[Soot-list] Hi all, does PAG in soot take "clone" as another source of AllocNode?

Xinwei Xie xenway at gmail.com
Thu Jun 16 09:19:16 EDT 2011


Hi all,
Thanks for your attention.
Currently I am developing an algorithm that depends on the accuracy of
cs-demand point-to analysis. However, I found out that the PAG the
cs-demand pta uses doesn't take clone into account, which in fact is
another source of allocation node in the program. I did some
experiment:
//**************************//
class Element {
        Element f2;
        public Element get() throws CloneNotSupportedException {
                //Element t1 = new Element();
                Element t1 = (Element)f2.clone();
                Element t2;
                t1.f2 = this;
                t2 = t1.f2;
                if (t1 == t2)
                        return t1;
                else
                        return t2;
        }
}
//**************************//
I got such points-to set result of t1:

field: r1.<Element: Element f2> base: r1, points to []

Is there any "simple" way to take this into account? Thanks for any
further reply.

-- 
Xinwei XIE


More information about the Soot-list mailing list