[Soot-list] Sideeffectanalysis

[Eric Bodden]

Hi Jochen.


If I am not mistaken then you are looking for a 1-object-sensitive
analysis. I think Ondrej wrote a paper a while ago in which he found
out that object-sensitivity usually works best and a context length of
1 is often sufficient - at least that's what I remember.

Eric

On 4 March 2011 14:42, Jochen Huck <jochen.huck at student.kit.edu> wrote:
> Hi,
>
> the current implementation of the sideeffectanalysis
> (soot.jimple.toolkits.pointer.SideEffectAnalysis) is context-insensitive
> and therefore really imprecise. For
>
> class Foo {
>     int i;
>     public static void main(String[] args) {
>         Foo f1 = new Foo();
>         Foo f2 = new Foo();
>         f1.inc();
>         f2.inc();
>     }
>     public void inc() {
>         i++;
>     }
> }
>
> it reports that f1.inc() and f2.inc() have the same dependencies, since
> the analysis is context-insensitive.
>
> I would like to improve the precisson using Paddle. Which option (1cfg,
> object-sensitive) would I need, that it is possible to infer that the
> calls to inc() have no dependencies?
> I will have to rewrite some methods of SideEffectAnalysis and
> SideEffectTagger. Any suggestions how difficult that would be?
>
> Thanks,
> Jochen
>
>
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>



-- 
Dr. Eric Bodden, http://bodden.de/
Principal Investigator in Secure Services at CASED
Coordinator of the CASED Advisory Board of Study Affairs
PostDoc at Software Technology Group, Technische Universität Darmstadt
Tel: +49 6151 16-5478    Fax: +49 6151 16-5410
Mailing Address: S2|02 A209, Hochschulstraße 10, 64289 Darmstadt