[Soot-list] Spark and aliasing analysis

[Lei Shang]

Spark is a context-insensitive analysis, which cannot distinguish the
object from factory method (getNew) as they regard (new Object) as the same
memory location. That's why context-sensitivity is needed to get more
precise results.

You should try context-sensitive analyses (cs-demand or geom-pta provided
in soot-2.5.0).

Lei


2012/5/9 Florian Strauß <f_straus at informatik.uni-kl.de>

> Hello,****
>
> ** **
>
> thanks for the helpful tools / framework Soot and Spark. ****
>
> In my settings, something is wrong. In want to find out, if two variables
> may point to the same object. Therefore I compare the PointsToSets of these
> variables. ****
>
> Example:****
>
>              Object o5 = *new* Object();****
>
>              Object o6 = *new* Object();****
>
> ** **
>
> This example works fine. In my analyzer the following lines return false:
> ****
>
> ** **
>
> PointsToAnalysis pointsToGraph = Scene.v().getPointsToAnalysis();****
>
> PointsToSet pts1 = pointsToGraph.reachingObjects(localO5);****
>
> PointsToSet pts2 = pointsToGraph.reachingObjects(localO6);****
>
> return pts1.hasNonEmptyIntersection(pts2);****
>
> ** **
>
> The next example is similar:****
>
>               ClassA k1 = *new* ClassA();****
>
>              ClassA k2 = *new* ClassA();****
>
>               ****
>
> Object o7 = k1.getNewO();****
>
>              Object o8 = k2.getNewO();****
>
> ** **
>
>              ….****
>
>              //In class ClassA:****
>
> *public* Object getNewO() {****
>
>                     *return* *new* Object();****
>
>               }****
>
> ** **
>
> But in this case, the framework says that the two pointsTo-Sets (of o7 and
> o8) has an non empty intersection. ****
>
> Furthermore, I found out that the base of a method call is always ignored.
> The consequence is that for example two iterator, which are returned by
> java.util.AbstractList, point to the same objects even if the list
> instances and elements are different.  ****
>
> Is there any option to make the analysis / pointsTo-set more precise?****
>
> ** **
>
> I am using soot 2.5 and the following options:****
>
> //Soot:****
>
>              Options.*v*().set_keep_line_number(*true*);****
>
>              Options.*v*().set_app(*true*);****
>
>              Options.*v*().set_xml_attributes(*true*);****
>
>              Options.*v*().set_whole_program(*true*);****
>
> ** **
>
>              PhaseOptions.*v*().setPhaseOption("jb" ,
> "use-original-names:true"); // use original names****
>
>              PhaseOptions.*v*().setPhaseOption("jb.ulp" , "enabled:false");
> // do not minimize the number of stack variables****
>
>              PhaseOptions.*v*().setPhaseOption("jj" ,
> "use-original-names:true");****
>
>              PhaseOptions.*v*().setPhaseOption("jj.ulp" , "enabled:false"
> );****
>
>              PhaseOptions.*v*().setPhaseOption("jj.a",
> "only-stack-locals:false");****
>
> ** **
>
>              //Spark:****
>
>              Options.*v*().setPhaseOption("cg","implicit-entry:false");***
> *
>
>              Options.*v*().setPhaseOption("cg.spark","enabled:true");****
>
>              ****
>
>              //explicit:****
>
>              Options.*v*().setPhaseOption("cg.spark","field-based:false");
> ****
>
>              Options.*v*().setPhaseOption("cg.spark",
> "types-for-sites:false");****
>
>              ****
>
>              ****
>
>              *if*(*IN_DEBUG_MODE*){****
>
>                     soot.options.Options.*v*().setPhaseOption("cg.spark",
> "verbose:true");****
>
>              }****
>
> ** **
>
> I tried the field-based options, but it does not matter if the option is
> true or false. The outcome is the same.  ****
>
> ** **
>
> Do you have any ideas?****
>
> ** **
>
> ** **
>
> Best regards,****
>
>        Florian****
>
> ** **
>
> ** **
>
> Btw. I am not able to access the website any more:
> http://www.sable.mcgill.ca/****
>
> Is this a local problem or did someone else notice it?****
>
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.cs.mcgill.ca/pipermail/soot-list/attachments/20120510/facefed0/attachment-0001.html