Where communities thrive


  • Join over 1.5M+ people
  • Join over 100K+ communities
  • Free without limits
  • Create your own community
People
Activity
  • 05:32

    msridhar on master

    Handle returned values from Fun… (compare)

  • 05:32
    msridhar closed #855
  • 05:32
    msridhar commented #855
  • 03:58
    msridhar synchronize #855
  • 02:54
    msridhar opened #855
  • Jan 06 08:10
    wendaojidian opened #854
  • Jan 03 19:54

    msridhar on master

    Revert "Dummy change to test ja… (compare)

  • Jan 03 18:49

    msridhar on master

    Dummy change to test javadoc up… (compare)

  • Jan 03 05:23

    msridhar on master

    Remove Travis badge (compare)

  • Jan 03 03:32

    msridhar on master

    Disable Travis CI (#853) (compare)

  • Jan 03 03:32
    msridhar closed #853
  • Jan 03 02:33
    msridhar opened #853
  • Jan 03 02:31
    msridhar closed #811
  • Jan 03 02:31
    msridhar commented #811
  • Jan 03 02:30
    msridhar edited #811
  • Jan 03 02:30
    msridhar edited #811
  • Jan 03 02:30
    msridhar assigned #852
  • Jan 03 02:30
    msridhar opened #852
  • Jan 03 02:16

    msridhar on gh-actions-snapshot-builds

    (compare)

  • Jan 03 02:16

    msridhar on master

    Upload snapshot builds from Git… (compare)

Manu Sridharan
@msridhar
Yes, you can create a CG for programs without a main method
You just provide whatever Entrypoints you want to consider to the AnalysisOptions object
234235235
@234235235
@msridhar thx a lot thats what i needed ;)
Manu Sridharan
@msridhar
Sure thing!
Marcel Bruch
@MarcelBruch

Hi, occassionally I get errors like the following:

instruction type: class com.ibm.wala.classLoader.JavaLanguage$JavaInstructionFactory$10 call site: invokestatic < Application, Ljava/lang/invoke/LambdaMetafactory, metafactory(Ljava/lang/invoke/MethodHandles$Lookup;Ljava/lang/String;Ljava/lang/invoke/MethodType;Ljava/lang/invoke/MethodType;Ljava/lang/invoke/MethodHandle;Ljava/lang/invoke/MethodType;)Ljava/lang/invoke/CallSite; >@20 caller: Node: < Application, Lru/saidgadjiev/ormnext/core/field/FieldAccessor, makeGetter(Ljava/lang/invoke/MethodHandles$Lookup;Ljava/lang/invoke/MethodHandle;)Ljava/util/function/Function; > Context: DelegatingContext [A=CallStringContext: [ com.ibm.wala.FakeRootClass.fakeRootMethod()V@4 ], B=Everywhere] unexpected non-invokedynamic instruction!

Is there anything I can do about this?

Manu Sridharan
@msridhar
@MarcelBruch i think this is fixed on WALA master branch. Can you check? If it works for you I can cut a new release with the fix
8 replies
Marcel Bruch
@MarcelBruch

With the changes in master I run into problems in my code.

fun SSAInvokeInstruction.getLambdaMethod(): IMethodName {
        require(this.isLambdaMetafactoryInvoke()) { "instruction is not a call to LambdaMetafactory" }
        require(this is SSAInvokeDynamicInstruction){"instruction is not a SSAInvokeDynamicInstruction: $this"} // here it fails
        val cp = bootstrap.cp // <— how do I get access to the bootstrap? I’m looking for the method that get’s invoked.
        val index = (0 until bootstrap.callArgumentCount()).first { bootstrap.callArgumentKind(it) == ClassConstants.CONSTANT_MethodHandle.toInt() }.let { bootstrap.callArgumentIndex(it) }
        val methodName = "L${cp.getCPHandleClass(index)}.${cp.getCPHandleName(index)}${cp.getCPHandleType(index)}"
        return VmMethodName.of(methodName)
    }

The cast fails (it’s not a SSAInvokeDynamic anymore). But w/o that cast i don’t get access to the bootstrap object. How would I solve this now?

Marcel Bruch
@MarcelBruch
@msridhar ^ (but it doesn’t fail in all cases - sometimes it is an SSAInvokeDynamicInstrcution, sometimes it’s not)
Manu Sridharan
@msridhar
@MarcelBruch are you analyzing JDK11 bytecodes? That may be the issue; we haven't tested that much.
Marcel Bruch
@MarcelBruch
I’m not exactly sure but that’s likely true. I’m analyzing (parts of ) maven central.
Manu Sridharan
@msridhar
If there's any way you could provide a repro test case and file an issue, that would be great
If it's related to JDK 11 it may require some deeper investigation and may not be a quick fix
Marcel Bruch
@MarcelBruch
I can easily share the jars (from maven central) and the conrete method where this fails. A reproducible test that compiles something with jdk11+ will be tricky… what do you need?
Manu Sridharan
@msridhar
WALA tries to pattern match on the expected bytecodes for invoking a lambda. But maybe those patterns have changed. Also invokedynamic is being used for more and more stuff, and it's hard to support arbitrary bootstrap methods, so we kind of play whack-a-mole with these issues
2 replies
If you can share a jar and what exactly fails that should be enough
ligen
@ligenPro
image.png
hi, everyone, I have some ideas on optimizing wala pointer analysis, what do you think about this?
I recorded it in the issue: wala/WALA#789
dtomassi
@dtomassi
Hi, y'all. I am wondering if there are some code examples using WALA CAst for Java source code? In particular generating Call Graphs using it. Thanks!
Imran Settuba
@sImttuba_gitlab
Hi all, how can I traverse the callgraph of my project of occurances of a CGNode?
I found Acyclic.computeBackEdges(callGraph, node), but I don’t know what do to with it
Manu Sridharan
@msridhar

Hi, y'all. I am wondering if there are some code examples using WALA CAst for Java source code? In particular generating Call Graphs using it. Thanks!

@dtomassi this is the best example we have: https://github.com/wala/WALA/blob/master/com.ibm.wala.cast.java.ecj/src/main/java/com/ibm/wala/cast/java/ecj/util/SourceDirCallGraph.java Sorry, we need to make it more prominent in the documentation

Hopefully that will get you started
@sImttuba_gitlab you need to build a call graph first. what language are you trying to analyze? if it's Java bytecode, you can take a look here for an example of what needs to be done: https://github.com/wala/WALA-start/blob/master/src/main/java/com/ibm/wala/examples/drivers/ScopeFileCallGraph.java I also recommend looking at the main tutorial slides: http://wala.sourceforge.net/files/PLDI_WALA_Tutorial.pdf
22 replies
Imran Settuba
@sImttuba_gitlab

Hi all,
I am struggeling to traverse the controllflowgraph of an CGNode, in a way so that I can introspect each invocation/ instruction and get their node.
I imagine something like:

public static void main(String[] args) {
  int x = 2;
        x++;

        if (true && 4 + 4 == 3)
            throw new NullPointerException();
}

In other words, how would I search through the graph and find the exception throwing, plus the expression in the if clause that is responsible for it?
Any help is welcome.

Manu Sridharan
@msridhar
Can you use CGNode.iterateNewSites() and find the ones allocating an exception type?
malionet-sarka
@malionet-sarka

Hi all.
Thank you for your help in Issues the other day.
I have a question about the backward slice, so I ask it here.
I did some backward slicing on the following code, but I didn't get the results I expected.

The configuration is as follows.

  • Slicer.DataDependenceOptions.FULL
  • Slicer.ControlDependenceOptions.NO_EXCEPTIONAL_EDGES
  • CallGraphBuilder: makeZeroOneContainerCFABuilder
  • slice seed: Iterator.hasNest();
  • java version: 1.8.0_211
  • WALA version: 1.5.5
public class ArraySample {
    public static void main(String[] args) {
        List<Integer> list = new ArrayList<>();
        list.add(1);
        for (Integer str : list) {
            System.out.println(str);
        }
    }
}

Slice result:

0 = {NormalReturnCaller@2194} "NORMAL_RET_CALLER:Node: < Application, LArraySample, main([Ljava/lang/String;)V > Context: Everywhere[13]13 = invokeinterface < Application, Ljava/util/Iterator, hasNext()Z > 11 @27 exception:12"
1 = {NormalStatement@2195} "NORMAL hasNext:return 9 Node: < Primordial, Ljava/util/ArrayList$Itr, hasNext()Z > Context: DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Primordial, Ljava/util/ArrayList, iterator()Ljava/util/Iterator; >:NEW <Primordial,Ljava/util/ArrayList$Itr>@0 in DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Application, LArraySample, main([Ljava/lang/String;)V >:NEW <Application,Ljava/util/ArrayList>@0 in Everywhere}>, B=Everywhere]}>, B=Everywhere]"
2 = {PhiStatement@2196} "PHI Node: < Primordial, Ljava/util/ArrayList$Itr, hasNext()Z > Context: DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Primordial, Ljava/util/ArrayList, iterator()Ljava/util/Iterator; >:NEW <Primordial,Ljava/util/ArrayList$Itr>@0 in DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Application, LArraySample, main([Ljava/lang/String;)V >:NEW <Application,Ljava/util/ArrayList>@0 in Everywhere}>, B=Everywhere]}>, B=Everywhere]:9 = phi  8,7"
3 = {NormalReturnCallee@2197} "NORMAL_RET_CALLEE:Node: < Primordial, Ljava/util/ArrayList$Itr, hasNext()Z > Context: DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Primordial, Ljava/util/ArrayList, iterator()Ljava/util/Iterator; >:NEW <Primordial,Ljava/util/ArrayList$Itr>@0 in DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Application, LArraySample, main([Ljava/lang/String;)V >:NEW <Application,Ljava/util/ArrayList>@0 in Everywhere}>, B=Everywhere]}>, B=Everywhere]"

The slice results I expect:

List<Integer> list = new ArrayList<>();
list.add(1);

If an iterator is used, isn't a backward slice of the original object valid?
If so, how can I get the results I expect?

Could you give me some advice if convenient.

Manu Sridharan
@msridhar
Hi @malionet-sarka. I agree; I would expect the statements you list to be in the slice. Can you report an issue? I will look when I have time
malionet-sarka
@malionet-sarka
@msridhar
Sorry...
When I reviewed the settings, I found that it was running in Slicer.ControlDependenceOptions.NONE.
In this case, won't the slice result include statement of the original object?
malionet-sarka
@malionet-sarka
If not, I'll report the Issue.
Manu Sridharan
@msridhar
Glancing at the ArrayList code I would expect the slice to include the statements on the original ArrayList even with no control dependence. But I'm not 100% sure. In any case I think it's worth reporting the issue
Ali Ahsan
@aliahsan07
Hi @msridhar , quick question, what are these definers 1 you see when a Call Graph gets constructed?
Manu Sridharan
@msridhar
@aliahsan07 I am not 100% sure. Do you have a small example? I think it might have something to do variables that get overwritten by a nested function
malionet-sarka
@malionet-sarka
Hi all.
I would like to calculate the distance between one node and another on CFG, is there a class implemented on WALA to do this?
Manu Sridharan
@msridhar
Hi @malionet-sarka can you use com.ibm.wala.util.graph.traverse.BFSPathFinder?
you can call find() and then check the length of the returned List
malionet-sarka
@malionet-sarka
@msridhar
Thank you for your reply.
I see... Okay, I'm going to implement it using com.ibm.wala.util.graph.traverse.BFSPathFinder.
Manu Sridharan
@msridhar
Sounds good!
Zhen Zhang
@izgzhen
Hi, I am trying to use WALA's JavaScript support, and I wonder how callbacks are handled typically during data-flow analysis?
For example, given snippet https.get(..., function (r) { ... }), is it possible to use certain API to construct data-flow entering the callback's body? (assuming the model of https.get can be manually constructed using any approach)
Manu Sridharan
@msridhar
Hi @izgzhen! At a high level, what you'd like to do should "just work" assuming you have a correct model of https.get. In particular, our call graph construction accounts for inter-procedural data flow, and we have many frameworks that allow you to perform inter-procedural data flow analysis on top of a call graph
Zhen Zhang
@izgzhen
Thanks for the reply! "have a correct model of https.get" -> how is that typically done from user side? (I can imagine to provide some model written in JS, similar to the prologue.js -- but I am not familiar how that is actually implemented)
@msridhar Forget to ping you on this...
Manu Sridharan
@msridhar
@izgzhen You could just write the model in JavaScript, defining a global variable https as an object that has a get method. Then, include that extra script along with the code you are trying to analyze
Zhen Zhang
@izgzhen
Cool, thanks!
malionet-sarka
@malionet-sarka

Hi, all.
I'd like to specify the definition of the arguments in a method call.
For example, the following code is assumed.

public class Main {
    public static void main(String[] args) {
        int x = 3;
        branch(x);
    }

    private static void test(int x) {
        for(int i = 0; i<x ; i++){
                Syste.out.println("count");
        }
}

In this case, is it possible to specify the source of the definition of x, which is referenced in the test method?

One possible way is to use a backward slice with a conditional branch as the seed in a loop statement.
I would like to know if there is any other good way.

WALA has a way to do inter-procedural data flow analysis, but as far as I know, I am aware that it only works with static fields.

Manu Sridharan
@msridhar

I'd like to specify the definition of the arguments in a method call.

Should the "definitions" be the invoke instructions that call the method? Those are the instructions that pass the actual parameter that ends up being the value for the argument within the method