Jimple Stmt ("Statement")
Stmts represent instructions of the JVM.
Jimple is a 3-address form code so there are max 3 operands used in a ("manipulating") Stmt - i.e. this does not apply to invokes as this is just operand/parameter passing.
Stmts can be roughly grouped by the amount of successors (in the StmtGraph
of a Body
of a Method
).
- A
FallsThroughStmt
has always one successor - it basically represents program counter++
.
- A
BranchingStmt
can have one, two or even n successors.
- All others (neither FallsThrough nor BranchingStmt) have no successors and therefore end the execution of the current method.
Branching Stmts
A BranchingStmt's job is to model the jumps or conditional branching flow between Stmts.
JGotoStmt
represents unconditional jumps to another Stmt.
JIfStmt
For conditional jumps depending on the result of the conditional expression AbstractConditionExpr
which needs to have boolean result.
If the conditional expression is false, the next Stmt is the successor as the JIFStmt is also a FallsthroughStmt
.
Therefore, the JIfStmt has two successor Stmt's.
JSwitchStmt
for conditional flow that behaves like a switch-case. It has #numberOfCaseLabels+1 (for default) successor Stmt's.
FallsThrough Stmts
The execution of a FallsthroughStmt goes on with the following Stmt (if no exception was thrown).
JInvokeStmt
transfers the control flow to another method until the called method returns.
JAssignStmt
assigns a Value from the right hand-side to the left hand-side.
Left hand-side of an assignment can be a Local referencing a variable (i.e. a Local) or a FieldRef referencing a Field.
Right hand-side of an assignment can be an expression (Expr), a Local, a FieldRef or a Constant.
JIdentityStmt
is similar to the JAssignStmt
and but handles assignments of IdentityRef
s to make implicit assignments explicit into the StmtGraph
.
- Assigns parameters to a
Local
via JParameterRef
like @parameter0: int
refering to the first argument of the method (which is of Type int in this case).
- Assigns exceptions to a
Local
via JCaughtExceptionRef
like @caughtexception: java.lang.NullpointerException
- Assigns the
this
Variable to a Local
via a JThisRef
JEnterMonitorStmt & JExitMonitorStmt
marks synchronized blocks of code from JEnterMonitorStmt to JExitMonitorStmt.
JRetStmt
// TODO: java 1.6 spec
JBreakpointStmt
models a Breakpoint set by a Debugger. Therefore, not really relevant for static analyses but useful for code generation.
Other Stmts
JReturnStmt & JReturnVoidStmt
They end the execution/flow inside the current method and return (a value) to its caller.
JThrowStmt
Ends the execution inside the current Method if the thrown exception is not caught by a Trap, which redirects the execution to an exceptionhandler.
Good to know
A lot of the SootUp APIs return the Stmt
Interface. To determine and handle its subtypes you can make use of instanceof.
But this could escalate to a huge if-else-tree - almost a forest. To mitigate such scenario you can implement a subclass of AbstractStmtVisitor
.
Just subclass the methods to the respective Stmts you need to handle. This is visitor acts like a switch-case, implemented via two dynamic calls.