Homework 3
Posted Friday February 26, Due Tuesday March 12
50 points
Now that you are (more) familiar with Soot and the Class analysis framework, you will build
a more complex class analysis, XTA. Add a new package analysis.XTA and add your XTA
implementation in public class XTAAnalysis extends Analysis in this package. You may
add analogous drivers to the ones in RTA to test locally. Follow directory structure as Submitty
pulls your analysis/XTA/XTAAnalysis.java to test.
Below is a rehash of the XTA constraints we discussed in class.
1. Allocation:
1: for each new A in m s.t. m ∈ ReachableMethods do
2: {A} ⊆ Sm
3: end for
2. Virtual call:
1: for each x = y.n(z) in m s.t. m ∈ ReachableMethods do
2: for each C in Sm ∩ SubTypes(StaticType(y)) do
3: n
0
(this, p,ret) = resolve(C, n) // adds target to ReachableMethods
4: {n
0} ⊆ ReachableMethods
5: {C} ⊆ Sn0 // adds receiver class to Sn0
6: Sm ∩ SubTypes(StaticType(p)) ⊆ Sn0 // adds to Sn0 due to arguments
7: Sn0 ∩ SubTypes(StaticType(ret)) ⊆ Sm // adds to Sm from Sn0 due to return
8: end for
9: end for
We have simplified the presentation showing each method having exactly one formal parameter
p. Of course, a method may have 0 or more parameters and you will need to handle the
general case. Note that the class analysis framework passes all actual arguments to the analysis,
including ones that are of primitive type. You will have to do some extra work to filter out
parameters of primitive type. Soot API methods getParameterType and getReturnType in
SootMethod may be of use.
3. Field Read:
1: for each x = y.f in m s.t. m ∈ ReachableMethods do
2: Sf ⊆ Sm
3: end for
4. Field Write:
1: for each x.f = y in m s.t. m ∈ ReachableMethods do
2: Sm ∩ SubTypes(StaticT ype(f)) ⊆ Sf
3: end for
In addition, you must handle direct calls, static fields and array reads/writes.
Direct calls to static methods are straightforward. Direct calls to instance methods (i.e., these
are methods such as constructors that have a receiver this) use the following constraint to pass
the type of the receiver to the callee n:
Sm ∩ SubTypes(StaticType(this)) ⊆ Sn
1
2
Static field reads, local = static field, and writes, static field = local, are abstracted
as assignStmt in the class analysis framework, where respectively, the right-hand-side or lefthand-side
node is of kind STATIC FIELD.
Make sure you handle arrays. Ignoring arrays renders the XTA analysis unsound. Consider
void m(X[] a) {
X x = a[0];
x.n();
}
and note that in general, the array argument may have been written anywhere in the program.
Finally, as with RTA, display your result in showResult. Specifically, display all reachable
methods m in alphabetical order with all classes in Sm in alphabetical order. For example, the
expected output for p2 is the following
Reachable methods: