[Soot-list] wrong result for method reachObjects(local, field) in points-to analysis

[Ondrej Lhotak]

At one point in the execution of your program (between the lines w.f = x
and w.x = y), w.f *does* point to the object pointed to by x. Therefore,
this object must be included in the points-to set for w.f.

In general, Spark is flow-insensitive, meaning that it computes a
single solution which is true for the entire program execution,
rather than computing different solutions for specific program
points.

Ondrej


On Tue, Mar 07, 2006 at 04:55:33PM -0500, Aiwu Shi wrote:
>    hi,
>     
>    I use a simple program to test my points-to analysis.
>     
>    I am not extending Soot in the recommended way, but just calling into
>    Soot/Spark directly like the following:
>     
>    //set the PointsToAnalysis with phase options
>      options.put("enabled", "true");
>      options.put("on-fly-cg", "true");
>      options.put("set-impl", "hybrid");
>      options.put("propagator", "worklist");
>      options.put("verbose", "true"); 
>      SparkTransformer.v().transform("cg.spark",options);
>     
>    I want to get the PointsToSet for the field f of local variable w, that
>    is, the PointsToSet of w.f. after my analysis, I got the PointsToSet
>    include two AllocNode, one is AllocNode for x, the other is AllocNode for
>    y.
>    in fact, we can know, the w.f should only contain the AllocNode of y.
>    so, is there a bug for the method of reachObject(local, field)? please
>    explain for me. thanks
>     
>    Aiwu
>     
> 
>    my analyzed sample class is followed:
>     
>    class Sample{
>     private C f;  
>     
>     public C f2( ){
>      C x;
>      C y;
>      Sample w=new Sample();
>      x = new C();
>      y = new C();
>      
>      w.f=x;
>      w.f=y;
>      
>      return x;
>     }
>    }

> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list