[Soot-list] Points-to analysis using SPARK

[Christophe Foket]

Hi,

I've got a question on how to treat the results of a points-to analysis 
performed using SPARK. Consider for instance the following 2-class program:

public abstract class Drawable {

     public void draw(){}
}

public class Circle extends Drawable {

     public void draw(){

         super.draw();
     }

     public static void main(String[] args){

         List<Drawable> drawables = new ArrayList<Drawable>();
         drawables.add(new Circle());

         for(Drawable drawable : drawables)
             drawable.draw();
     }
}

The jimple code for Drawable:draw() is

Drawable r0
r0 := @this: Drawable
return

Using SPARK as a points-to analysis,

     Scene.v().getPointsToAnalysis().reachingObjects(...).possibleTypes()

gives me the following set of types for the Local corresponding to r0:

[Any_subtype_of_java.lang.Thread, Any_subtype_of_java.lang.ClassLoader, 
Circle, Any_subtype_of_java.lang.Object, 
Any_subtype_of_java.security.PrivilegedActionException]

I expected this set to only include Circle (since Drawable is abstract). 
What is the purpose of the "Any_subtype_of_..." types? I suppose this 
covers all types that are subtypes of Object. However, these also 
include, e.g., String, which is definitely not a possible type for r0.

Can anyone shed any light on this?

Best,

Christophe