[Soot-list] Help with NPE PointsToAnalysis.reachingObjects(Context, Local) using Heros/Spark+Geom

[Henddher Pedroza]

Thank you very much Richard,

Given that I am using Heros (flow-sensitive and context-sensitive), what would be a suitable points-to-analysis for the case I am interested (this.dummy field)?

- Henddher

On May 20, 2013, at 10:10 AM, Richard Xiao <richardxx at cse.ust.hk> wrote:

> Hi, Pedroza:
> 
> Yes, your usage is wrong. Context means callsite in current implementation of Geom PTA. And in Spark, context version of reachingObjects is not supported.
> 
> You cannot observe the changes before/after the assignment with a flow-insensitive points-to analysis, because the points-to results for the pointer before/after the assignment are the same. You can only inspect what are returned by "doSomethingElse".
> 
> Cheers,
> Xiao
>  
> 
> 
> On Mon, May 20, 2013 at 10:30 PM, Henddher Pedroza <hpedro2 at uic.edu> wrote:
> Thank you Richard,
> 
> So I am using reachingObjects incorrectly in this case? (because I am using the wrong statement?)
> (Thus far, I am experimenting with every possible 'reachingObjects' call to see what I get back and it seems like in this particular stmt the use is invalid, right?)
> 
> In reality I am trying to get points-to-analysis for fields of instances: this.dummy 
> 
> I want to see what a field may be pointing to whenever an assignment involves that field. IOW, whenever there's an stmt with a field being set or being retrieved, I want to see what the field may point to before/after the assignment.
> Is such possible?
> 
> Thanks
> 
> On May 20, 2013, at 9:03 AM, Richard Xiao <richardxx at cse.ust.hk> wrote:
> 
>> Hi, Pedroza:
>> 
>> The first argument of "reachingObjects" is the callsite that invokes the enclosing method of the second argument. For your case, context should be the statement "anObj.doSomething();". Please try again.
>> 
>> Cheers,
>> Xiao
>> 
>> 
>> 
>> On Mon, May 20, 2013 at 9:48 PM, Henddher Pedroza <hpedro2 at uic.edu> wrote:
>> Hello, 
>> 
>> Any suggestions?
>> 
>> 
>> On May 17, 2013, at 10:58 AM, Henddher Pedroza <hpedro2 at uic.edu> wrote:
>> 
>>> Hello all:
>>> 
>>> Using Heros in combination with SPARK w/Geom (*), I am getting an NPE in CallGraph.findEdge(Unit, SootMethod) @ line 123 called from GeomPointsTo.reachingObjects(Context, Local) @ line 1504:
>>> 
>>> (*) cmd-line options:
>>> -p cg all-reachable:true,verbose:true,safe-forname:true,safe-newinstance:true -p cg.spark enabled:true,verbose:true,geom-pta:true,geom-eval:2
>>> 
>>> GeomPointsTo.reachingObjects(Context, Local):
>>> 1504: Edge e = Scene.v().getCallGraph().findEdge((Unit)c, callee);
>>> 
>>> CallGraph.findEdge(Unit, SootMethod): 
>>>     Edge findEdge( Unit u, SootMethod callee )
>>>     {
>>>     	Edge e = srcUnitToEdge.get(u);
>>> 123: 	while ( e.srcUnit() == u && // <<<< NPE, e is null
>>> 
>>> For my test, I am using one explicit entry point, discarding all default entry-points configured by Soot.
>>> My entry-point is a static method (staticFakeEntryPoint) which instantiates one obj of the class I am testing. Then, in my interesting method doSomething(), I perform a field assignment and request PointsToAnalysis.reachingObjects(Context, Local) (see "<<<<" below). Context is the current statement "stmt" (r0.<MyClass: java.lang.String dummy> = $r3) and Local is "r0" (obtained through stmt.getDefBoxes().getValue().getBase() more or less)
>>> 
>>> MyClass {
>>>    String dummy;
>>>    void static staticFakeEntryPoint() {
>>>       MyClass anObj = new MyClass();
>>>       anObj.doSomething();
>>>    }
>>>    void doSomething() {
>>>      this.dummy = doSomethingElse(); // <<<< jimple: r0.<MyClass: java.lang.String dummy> = $r3
>>>    }
>>> }
>>> 
>>> Am I incorrectly using pointsToAnalysis.reachingObjects(Context, Local) or incorrectly configuring Spark?
>>> 
>>> Why would srcUnitToEdge be lacking that edge?
>>> 
>>> Any help is appreciated.
>>> 
>>> - Henddher  
>> 
>> 
>> _______________________________________________
>> Soot-list mailing list
>> Soot-list at sable.mcgill.ca
>> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
>> 
>> 
>> 
>> 
>> -- 
>> Richard Xiao Xiao
>> PhD Student @ CSE @ Hong Kong University of Science and Technology
>> www.cse.ust.hk/~richardxx
>> _______________________________________________
>> Soot-list mailing list
>> Soot-list at sable.mcgill.ca
>> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
> 
> 
> _______________________________________________
> Soot-list mailing list
> Soot-list at sable.mcgill.ca
> http://mailman.cs.mcgill.ca/mailman/listinfo/soot-list
> 
> 
> 
> 
> -- 
> Richard Xiao Xiao
> PhD Student @ CSE @ Hong Kong University of Science and Technology
> www.cse.ust.hk/~richardxx

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mailman.cs.mcgill.ca/pipermail/soot-list/attachments/20130520/afa18d91/attachment-0001.html