[Soot-list] information returned from DemandCS pointto analysis misses context
LIU Peng
lpxz at ust.hk
Tue Aug 4 13:57:10 EDT 2009
Dear Eric:
As mentioned in last email, I tried DemandCS pointto analysis. But I
found in the AllocAndContext returned using reachingObjects(iBase),
the contexts are empty but alloc is not empty.
To be more detailed:
1 subject class:
public class TestMethods {
public static void A()
{
Run1 run1 = new Run1();
D(run1);
}
public static void B()
{
Run2 run2 = new Run2();
D(run2);
}
public static void C()
{
Run3 run3 = new Run3();
// D(run3);
}
public static void D(Runit r)
{
r.run();
}
public static void main(String[] args) // to be analyzed.
{
A();
B();
C();
}
}
2 trace:
//the analysis start from main body, and when meet with an invoking stmt,
analyze the corresponding method immediately.
This is part of my console information :
[Call Graph] For information on where the call graph may be incomplete,
use the verbose option to the cg phase.
[Spark] Pointer Assignment Graph in 2.4 seconds.
[Spark] Type masks in 1.0 seconds.
[Spark] Pointer Graph simplified in 0.0 seconds.
[Spark] Propagation in 157.3 seconds.
[Spark] Solution found in 157.4 seconds.
[Spark] Initialized on-demand refinement-based context-sensitive analysis
in 18.2 seconds.
==>method:<TestMethods: void main(java.lang.String[])>
args := @parameter0: java.lang.String[]
staticinvoke <TestMethods: void A()>()
{ =====================================
==>method:<TestMethods: void A()>
$r0 = new Run1
specialinvoke $r0.<Run1: void <init>()>()
AllocNode 32 new Run1 in method <TestMethods: void A()><--> ibase:$r0
{ =====================================
==>method:<Run1: void <init>()>
this := @this: Run1
specialinvoke this.<java.lang.Object: void <init>()>()
AllocNode 32 new Run1 in method <TestMethods: void A()><--> ibase:this
return
<==method:<Run1: void <init>()>
===================================== }
run1 = $r0
staticinvoke <TestMethods: void D(Runit)>(run1)
{ =====================================
==>method:<TestMethods: void D(Runit)>
r := @parameter0: Runit
interfaceinvoke r.<Runit: void run()>()
(I hope to get context information here.)!!!!!!!!!!!!!!!!!!!!!!!!!
AllocNode 32 new Run1 in method <TestMethods: void A()><--> ibase:r
AllocNode 31 new Run2 in method <TestMethods: void B()><--> ibase:r
{ =====================================
==>method:<Run2: void run()>
this := @this: Run2
$r0 = <java.lang.System: java.io.PrintStream out>
virtualinvoke $r0.<java.io.PrintStream: void
println(java.lang.String)>("B is runnning")
AllocNode 8 new java.io.PrintStream in method <java.lang.System: void
initializeSystemClass()><--> ibase:$r0
return
<==method:<Run2: void run()>
==>method:<Run1: void run()>
this := @this: Run1
$r0 = <java.lang.System: java.io.PrintStream out>
virtualinvoke $r0.<java.io.PrintStream: void
println(java.lang.String)>("A is runnning")
AllocNode 8 new java.io.PrintStream in method <java.lang.System: void
initializeSystemClass()><--> ibase:$r0
return
<==method:<Run1: void run()>
===================================== }
return
<==method:<TestMethods: void D(Runit)>
===================================== }
3 problem:
The problem is for interfaceinvoke r.<Runit: void run()>(), I want
its pointTo set of r is context-sensitive, to be concrete, I
want:
r points to "AllocNode 32 new Run1 in method <TestMethods: void A()>"
when r.<Runit: void run()>() is called under context "A()"
r points to "AllocNode 31 new Run2 in method <TestMethods: void B()>"
when r.<Runit: void run()>() is called under context "B()"
but when I use the following code to query.
PointsToSet p2base= MyAnalysis.paDemand.reachingObjects(iBase);
if(base instanceof AllocAndContextSet) // spark use this way, can use
forall implementation
{//
for (AllocAndContext allocAndContext : ((AllocAndContextSet)base)) {
System.out.println(""+allocAndContext.alloc+"");
filter2.add(allocAndContext);// type
}
}
I find that alloc is right. but the integer stack of context is empty
during debug mode. so I can get no assistant information about context
-sensitive.
Do you know what is wrong with my analysis?
Thanks
Regards
Peng
More information about the Soot-list
mailing list