diff --git a/svf-llvm/include/SVF-LLVM/SymbolTableBuilder.h b/svf-llvm/include/SVF-LLVM/SymbolTableBuilder.h
index 18b07ffe54..d8d72912c6 100644
--- a/svf-llvm/include/SVF-LLVM/SymbolTableBuilder.h
+++ b/svf-llvm/include/SVF-LLVM/SymbolTableBuilder.h
@@ -94,6 +94,9 @@ class SymbolTableBuilder
     /// Analyse types of heap and static objects
     void analyzeStaticObjType(ObjTypeInfo* typeinfo, const Value* val);
 
+    /// Analyze byte size of heap alloc function (e.g. malloc/calloc/...)
+    u32_t analyzeHeapAllocByteSize(const Value* val);
+
     ///Get a reference to the components of struct_info.
     /// Number of flattened elements of an array or struct
     u32_t getNumOfFlattenElements(const Type* T);
diff --git a/svf-llvm/lib/SymbolTableBuilder.cpp b/svf-llvm/lib/SymbolTableBuilder.cpp
index 408ef72e47..73f3fbf740 100644
--- a/svf-llvm/lib/SymbolTableBuilder.cpp
+++ b/svf-llvm/lib/SymbolTableBuilder.cpp
@@ -669,6 +669,64 @@ void SymbolTableBuilder::analyzeObjType(ObjTypeInfo* typeinfo, const Value* val)
         typeinfo->setFlag(ObjTypeInfo::HASPTR_OBJ);
 }
 
+/*!
+ * Analyze byte size of heap alloc function (e.g. malloc/calloc/...)
+ */
+u32_t SymbolTableBuilder::analyzeHeapAllocByteSize(const Value* val) {
+    if (const llvm::CallInst* callInst = llvm::dyn_cast<llvm::CallInst>(val))
+    {
+        if (const llvm::Function* calledFunction = callInst->getCalledFunction()) {
+            const SVFFunction* svfFunction = LLVMModuleSet::getLLVMModuleSet()->getSVFFunction(calledFunction);
+            std::vector<const Value*> args;
+            // Heap alloc functions have annoation like "AllocSize:Arg1"
+            for (std::string annotation: svfFunction->getAnnotations()) {
+                if (annotation.find("AllocSize:") != std::string::npos) {
+                    std::string allocSize = annotation.substr(10);
+                    std::stringstream ss(allocSize);
+                    std::string token;
+                    // Analyaze annotation string and attract Arg list
+                    while (std::getline(ss, token, '*')) {
+                        if (token.rfind("Arg", 0) == 0) {
+                            int argIndex;
+                            std::istringstream(token.substr(3)) >> argIndex;
+                            if (argIndex < callInst->getNumOperands() - 1) {
+                                args.push_back(callInst->getArgOperand(argIndex));
+                            }
+                        }
+                    }
+                }
+            }
+            uint64_t product = 1;
+            if (args.size() > 0)
+            {
+                // for annotations like "AllocSize:Arg0*Arg1"
+                for (const llvm::Value* arg : args)
+                {
+                    if (const llvm::ConstantInt* constIntArg =
+                            llvm::dyn_cast<llvm::ConstantInt>(arg))
+                    {
+                        // Multiply the constant Value if all Args are const
+                        product *= constIntArg->getZExtValue();
+                    }
+                    else
+                    {
+                        // if Arg list has non-const value, return 0 to indicate it is non const byte size
+                        return 0;
+                    }
+                }
+                // If all the Args are const, return product
+                return product;
+            }
+            else {
+                // for annotations like "AllocSize:UNKNOWN"
+                return 0;
+            }
+        }
+    }
+    // if it is not CallInst or CallInst has no CalledFunction, return 0 to indicate it is non const byte size
+    return 0;
+}
+
 /*!
  * Analyse types of heap and static objects
  */
@@ -715,6 +773,8 @@ void SymbolTableBuilder::initTypeInfo(ObjTypeInfo* typeinfo, const Value* val,
 {
 
     u32_t elemNum = 1;
+    // init byteSize = 0, If byteSize is changed in the following process,
+    // it means that ObjTypeInfo has a Constant Byte Size
     u32_t byteSize = 0;
     // Global variable
     // if val is Function Obj, byteSize is not set
@@ -725,6 +785,7 @@ void SymbolTableBuilder::initTypeInfo(ObjTypeInfo* typeinfo, const Value* val,
         elemNum = getNumOfElements(objTy);
     }
     /// if val is AllocaInst, byteSize is Type's LLVM ByteSize * ArraySize
+    /// e.g. alloc i32, 10. byteSize is 4 (i32's size) * 10 (ArraySize) = 40
     else if(const AllocaInst* allocaInst = SVFUtil::dyn_cast<AllocaInst>(val))
     {
         typeinfo->setFlag(ObjTypeInfo::STACK_OBJ);
@@ -740,11 +801,11 @@ void SymbolTableBuilder::initTypeInfo(ObjTypeInfo* typeinfo, const Value* val,
         else
         {
             elemNum = getNumOfElements(objTy);
-            byteSize = typeinfo->getType()->getLLVMByteSize();
-            typeinfo->setStaticDeterminedByteSize(false);
+            byteSize = 0;
         }
     }
     /// if val is GlobalVar, byteSize is Type's LLVM ByteSize
+    /// All GlobalVariable must have constant size
     else if(SVFUtil::isa<GlobalVariable>(val))
     {
         typeinfo->setFlag(ObjTypeInfo::GLOBVAR_OBJ);
@@ -763,56 +824,11 @@ void SymbolTableBuilder::initTypeInfo(ObjTypeInfo* typeinfo, const Value* val,
         analyzeHeapObjType(typeinfo,val);
         // Heap object, label its field as infinite here
         elemNum = typeinfo->getMaxFieldOffsetLimit();
-        if (const llvm::CallInst* callInst = llvm::dyn_cast<llvm::CallInst>(val))
-        {
-            if (const llvm::Function* calledFunction =
-                    callInst->getCalledFunction())
-            {
-                std::string functionName = calledFunction->getName().str();
-                // Check if the function called is 'malloc' and process its argument.
-                // if arg is constant, set byteSize, otherwise byteSize is not static determined.
-                if (functionName == "malloc" && callInst->getNumOperands() > 0)
-                {
-                    if (const llvm::ConstantInt* arg =
-                            llvm::dyn_cast<llvm::ConstantInt>(
-                                callInst->getArgOperand(0)))
-                    {
-                        byteSize = arg->getZExtValue();
-                    }
-                    else {
-                        typeinfo->setStaticDeterminedByteSize(false);
-                    }
-                }
-                // Check if the function called is 'calloc' and process its arguments.
-                // if both arg0 and arg1 is constant, set byteSize,
-                // otherwise byteSize is not static determined.
-                else if (functionName == "calloc" &&
-                         callInst->getNumOperands() > 1)
-                {
-                    if (const llvm::ConstantInt* arg1 =
-                            llvm::dyn_cast<llvm::ConstantInt>(
-                                callInst->getArgOperand(0)))
-                    {
-                        if (const llvm::ConstantInt* arg2 =
-                                llvm::dyn_cast<llvm::ConstantInt>(
-                                    callInst->getArgOperand(1)))
-                        {
-                            byteSize = arg1->getZExtValue() * arg2->getZExtValue();
-                        } else {
-                            typeinfo->setStaticDeterminedByteSize(false);
-                        }
-                    } else {
-                        typeinfo->setStaticDeterminedByteSize(false);
-                    }
-                }
-                // Other function, let ByteSize be non-static determined.
-                else
-                {
-                    typeinfo->setStaticDeterminedByteSize(false);
-                }
-            }
-        }
-
+        // analyze heap alloc like (malloc/calloc/...), the alloc functions have
+        // annotation like "AllocSize:Arg1". Please refer to extapi.c.
+        // e.g. calloc(4, 10), annotation is "AllocSize:Arg0*Arg1",
+        // it means byteSize = 4 (Arg0) * 10 (Arg1) = 40
+        byteSize = analyzeHeapAllocByteSize(val);
     }
     else if(ArgInProgEntryFunction(val))
     {
@@ -836,9 +852,12 @@ void SymbolTableBuilder::initTypeInfo(ObjTypeInfo* typeinfo, const Value* val,
     // Reset maxOffsetLimit if it is over the total fieldNum of this object
     if(typeinfo->getMaxFieldOffsetLimit() > elemNum)
         typeinfo->setNumOfElements(elemNum);
-    if(typeinfo->isStaticDeterminedByteSize())
-        typeinfo->setByteSizeOfObj(byteSize);
 
+    // set ByteSize. If ByteSize > 0, this typeinfo has constant type.
+    // If ByteSize == 0, this typeinfo has 1) zero byte 2) non-const byte size
+    // If ByteSize>MaxFieldLimit, set MaxFieldLimit to the byteSize;
+    byteSize = Options::MaxFieldLimit() > byteSize? byteSize: Options::MaxFieldLimit();
+    typeinfo->setByteSizeOfObj(byteSize);
 }
 
 /*!
diff --git a/svf-llvm/lib/extapi.c b/svf-llvm/lib/extapi.c
index 3280d8e95f..e263bb8e59 100644
--- a/svf-llvm/lib/extapi.c
+++ b/svf-llvm/lib/extapi.c
@@ -14,541 +14,541 @@
         MEMCPY,       // memset() operations
         OVERWRITE,    // svf function overwrite app function
 */
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *malloc(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *fopen(const char *voidname, const char *mode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *fopen64(const char *voidname, const char *mode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *fdopen(int fd, const char *mode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 struct dirent64 *readdir64(void *dirp)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *tmpvoid64(void)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0*Arg1")))
 void *calloc(unsigned long nitems, unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *zmalloc(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *gzdopen(int fd, const char *mode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *iconv_open(const char *tocode, const char *fromcode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *lalloc(unsigned long size, int a)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *lalloc_clear(unsigned long size, int a)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 long *nhalloc(unsigned int a, const char *b, int c)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *oballoc(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *popen(const char *command, const char *type)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *pthread_getspecific(const char *a, const char *b)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 struct dirent *readdir(void *dirp)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0*Arg1")))
 void* safe_calloc(unsigned nelem, unsigned elsize)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void* safe_malloc(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0*Arg1")))
 char* safecalloc(int a, int b)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 char* safemalloc(int a, int b)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *setmntent(const char *voidname, const char *type)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *shmat(int shmid, const void *shmaddr, int shmflg)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void* __sysv_signal(int a, void *b)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void (*signal(int sig, void (*func)(int)))(int)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *tempnam(const char *dir, const char *pfx)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *tmpvoid(void)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void* xcalloc(unsigned long size1, unsigned long size2)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void* xmalloc(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *_Znam(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *_Znaj(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *_Znwj(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *__cxa_allocate_exception(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg1")))
 void* aligned_alloc(unsigned long size1, unsigned long size2)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg1")))
 void* memalign(unsigned long size1, unsigned long size2)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *valloc(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg1")))
 void *mmap64(void *addr, unsigned long len, int prot, int flags, int fildes, long off)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *XSetLocaleModifiers(char *a)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char * __strdup(const char * string)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *crypt(const char *key, const char *salt)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *ctime(const void *timer)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *dlerror(void)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *dlopen(const char *voidname, int flags)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 const char *gai_strerror(int errcode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 const char *gcry_cipher_algo_name(int errcode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 const char *svfgcry_md_algo_name_(int errcode)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *getenv(const char *name)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *getlogin(void)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *getpass(const char *prompt)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 const char * gnutls_strerror(int error)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 const char *gpg_strerror(unsigned int a)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 const char * gzerror(void* file, int * errnum)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *inet_ntoa(unsigned int in)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *initscr(void)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void* llvm_stacksave()
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg1")))
 void *mmap(void *addr, unsigned long len, int prot, int flags, int fildes, long off)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *newwin(int nlines, int ncols, int begin_y, int begin_x)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *nl_langinfo(int item)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *opendir(const char *name)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void *sbrk(long increment)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *strdup(const char *s)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *strerror(int errnum)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *strsignal(int errnum)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *textdomain(const char * domainname)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *tgetstr(char *id, char **area)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *tigetstr(char *capname)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *tmpnam(char *s)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *ttyname(int fd)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *getcwd(char *buf, unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:Arg1")))
 char *mem_realloc(void *ptr, unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:Arg1")))
 char *realloc(void *ptr, unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:Arg1")))
 void* safe_realloc(void *p, unsigned long n)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:Arg1*Arg2")))
 void* saferealloc(void *p, unsigned long n1, unsigned long n2)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 void* safexrealloc()
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *strtok(char *str, const char *delim)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:UNKNOWN")))
 char *strtok_r(char *str, const char *delim, char **saveptr)
 {
     return NULL;
 }
 
-__attribute__((annotate("REALLOC_RET")))
+__attribute__((annotate("REALLOC_RET"), annotate("AllocSize:Arg1")))
 void *xrealloc(void *ptr, unsigned long bytes)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *_Znwm(unsigned long size)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *_ZnwmRKSt9nothrow_t(unsigned long size, void *)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 void *_ZnamRKSt9nothrow_t(unsigned long size, void *)
 {
     return NULL;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int asprintf(char **restrict strp, const char *restrict fmt, ...)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int vasprintf(char **strp, const char *fmt, void* ap)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int db_create(void **dbp, void *dbenv, unsigned int flags)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int gnutls_pkcs12_bag_init(void *a)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int gnutls_pkcs12_init(void *a)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int gnutls_x509_crt_init(void *a)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:UNKNOWN")))
 int gnutls_x509_privkey_init(void *a)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG0")))
+__attribute__((annotate("ALLOC_ARG0"), annotate("AllocSize:Arg2")))
 int posix_memalign(void **a, unsigned long b, unsigned long c)
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG1")))
+__attribute__((annotate("ALLOC_ARG1"), annotate("AllocSize:UNKNOWN")))
 int scandir(const char *restrict dirp, struct dirent ***restrict namelist, int (*filter)(const struct dirent *), int (*compar)(const struct dirent **, const struct dirent **))
 {
     return 0;
 }
 
-__attribute__((annotate("ALLOC_ARG2")))
+__attribute__((annotate("ALLOC_ARG2"), annotate("AllocSize:UNKNOWN")))
 int XmbTextPropertyToTextList(void *a, void *b, char ***c, int *d)
 {
     return 0;
@@ -664,7 +664,7 @@ void* _ZNSt5arrayIPK1ALm2EE4backEv(void *arg)
     return ptr2;
 }
 
-__attribute__((annotate("ALLOC_RET")))
+__attribute__((annotate("ALLOC_RET"), annotate("AllocSize:Arg0")))
 __attribute__((annotate("OVERWRITE")))
 void *SyGetmem(unsigned long size)
 {
diff --git a/svf/include/AbstractExecution/IntervalValue.h b/svf/include/AbstractExecution/IntervalValue.h
index 87909dae03..dec8c8152c 100644
--- a/svf/include/AbstractExecution/IntervalValue.h
+++ b/svf/include/AbstractExecution/IntervalValue.h
@@ -663,7 +663,7 @@ inline IntervalValue operator<(const IntervalValue &lhs, const IntervalValue &rh
             // i.e., lhs is totally greater than or equal to rhs
             // When lhs.ub >= rhs.lb, e.g., lhs:[3, 4] rhs:[4，5]
             // lhs.ub(4) >= rhs.lb(4)
-            else if (rhs.ub().geq(lhs.lb()))
+            else if (lhs.ub().geq(rhs.lb()))
             {
                 return IntervalValue(0, 0);
             }
diff --git a/svf/include/SVFIR/SymbolTableInfo.h b/svf/include/SVFIR/SymbolTableInfo.h
index 704332d614..5719897bc0 100644
--- a/svf/include/SVFIR/SymbolTableInfo.h
+++ b/svf/include/SVFIR/SymbolTableInfo.h
@@ -441,8 +441,8 @@ class MemObj
     /// Get the byte size of this object
     u32_t getByteSizeOfObj() const;
 
-    /// Check if byte size is static determined
-    bool isStaticDeterminedByteSize() const;
+    /// Check if byte size is a const value
+    bool isConstantByteSize() const;
 
 
     /// object attributes methods
@@ -514,8 +514,6 @@ class ObjTypeInfo
 
     /// Byte size of object
     u32_t byteSize;
-    /// Flag if byte size is static determined
-    bool staticDeterminedByteSize{true};
 
     void resetTypeForHeapStaticObj(const SVFType* type);
 public:
@@ -561,6 +559,7 @@ class ObjTypeInfo
 
     /// Get the byte size of this object
     inline u32_t getByteSizeOfObj() const {
+        assert(isConstantByteSize() && "This Obj's byte size is not constant.");
         return byteSize;
     }
 
@@ -569,14 +568,9 @@ class ObjTypeInfo
         byteSize = size;
     }
 
-    /// Check if byte size is static determined
-    inline bool isStaticDeterminedByteSize() const {
-        return staticDeterminedByteSize;
-    }
-
-    /// Set true if byte size is static determined
-    inline void setStaticDeterminedByteSize(bool val) {
-        staticDeterminedByteSize = val;
+    /// Check if byte size is a const value
+    inline bool isConstantByteSize() const {
+        return byteSize != 0;
     }
 
     /// Flag for this object type
diff --git a/svf/lib/SVFIR/SymbolTableInfo.cpp b/svf/lib/SVFIR/SymbolTableInfo.cpp
index 25d6232f14..63394eaa21 100644
--- a/svf/lib/SVFIR/SymbolTableInfo.cpp
+++ b/svf/lib/SVFIR/SymbolTableInfo.cpp
@@ -436,9 +436,9 @@ u32_t MemObj::getByteSizeOfObj() const
 }
 
 /// Check if byte size is static determined
-bool MemObj::isStaticDeterminedByteSize() const
+bool MemObj::isConstantByteSize() const
 {
-    return typeInfo->isStaticDeterminedByteSize();
+    return typeInfo->isConstantByteSize();
 }