Jason Sawin amp Atanas Rountev Call Graphs Represent the calling relationships between methods Critical component in many interprocedural static analyses Unsound when applied to applications which use dynamic features ID: 306973
Download Presentation The PPT/PDF document "Assumption Hierarchy for a CHA Call Grap..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
Assumption Hierarchy for a CHA Call Graph Construction AlgorithmJason Sawin & Atanas Rountev Slide2
Call GraphsRepresent the calling relationships between methodsCritical component in many interprocedural static analysesUnsound when applied to applications which use dynamic featuresSlide3
Dynamic Features of JavaDynamic Class LoadingAbility to install classes at run time ReflectionAbility to examine or modify run-time behavior of a running applicationJVMImplicitly calls certain code elementsNative MethodAbility to interface with libraries written in non-Java languagesSlide4
Dynamic Features in Action Class c; String className; Method m; Object h; ... Class c = Class.forName(className, true, cl); m = c.getMethod("handle", …); h =
c.newInstance(); m.invoke
(h,…)
...Slide5
CHA Call Graph Construction AlgorithmClass Hierarchy Analysis (CHA)For every virtual call site e.m(…) where T is the static type of e, it examines all subtypes of T for methods which override m(…)The set of overriding methods are considered possible targets of the callSlide6
CHA and Dynamic FeaturesEvery implementation of CHA makes assumptions about dynamic featuresWide range of possible assumptionsVery conservative to unsoundDifferent assumptions allow for different resolution techniquesString analysis Cast informationSlide7
Assumption Hierarchy Behaved-CLS: Dynamic features could call every methodEncap-Respect: Dynamic features respect normal encapsulation boundsCorrect Casting: Allows for casing information to be used to resolve certain featuresCorrect-String: Allows for use of a string analysisCorrect-Env: Allows for use of a semi static string analysisSlide8
Experimental Results: EdgesSlide9
Summary of ResultsThe Correct-Env version of CHA created a graphs that contained, on average, 10% fewer nodes and 54% fewer edges than the fully conservative versionThe Correct-Env version was able to resolve an average of 6% of reflective invocation calls, 50% of dynamic class loading sites, and 61% of reflective instantiation sitesUnder very reasonable assumptions, a much more precise call graph can be created Slide10
ConclusionWe created a hierarchy of assumptions that could be used to classify future analyses We incorporated several new techniques for resolving dynamic features into a CHA Call GraphOur experiments showed that assumptions have a significant impact on the graph produced