Hi, y'all. I am wondering if there are some code examples using WALA CAst for Java source code? In particular generating Call Graphs using it. Thanks!
@dtomassi this is the best example we have: https://github.com/wala/WALA/blob/master/com.ibm.wala.cast.java.ecj/src/main/java/com/ibm/wala/cast/java/ecj/util/SourceDirCallGraph.java Sorry, we need to make it more prominent in the documentation
22 replies
Hi all,
I am struggeling to traverse the controllflowgraph of an CGNode, in a way so that I can introspect each invocation/ instruction and get their node.
I imagine something like:
public static void main(String[] args) {
int x = 2;
x++;
if (true && 4 + 4 == 3)
throw new NullPointerException();
}In other words, how would I search through the graph and find the exception throwing, plus the expression in the if clause that is responsible for it?
Any help is welcome.
Hi all.
Thank you for your help in Issues the other day.
I have a question about the backward slice, so I ask it here.
I did some backward slicing on the following code, but I didn't get the results I expected.
The configuration is as follows.
- Slicer.DataDependenceOptions.FULL
- Slicer.ControlDependenceOptions.NO_EXCEPTIONAL_EDGES
- CallGraphBuilder: makeZeroOneContainerCFABuilder
- slice seed: Iterator.hasNest();
- java version: 1.8.0_211
- WALA version: 1.5.5
public class ArraySample {
public static void main(String[] args) {
List<Integer> list = new ArrayList<>();
list.add(1);
for (Integer str : list) {
System.out.println(str);
}
}
}Slice result:
0 = {NormalReturnCaller@2194} "NORMAL_RET_CALLER:Node: < Application, LArraySample, main([Ljava/lang/String;)V > Context: Everywhere[13]13 = invokeinterface < Application, Ljava/util/Iterator, hasNext()Z > 11 @27 exception:12"
1 = {NormalStatement@2195} "NORMAL hasNext:return 9 Node: < Primordial, Ljava/util/ArrayList$Itr, hasNext()Z > Context: DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Primordial, Ljava/util/ArrayList, iterator()Ljava/util/Iterator; >:NEW <Primordial,Ljava/util/ArrayList$Itr>@0 in DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Application, LArraySample, main([Ljava/lang/String;)V >:NEW <Application,Ljava/util/ArrayList>@0 in Everywhere}>, B=Everywhere]}>, B=Everywhere]"
2 = {PhiStatement@2196} "PHI Node: < Primordial, Ljava/util/ArrayList$Itr, hasNext()Z > Context: DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Primordial, Ljava/util/ArrayList, iterator()Ljava/util/Iterator; >:NEW <Primordial,Ljava/util/ArrayList$Itr>@0 in DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Application, LArraySample, main([Ljava/lang/String;)V >:NEW <Application,Ljava/util/ArrayList>@0 in Everywhere}>, B=Everywhere]}>, B=Everywhere]:9 = phi 8,7"
3 = {NormalReturnCallee@2197} "NORMAL_RET_CALLEE:Node: < Primordial, Ljava/util/ArrayList$Itr, hasNext()Z > Context: DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Primordial, Ljava/util/ArrayList, iterator()Ljava/util/Iterator; >:NEW <Primordial,Ljava/util/ArrayList$Itr>@0 in DelegatingContext [A=ReceiverInstanceContext<SITE_IN_NODE{< Application, LArraySample, main([Ljava/lang/String;)V >:NEW <Application,Ljava/util/ArrayList>@0 in Everywhere}>, B=Everywhere]}>, B=Everywhere]"The slice results I expect:
List<Integer> list = new ArrayList<>();
list.add(1);If an iterator is used, isn't a backward slice of the original object valid?
If so, how can I get the results I expect?
Could you give me some advice if convenient.
ArrayList even with no control dependence. But I'm not 100% sure. In any case I think it's worth reporting the issue
find() and then check the length of the returned List
https.get(..., function (r) { ... }), is it possible to use certain API to construct data-flow entering the callback's body? (assuming the model of https.get can be manually constructed using any approach)
https.get. In particular, our call graph construction accounts for inter-procedural data flow, and we have many frameworks that allow you to perform inter-procedural data flow analysis on top of a call graph
Hi, all.
I'd like to specify the definition of the arguments in a method call.
For example, the following code is assumed.
public class Main {
public static void main(String[] args) {
int x = 3;
branch(x);
}
private static void test(int x) {
for(int i = 0; i<x ; i++){
Syste.out.println("count");
}
}In this case, is it possible to specify the source of the definition of x, which is referenced in the test method?
One possible way is to use a backward slice with a conditional branch as the seed in a loop statement.
I would like to know if there is any other good way.
WALA has a way to do inter-procedural data flow analysis, but as far as I know, I am aware that it only works with static fields.
ClassHierarchy and then scan all the methods in each class, looking for references to other classes in fields, method signatures, instructions, etc. You should look around; maybe this kind of analysis already exists using some other framework (Soot, ASM, etc.). It's pretty simple so I wouldn't be surprised if someone has built it already
Hi, everyone.
I would like to map the bytecode position to the WALA IR index. But I could not find such a method. Is there any better way?
What I want to do is to reference the beginning of the corresponding bytecode position from the WALA IR. For example, if you reference a bytecode position from invokestatic(WALA IR), you want to reference the bytecode position of the push instruction, not the bytecode position of invokestatic(bytecode).
My understanding is that the WALA IR position does not have a one-to-one correspondence with the bytecode position.
null value. Could you try that out
[Node: <Code body of function Lexample.js> Context: Everywhere, v7] --> [SITE_IN_NODE{<ctor for <JavaScriptLoader,LObject>>:NEW <JavaScriptLoader,LObject>@2 in CallStringContext: [ example.js.do()LRoot;@7 ]}]
[Node: <ctor for <JavaScriptLoader,LFunction>(Lexample.js/example.js@118)> Context: CallStringContext: [ example.js.do()LRoot;@10 ], v7] --> [SITE_IN_NODE{<ctor for <JavaScriptLoader,LFunction>(Lexample.js/example.js@118)>:NEW <JavaScriptLoader,LObject>@3 in CallStringContext: [ example.js.do()LRoot;@10 ]}]
[Node: <Code body of function Lexample.js/example.js@118> Context: Everywhere, v7] --> [SITE_IN_NODE{<ctor for <JavaScriptLoader,LArray>>:NEW <JavaScriptLoader,LArray>@2 in CallStringContext: [ example.js.example.js@118.do()LRoot;@5 ]}]
[Node: <ctor for <JavaScriptLoader,LArray>> Context: CallStringContext: [ example.js.example.js@118.do()LRoot;@5 ], v7] --> [[ConstantKey:0:<JavaScriptLoader,LNumber>]]