1, 1);
+                    }
+                    break;
                 }
-                else
+                case CmpStmt::ICMP_UGT:
+                case CmpStmt::ICMP_SGT:
+                case CmpStmt::FCMP_OGT:
+                case CmpStmt::FCMP_UGT:
                 {
-                    resVal = IntervalValue(0, 1);
+                    if (lhs.size() == 1 && rhs.size() == 1)
+                    {
+                        resVal = IntervalValue(*lhs.begin() > *rhs.begin());
+                    }
+                    else
+                    {
+                        resVal = IntervalValue(0, 1);
+                    }
+                    break;
                 }
-                break;
-            }
-            case CmpStmt::ICMP_ULT:
-            case CmpStmt::ICMP_SLT:
-            case CmpStmt::FCMP_OLT:
-            case CmpStmt::FCMP_ULT:
-            {
-                if (lhs.size() == 1 && rhs.size() == 1)
+                case CmpStmt::ICMP_UGE:
+                case CmpStmt::ICMP_SGE:
+                case CmpStmt::FCMP_OGE:
+                case CmpStmt::FCMP_UGE:
                 {
-                    resVal = IntervalValue(*lhs.begin() < *rhs.begin());
+                    if (lhs.size() == 1 && rhs.size() == 1)
+                    {
+                        resVal = IntervalValue(*lhs.begin() >= *rhs.begin());
+                    }
+                    else
+                    {
+                        resVal = IntervalValue(0, 1);
+                    }
+                    break;
                 }
-                else
+                case CmpStmt::ICMP_ULT:
+                case CmpStmt::ICMP_SLT:
+                case CmpStmt::FCMP_OLT:
+                case CmpStmt::FCMP_ULT:
                 {
-                    resVal = IntervalValue(0, 1);
+                    if (lhs.size() == 1 && rhs.size() == 1)
+                    {
+                        resVal = IntervalValue(*lhs.begin() < *rhs.begin());
+                    }
+                    else
+                    {
+                        resVal = IntervalValue(0, 1);
+                    }
+                    break;
                 }
-                break;
-            }
-            case CmpStmt::ICMP_ULE:
-            case CmpStmt::ICMP_SLE:
-            case CmpStmt::FCMP_OLE:
-            case CmpStmt::FCMP_ULE:
-            {
-                if (lhs.size() == 1 && rhs.size() == 1)
+                case CmpStmt::ICMP_ULE:
+                case CmpStmt::ICMP_SLE:
+                case CmpStmt::FCMP_OLE:
+                case CmpStmt::FCMP_ULE:
                 {
-                    resVal = IntervalValue(*lhs.begin() <= *rhs.begin());
+                    if (lhs.size() == 1 && rhs.size() == 1)
+                    {
+                        resVal = IntervalValue(*lhs.begin() <= *rhs.begin());
+                    }
+                    else
+                    {
+                        resVal = IntervalValue(0, 1);
+                    }
+                    break;
                 }
-                else
+                case CmpStmt::FCMP_FALSE:
+                    resVal = IntervalValue(0, 0);
+                    break;
+                case CmpStmt::FCMP_TRUE:
+                    resVal = IntervalValue(1, 1);
+                    break;
+                default:
                 {
-                    resVal = IntervalValue(0, 1);
+                    assert(false && "undefined compare: ");
                 }
-                break;
-            }
-            case CmpStmt::FCMP_FALSE:
-                resVal = IntervalValue(0, 0);
-                break;
-            case CmpStmt::FCMP_TRUE:
-                resVal = IntervalValue(1, 1);
-                break;
-            default:
-            {
-                assert(false && "undefined compare: ");
-            }
+                }
+                as[res] = resVal;
             }
-            as[res] = resVal;
         }
     }
 }
@@ -2052,8 +2144,8 @@ void AbstractInterpretation::updateStateOnCopy(const CopyStmt *copy)
         return IntervalValue::top(); // TODO: may have better solution
     };
 
-    auto getTruncValue = [](const AbstractState& as, const SVF::SVFVar* var,
-                            const SVFType* dstType)
+    auto getTruncValue = [&](const AbstractState& as, const SVF::SVFVar* var,
+                             const SVFType* dstType)
     {
         const IntervalValue& itv = as[var->getId()].getInterval();
         if(itv.isBottom()) return itv;
@@ -2070,7 +2162,7 @@ void AbstractInterpretation::updateStateOnCopy(const CopyStmt *copy)
             if (s8_lb > s8_ub)
             {
                 // return range of s8
-                return IntervalValue::top();
+                return this->getRangeLimitFromType(dstType);
             }
             return IntervalValue(s8_lb, s8_ub);
         }
@@ -2082,7 +2174,7 @@ void AbstractInterpretation::updateStateOnCopy(const CopyStmt *copy)
             if (s16_lb > s16_ub)
             {
                 // return range of s16
-                return IntervalValue::top();
+                return this->getRangeLimitFromType(dstType);
             }
             return IntervalValue(s16_lb, s16_ub);
         }
@@ -2094,7 +2186,7 @@ void AbstractInterpretation::updateStateOnCopy(const CopyStmt *copy)
             if (s32_lb > s32_ub)
             {
                 // return range of s32
-                return IntervalValue::top();
+                return this->getRangeLimitFromType(dstType);
             }
             return IntervalValue(s32_lb, s32_ub);
         }

package/svf/lib/SVFIR/SVFFileSystem.cpp

@@ -549,7 +549,6 @@ cJSON* SVFIRWriter::contentToJson(const SVFFunction* value)
     F(realDefFun);
     F(allBBs);
     F(allArgs);
-    F(annotations);
 #undef F
     return root;
 }
@@ -2357,7 +2356,6 @@ void SVFIRReader::fill(const cJSON*& fieldJson, SVFFunction* value)
     F(realDefFun);
     F(allBBs);
     F(allArgs);
-    F(annotations);
 #undef F
 }