[Soot-list] Incomplete Call Graph for Web Application

[Marc-Andre Laverdiere-Papineau]

This is a very interesting discussion, thanks for sharing.

The bigger problem I have is that JEE applications are meant to be coded 
against the spec and it is a lot of interfaces. That means that both the 
programmer and the analyzer have no clue about the real points-to target 
are.

Further, we have the fact that each container will have a different 
implementation of those. So, CHA isn't super helpful for that use case. 
I can't code an analysis that depends on Glassfish being on the 
classpath for instance.

In other words, we'd need a call graph algorithm that can point to an 
interface and leave it at that if need be. I don't recall a Spark option 
to enable that. Any pointers to make it happen?

Regards,

Marc-André Laverdière-Papineau
Doctorant - PhD Candidate

On 12-12-12 03:32 PM, Eric Bodden wrote:
> Hi Tony.
>
>> I have similar questions too. Is it possible to have Soot perform an
>> analysis of mixed precisions? Here is what I mean: when the points-to
>> set is not empty, let SPARK do what it used to do; when it is empty,
>> let it fall back to a CHA solution.
>
> Not out of the box. I guess you could instantiate two call graphs, but
> it would involve some manual coding because Soot is not set up to have
> more than one call graph at a time. It may be simpler to just compute
> Spark's normal call-graph and then program a CHA-like call graph on
> your own. It's not hard: you just need to match call sites against the
> possible call targets in the class hierarchy.
>
> About using CHA in general: I tried this with Soot yesterday and I
> found that it works if all-reachable is enabled, see here:
> http://www.sable.mcgill.ca/soot/tutorial/phase/
>
> Eric
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>