[Soot-list] Paddle: All points-to sets of a field

[Eric Bodden]

Hello again.

> I'm interested in all contexts in which the field has a value, and that
> for all "host" objects (i.e. all instances of C).
>
> So by "all points-to
> sets" of a particular field f, I basically mean the results of calling
>  PointsToAnalysis.reachingObjects(c, l, f)
> for all c and l where the returned set is non-empty.

I am a bit confused because first you say that you want a
context-sensitive analysis and then you want to project the context
away again (by joining over all c). So why use a context-sensitive
analysis in the first place? For example, if you just use Spark, which
is context-insensitive, with a field-based mode (see
http://www.sable.mcgill.ca/soot/tutorial/phase/) then this will join
together the results for "all host objects".

> My question is how to find all the host objects of f and the contexts in
> which they appear.

To find all statements that access a field f you would need to iterate
through all method bodies of the program. For every statement you can
check containsFieldRef(). Then you can check the field reference to
see if it points to the field you are looking for. Last but not least
you could then use the results of the points-to analysis to see which
of these field accesses may access the same host object.

Do you think this would work?

Eric