4

I just started using Wala Java Slicer to do some source code analysis tasks. I have a question about the proper use of the library. Assuming I have the following example code:

public void main(String[] args) {
    ...
    UserType ut = userType;
    int i = ut.getInt();
    ...
    System.out.println(i);
}

Calculating a slice for the println statement with Wala gives the following statements:

NORMAL_RET_CALLER:Node: < Application, LRTExecutionClass, main([Ljava/lang/String;)V > Context: Everywhere[15]13 = invokevirtual < Application, LUserType, getInt()I > 11 @27 exception:12
NORMAL main:23 = getstatic < Application, Ljava/lang/System, out, <Application,Ljava/io/PrintStream> > Node: < Application, LRTExecutionClass, main([Ljava/lang/String;)V > Context: Everywhere
NORMAL main:invokevirtual < Application, Ljava/io/PrintStream, println(I)V > 23,13 @63 exception:24 Node: < Application, LRTExecutionClass, main([Ljava/lang/String;)V > Context: Everywhere

The code I am using to create the slice with Wala is shown below:

AnalysisScope scope = AnalysisScopeReader.readJavaScope("...", 
                            null, WalaJavaSlicer.class.getClassLoader());
ClassHierarchy cha = ClassHierarchy.make(scope);

Iterable<Entrypoint> entrypoints = Util.makeMainEntrypoints(scope, cha);
AnalysisOptions options = new AnalysisOptions(scope, entrypoints);

// Build the call graph
CallGraphBuilder cgb = Util.makeZeroCFABuilder(options, new AnalysisCache(),cha, scope, null, null);
CallGraph cg = cgb.makeCallGraph(options, null);
PointerAnalysis pa = cgb.getPointerAnalysis();

// Find seed statement
Statement statement = findCallTo(findMainMethod(cg), "println");

// Context-sensitive thin slice
Collection<Statement> slice = Slicer.computeBackwardSlice(statement, cg, pa, DataDependenceOptions.NO_BASE_NO_HEAP, ControlDependenceOptions.NONE);
dumpSlice(slice);

There are a number of statements that I expect to find in the slice but are not present:

  • The assign statement ut = userType is not included even though the dependent method call ut.getInt(), IS included in the slice
  • No statements from the implementation of getInt() are included. Is there an option to activate "inter-procedural" slicing? I should mention here that the .class file is included in the path used to create the AnalysisScope.

As you can see, I am using DataDependenceOptions.NO_BASE_NO_HEAP and ControlDependenceOptions.NONE for the dependence options. But even when I use FULL for both, the problem persists.

What am I doing wrong?

Rizkallah
  • 113
  • 6

1 Answers1

1

The assign statement ut = userType is not included even though the dependent method call ut.getInt(), IS included in the slice

I suspect that assignment never makes it into the byte code since it's an un-required local variable and hence will not be visible to WALA:

Because the SSA IR has already been somewhat optimized, some statements such as simple assignments (x=y, y=z) do not appear in the IR, due to copy propagation optimizations done automatically during SSA construction by the SSABuilder class. In fact, there is no SSA assignment instruction; additionally, a javac compiler is free to do these optimizations, so the statements may not even appear in the bytecode. Thus, these Java statements will never appear in the slice.

http://wala.sourceforge.net/wiki/index.php/UserGuide:Slicer#Warning:_exclusion_of_copy_statements_from_slice

StuPointerException
  • 7,117
  • 5
  • 29
  • 54
  • Thank you! I completely missed that warning on the Wala page.. Does that mean that if I need these statements then I have to analyze the source code instead of byte code? – Rizkallah Oct 05 '15 at 13:42
  • I guess it depends what you're trying to achieve; in most cases analysing this kind of assignment isn't important since it's the method call to the object that matters, not where the reference is stored. Keeping track of references might become a battle between you and the compiler and that's a tough fight. Good luck! – StuPointerException Oct 05 '15 at 13:48
  • I am trying to keep track of which reference was used to execute the method call, not only the method call itself. That's why assignments are important to me. I guess I need to do some more research on the topic. Thank you again! – Rizkallah Oct 05 '15 at 14:01