[Soot-list] throw analysis

[John Jorgensen]

>>>>> "rugang" == Ru-Gang Xu <rugang at gmail.com> writes:

    rugang> ... my example is something like this:

    rugang> void doSomething() {}

    rugang> int method(int k) {
    rugang>  int i = 0;        //A
    rugang>  int j = 0;
    rugang>  try {
    rugang>    j = -1;         //B
    rugang>    i = j/k;        //C1
    rugang>    doSomething(); //C2
    rugang>  } catch (Exception e) {
    rugang>    i = 5;          //D
    rugang>  } catch (Error e) {
    rugang>    i = 6;          //E
    rugang>  } finally {
    rugang>    return j/i;     //F
    rugang>  }
    rugang> }

    rugang> So if you look at the CFG dotgraph, there is an edge from C2 to all
    rugang> the exception handlers.  I think although there should be edges to the
    rugang> first two catch blocks, but there should not be an edge going to the
    rugang> finally block. So I guess that the throwanalysis has correct
    rugang> conservative behavior because the catch blocks do not handle
    rugang> everything thats "Throwable."(i.e. if we add a "catch(Throwable e)",
    rugang> there is no edge to F).  However statically, you can tell the
    rugang> doSomething does not throw  anything special.

First, the exception analyses currently in Soot are strictly
intraprocedural, so during the construction of the CFG for
method(), doSomething() is considered as a black box that might
throw anything at all.

But even if the current analyses were smart enough to know that
doSomething() could not throw any Throwable that is not an Error
or an Exception (or if there was a catch(Throwable e) in the
scope of the finally), there would still need to be an edge from
C2 to F.  

C2 might throw an exception caught by D or E (or by your new
"catch(Throwable e)"), but then D or E (or the "catch(Throwable
e)" handler) might themselves throw an Error caught by F before
performing their computation (assigning to i, in the case of D
and E).  So there needs to be an edge from C2 to F to indicate
that it is possible, at F, that the computation described at C2
has been executed, without the computation at either of D or E
being executed.

-- 
John Jorgensen	LCD System Administrator  jorgnsn at lcd.uregina.ca
                                          306.337.2344