public static Address getSpacebaseReferenceAddress(AddressFactory addrFactory, PcodeOp op) {
		Address storageAddress = null;
		if (op == null) {
			return storageAddress;
		}
		if (op.getOpcode() == PcodeOp.PTRSUB) {
			Varnode vnode = op.getInput(0);
			Varnode cnode = op.getInput(1);
			if (vnode.isRegister()) {
				AddressSpace stackspace = addrFactory.getStackSpace();
				if (stackspace != null) {
					storageAddress = stackspace.getAddress(cnode.getOffset());
				}
			}
			else {
				AddressSpace space = addrFactory.getDefaultAddressSpace();
				if (space instanceof SegmentedAddressSpace) {
					// Assume this is a "full" encoding of the offset
					int innersize = space.getPointerSize();
					int base = (int) (cnode.getOffset() >>> 8 * innersize);
					int off = (int) cnode.getOffset() & ((1 << 8 * innersize) - 1);
					storageAddress = ((SegmentedAddressSpace) space).getAddress(base, off);
				}
				else {
					storageAddress = space.getAddress(cnode.getOffset());
				}
			}
		}
		return storageAddress;
	}
Get the Address referred to by a spacebase reference. Address-of references are encoded in
the p-code syntax tree as: {@code vn = PTRSUB(<spacebase>, #const)}.  This decodes the reference and
returns the Address
@param addrFactory is the factory used to construct the Address
@param op is the PTRSUB op encoding the reference
@return the recovered Address (or null if not correct form)
Ghidra/Framework/SoftwareModeling/src/main/java/ghidra/program/model/pcode/HighFunctionDBUtil.java