[Soot-list] points-to analysis question

[manu_s at EECS.Berkeley.EDU]

The reason that Soot doesn't find the may-alias you want isn't just because it doesn't see a Hello object being created; there is only an alias between G and H when the same Hello value is passed to foo() and bar().  The real issue is that Soot's pointer analyses (or at least the subset-based analysis) are whole-program, ie. they assume they have analyzed all the code in the program, so any aliasing relationships created by other code will be missed.  I think to use Soot's pointer analyses off-the-shelf, you'd have to generate harness code like what you show.  Someone else can correct me if I'm wrong.

-Manu  
 
----- Original Message -----
From: Mayur Naik <mhn at cs.stanford.edu>
Date: Saturday, March 26, 2005 6:59 am
Subject: [Soot-list] points-to analysis question

> 
> I have a question about the way Soot does points-to analysis of 
> open 
> programs.  Consider the program:
> 
> public class Hello {
>     static Hello H;
>     static Hello G;
>     public static void foo(Hello x) { H = x; }
>     public static void bar(Hello y) { G = y; }
> }
> 
> A conservative points-to analysis should report that the fields H 
> and G 
> are may-aliased, right?  But Soot reports that they aren't.  I'm 
> using the 
> options:
> 
> -w -p cg all-reachable:true -p cg.cha enabled:false -p cg.spark 
> enabled:true
> 
> I understand that it does so (and so do other frameworks I've 
> used) 
> because it doesn't see any object of class Hello created, but I 
> want to 
> know whether there's any other option by which I can get Soot to 
> report 
> that they are may-aliased.  I could add a harness to the above class:
> 
>     public static void main(String args[]) {
>          Hello h = new Hello();
>          foo(h);
>          bar(h);
>     }
> 
> and then Soot does report that H and G are aliased, but I'm using 
> Soot for 
> building a tool for detecting concurrency bugs in huge open Java 
> programs, 
> and I want to know if I can get conservative points-to results as 
> in the 
> above example without writing a harness like the main method.
> 
> Thanks,
> -- Mayur
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://www.sable.mcgill.ca/mailman/listinfo/soot-list
>