[Soot-list] Backtracing local variable

[Marc-Andre Laverdiere-Papineau]

Hello,

To add to the very good summary that Eric gave, there are also variants 
that could be relevant for you.

A good paper, in my opinion, on the subject is the following:
http://www.cs.tau.ac.il/~omertrip/pldi09/paper.pdf

Note that the implementation done by the authors is in WALA, but there 
is no "secret sauce" that they have that Soot doesn't have ;)


Marc-André Laverdière-Papineau
Doctorant - PhD Candidate

On 13-01-14 11:19 PM, Eric Bodden wrote:
> Hi Jörg.
>
>> I would like to use soot for tracing back a given Local inside a function.
>> Meaning I would like to identify all Units which can effect a given local
>> variable.
>> I would assume this should be doable using the BackwardFlowAnalysis, but yet
>> unsure how exactly.
>>
>> Are there any pointers or examples for such kind of (easy?) problem?
>
> Essentially what you are looking for is called a "backwards slice".
> The first question to ask here is generally whether you would like to
> include in this slice only data dependencies or also control
> dependencies such as:
>
> if(p) //here myTrackedVariable is control dependent on p
>    myTrackedVariable=1;
>
> In general, if an intra-procedural analysis is good enough for you
> then BackwardFlowAnalysis is the right choice. If you want to go
> inter-procedural then you can either use a hand-crafted combination of
> BackwardFlowAnalysis instances (one per method) or use Heros
> (https://github.com/Sable/heros).
>
> The thing you need to think about is then your abstract domain, i.e.,
> what analysis information to propagate. That depends on whether you
> just want to track local variables or also field and array
> assignments. I am happy to give you further assistance here, but I'd
> need to know more about the actual analysis problem you are trying to
> solve.
>
> Cheers,
> Eric
>