Package sootup.spark

Class PointsToAnalysis

java.lang.Object

sootup.spark.PointsToAnalysis

public class PointsToAnalysis
extends Object

Client-facing pointer analysis API over a SPARK PAG.

Construct via fromSolver(Solver). The factory triggers Solver.solve() (if the PAG has not yet been built) and then runs an Andersen-style fixed-point propagation over the allocation, assignment, store, and load edges of the PAG. After construction the following queries are supported:

• reachingObjects(Node) — the set of AllocationNodes a node may point to.
• aliases(Node) — the set of other PAG nodes whose points-to set intersects the query node's.
• reachingTypes(Node) — the set of run-time Types induced by the points-to set.

Method Summary

Modifier and Type	Method	Description
Set<Node>	aliases(@NonNull Node node)	Returns the set of nodes (other than node itself) whose points-to set shares at least one allocation with reachingObjects(node) — i.e. nodes that may refer to a common run-time object.
static PointsToAnalysis	fromSolver(@NonNull Solver solver)	Builds a PointsToAnalysis over the PAG of solver.
Set<AllocationNode>	reachingObjects(@NonNull Node node)	Returns the set of allocation sites that node may point to.
Set<Type>	reachingTypes(@NonNull Node node)	Returns the set of run-time types that node's points-to set may induce.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

fromSolver

public static PointsToAnalysis fromSolver(@NonNull
 @NonNull Solver solver)

Builds a PointsToAnalysis over the PAG of solver. If the PAG has not yet been built (i.e. has no vertices), Solver.solve() is invoked first.

reachingObjects

public Set<AllocationNode> reachingObjects(@NonNull
 @NonNull Node node)

Returns the set of allocation sites that node may point to.

For an AllocationNode the result is the singleton containing that allocation. For an InstanceFieldRefNode b.f the result is the union of heap[o, f] over each o in reachingObjects(b).

aliases

public Set<Node> aliases(@NonNull
 @NonNull Node node)

Returns the set of nodes (other than node itself) whose points-to set shares at least one allocation with reachingObjects(node) — i.e. nodes that may refer to a common run-time object. Only PAG vertices are considered as candidates.

reachingTypes

public Set<Type> reachingTypes(@NonNull
 @NonNull Node node)

Returns the set of run-time types that node's points-to set may induce.