All Classes and Interfaces
Class
Description
Abstract base class for analysis engine implementations
Aids in handling code to be inserted at given points into the model.
Common functionality for
ControlFlowGraph implementations.A graph representing program flow, constructed method-by-method on demand
Abstract super class for demand points-to analysis.
An object to track performance of an analysis engine
Common implementation for
InstanceFieldPointerKey implementations.Represents a set of
IFixedPointStatements to be solved by a IFixedPointSolverA graph whose edges are labeled with
IFlowLabels.An
IFlowLabel.IFlowLabelVisitor that does nothing.Basic functionality for a
Graph that delegates node and edge management.Interprocedural control-flow graph, constructed lazily.
Skeleton of functionality to propagate information through the Java bytecode stack machine using
ShrikeBT.
This gives some basic facilities for shoving things around on the stack.
Update the machine state to account for an instruction
Interface which defines a flow function for a basic block
A Meeter object provides the dataflow logic needed to meet the abstract machine state for a
dataflow meet.
Skeleton of functionality to propagate information through the Java bytecode stack machine using
ShrikeBT.
This gives some basic facilities for shoving things around on the stack.
Interface which defines a flow function for a basic block
A Meeter object provides the dataflow logic needed to meet the abstract machine state for a
dataflow meet.
An Eclipse action that analyzes a Java selection
abstract base class for launching a JFace application
A
PointerKey representing a local variable must carry at least a CGNode.Abstract superclass for meet operators
A Jar file nested in a parent jar file
Basic functionality for a graph that delegates node and edge management, and tracks node numbers
operator for a step in an iterative solver
Abstract superclass for
PointerAnalysis implementations.This class exists to force
PointerKey implementations to implement equals() and
hashCode()s.Abstract base class for solver for pointer analysis.
Default
RefinementPolicy implementation, delegating to some provided FieldRefinePolicy and CallGraphRefinePolicyAn abstract superclass of various
SSAContextInterpreters that deal with reflection
methods.A warning when we find flow of a factory allocation to a cast to
SerializableA warning when we expect excessive pollution from a factory method
A warning when we fail to find subtypes for a factory method
This abstract class represents field (a.k.a property) reads in which the field name is not a
constant, but rather a computed value.
This abstract class represents field (a.k.a property) writes in which the field name is not a
constant, but rather a computed value.
A synthetic method from the
FakeRootClassAbstract superclass of various RTA flavors
Abstract core of traditional SSA conversion (Cytron et al.).
Represents a single step in an iterative solver
Represents a single variable in a fixed-point system.
Visitor class for
Vertex.The activator class controls the plug-in life cycle
The activator class controls the plug-in life cycle
Hardcoded EntryPoint-specifications for an Android-Activity.
Utilities for dealing with acyclic subgraphs
This is a demo class.
EdgeWeight that adds a specific value.
This class implements a stream that just discards everything written to it.
Includes all application methods in an analysis scope as entrypoints.
A policy, that adds pi nodes for all variables, that are used in a branch instruction.
A factory which tries by default to create
InstanceKeys which are AllocationSiteInNodes.This is a
ContextItem that records n allocation sites, the 0th element represents the
most recently used receiver obj, which is an AllocationSiteInNodeThis
Context consists of an AllocationString that records n allocation sitesPattern to match one of two alternatives.
A policy that always refines the call graph.
A policy that always refines handling of field accesses by checking for an alias path
corresponding to each match edge.
A place to hold onto caches of various analysis artifacts.
Basic interface for options that control call graph generation.
options for handling reflection during call graph construction
Base class that represents a set of files to analyze.
Reads
AnalysisScope from a text file.Utility class for the exception pruning analysis.
This exception is thrown by verify() when it fails.
Create some Android-Environment.
Android Components like Activity, Service, ...
Fetches an android/content/Context.
An AdnroidEntryPoint is basically the same as a DexEntryPoint.
The ExecutionOrder is used to partially order EntryPoints.
AndroidEntryPoints have to be sorted before building the model.
Implement this interface to put entitys into the AndroidModel.
Searches an Android application for its EntryPoints.
A definition of an Entrypoint functions o the App are matched against.
Used to control the search mechanisms of AndroidEntryPointLocator.
Model configuration and Global list of entrypoints.
Read in an extracted AndroidManifest.xml.
The model to be executed at application start.
Encapsulates synthetic methods for modeling Androids lifecycle.
Manages SSA-Numbers for the arguments to Entrypoints.
Does optional checks before building the CallGraph.
Generate a Settings-Object from a String-Representation.
Add an Intent that is _shure_ to be handled internally _only_.
Grab and set data of AndroidClasses.
Constants for types used by the AndroidModel
Represents a member annotation, e.g., Java 5.0 class file annotations
This class reads Annotations attributes, e.g., RuntimeInvisibleAnnotations.
Representation of an annotation attribute.
represents an annotation argument that itself is an array of arguments
Represents a constant argument to an annotation.
Marker interface for possible element values in an annotation attribute.
Represents enum constant annotation arguments.
A node pattern that matches any AST node.
Hardcoded EntryPoint-specifications for an Android-Application.
Keeps a given CGNode if it stems from application code
An entrypoint which chooses some valid (non-interface) concrete type for each argument, if one is
available.
A return vertex represents the 'arguments' array of a given function.
A synthetic model of java.lang.reflect.Array native methods
Some thoughts about implementation details, not mentioned in [1]:
Implementation of
IClass for array classes.Pseudo-classloader for all array classes; all other IClassLoader implementations should delegate
to this one for array classes only.
Pseudo-field modelling the contents of an array of reference type.
A
PointerKey which represents the contents of an array instance.an Iterator of array elements
This class represents arraylength instructions.
A
PointerKey that represents an array length locationThis class represents the ?aload instructions.
Iterator that only returns non-null elements of the array
Adapter for using
ArrayOutOfBoundsAnalysis.The array out of bounds analysis uses the inequality graph as described in [1].
A set implementation backed by an array.
This class represents the ?astore instructions.
WALA-specific assertion checking.
A specialized equation class introduced for efficiency.
A simple assignment statement.
An assert statement, as found in a variety of languages.
A version of
ContextInsensitiveSSAInterpreter that uses the IR for AstContextInsensitiveSSAContextInterpreter.iterateNewSites(CGNode) and AstContextInsensitiveSSAContextInterpreter.iterateCallSites(CGNode) when we have an AstMethod.A read of a global variable denoted by a FieldReference
A write of a global variable denoted by a FieldReference
IR instruction to check whether a field is defined on some object.
Common utilities for CFA-style call graph builders.
0-1-CFA Call graph builder which analyzes calls to "container methods" in a context which is
defined by the receiver instance.
0-1-CFA Call graph builder, optimized to not disambiguate instances of "uninteresting" types.
This abstract class provides helper functionality for recording lexical uses and/or definitions.
A single lexical access.
A set of lexical reads.
A set of lexical writes.
lexical access information for some entity scope.
Parents of this method with respect to lexical scoping, that is, methods containing state
possibly referenced lexically in this method
Common code to translate CAst to IR.
data structure for the final CFG for a method, based on the information in an
AstTranslator.IncipientCFGlexical access information for some entity scope.
basic block implementation used in the CFGs constructed during the IR-generating AST traversal
a scope in the symbol table built during AST traversal
interface for name information stored in a symbol table.
An utf8-encoded byte string.
This is a base class for "attribute readers", the classes which provide access to the contents of
attributes.
A cache for auxiliary information based on an SSA representation
A "reversed" supergraph for backwards analysis.
A helper class to make the ipcfg work correctly with context-sensitive call graphs.
Basic data structure support for a call graph.
A class that represents the a normal node in a call graph.
Simple implementation of an
EdgeManager.a basic implementation of the dataflow framework
Basic implementation of a
Graph.Basic implementation of
HeapGraphA generic process launcher
A relation between non-negative integers
Simple implementation of a
NodeManager.An implementation of NullaryStep that carries its operator explicitly
Inefficient implementation of OrderedMultiGraph.
TODO: refactor to eliminate more redundancy with SSACallGraphBuilder
A simple, extremely inefficient tree implementation
An implementation of UnaryStatement that carries its operator explicitly
This is a demo class.
This is a demo class.
This class implements breadth-first search over a Graph, returning an Iterator of the nodes of
the graph in order of discovery.
This class searches breadth-first for node that matches some criteria.
This implementation of
Map chooses between one of two implementations, depending on the
size of the map.An implementation of
MutableIntSet that delegates to either a MutableSparseIntSet
or a BitVectorIntSetAn object that creates some bimodal mutable int sets.
Module representing a directory of .class files
for binary ops not defined in JVML
This class represents binary operator instructions for which the operands and the result all have
the same type.
Normalizes a binary operation with a constant by providing direct access to assigned = other op
constant.
utilities for manipulating values at the bit-level.
A bit set is a set of elements, each of which corresponds to a unique integer from [0,MAX].
Abstract base class for implementations of bitvectors
Operator OUT = IN - filterSet
a basic implementation of the dataflow framework
Operator OUT = IN
Operator U(n) = U(n) n U(j)
A
BitVector implementation of MutableIntSet.Just kills everything
Operator OUT = (IN - kill) U gen
Operator OUT = IN / v
Operator OUT = IN U v
A repository for shared bit vectors as described by Heintze
A
DataflowSolver specialized for BitVectorVariablesOperator U(n) = U(n) U U(j)
Operator OUT = IN U c
Operator lhs = lhs U rhs U v
A bit vector variable for dataflow analysis.
Operator OUT = IN
A
DataflowSolver specialized for BooleanVariablesOperator U(n) = U(n) U U(j)
A boolean variable for dataflow analysis.
This class implements breadth-first search over a Graph, returning an Iterator of the nodes of
the graph in order of discovery.
A
TabulationSolver that gives up after a finite bound.A
TabulationSolver that gives up after a finite bound.Exception thrown when a demand-driven points-to query exceeds its allocated budget.
A
ClassTargetSelector that looks up the declared type of a NewSiteReference based
on bypass rules."Non-standard" bypass rules to use during call graph construction.
A synthetic implementation of a class
This class represents class loaders that introduce classes that do not exist in the actual
application being analyzed.
A class representing which originates in some form of bytecode.
Information about java byte codes that appear in the "code" attribute of a .class file.
Provides minimal abstraction layer to a stream of bytecodes from the code attribute of a method.
A factory for References ...
CallArgSourceSpecs represent sources that are arguments to another function.
This is a context which is defined by the caller node.
This is a
Context which is defined by a pair consisting of <caller node, base
context>.A context which is a <CGNode, CallSiteReference> pair.
This is a context which is defined by a pair consisting of <caller node, base context>.
A set of call flow edges which lead to a particular procedure entry s_p.
Basic interface for a call graph, which is a graph of
CGNodeUtility class to serialize call graphs as JSON objects.
Basic interface for an object that can build a call graph.
An exception to throw when call graph construction is canceled.
utility methods for mapping various program entities from one call graph to the corresponding
entity in another one
Interface for specifying a policy for refining the call graph.
Utility methods for searching call graphs, e.g., to find particular
CGNodes or types of
statements within a nodeCollect basic call graph statistics
Utilities for call graph tests
Utility class for computing an analysis result for call graph nodes and their transitive callees,
given the results for individual nodes.
CallRetSourceSpecs represent sources from invocations of other methods (eg: API methods).
A utility class consisting of a pair CallSiteReference x CGNode
Simple object that represents a static call site (ie., an invoke instruction in the bytecode)
Representation for a calling context.
A call vertex represents the possible callees of a function call or
new expression.Exception class that indicates that construction of class hierarchy has been cancelled by a
progress monitor.
An exception for when work is canceled in eclipse.
An exception for when work is canceled in eclipse.
The main interface for creating CAPA Abstract Syntax Trees.
basic abstract class loader implementation
abstract class loader that performs CAst and IR generation for relevant entities in a list of
Modules.abstract base class for
CAstRewriters that do no cloning of nodeskey indicating that no duplication is being performed
context indicating that no cloning is being performed
The control flow information for the CAPA AST of a particular entity.
An implementation of a CAstControlFlowMap that is designed to be used by producers of CAPA asts.
The assumption is that abstract syntax trees pertain to particular programming language
constructs, such as classes, methods, programs and the like.
An implementation of CAst, i.e.
Convenience interface for implementing an AST node with no children
This interface represents nodes of CAPA Abstract Syntax Trees.
Various operators that are built in to many languages, and hence perhaps deserve special notice
in WALA CAst interface.
This interface is used to denote various kinds of references in CAst structures.
Abstract superclass for types performing a rewrite operation on a CAst.
interface to be implemented by keys used for cloning sub-trees during the rewrite
represents a rewritten CAst
interface to be implemented by contexts used while traversing the AST
Extension of
CAstRewriter which allows adding or deleting control flow edges, and keeps
track of the current entity.A control flow edge to be added to the CFG.
The assumption is that a typical CAst is derived from some kind of textual source file, for which
it makes sense to record source position in terms of line and column numbers.
This interface encapsulates the source position of an ast node in its source file.
An implementation of CAst, i.e.
This interface represents a visitor-specific context.
Utility class to remove exceptional edges to exit() from a CFG
Wrapper to store multiple intraprocedural analysis for a call graph.
Basic interface for a node in a call graph.
Call graph in which call targets are determined entirely based on an
IClassHierarchy.This class represents checkcast instructions.
A
NodePos for a non-root node; includes information about the parent node, the child
index, and the position of the parent node.A context-insensitive SDG.
A cheap, context-insensitive slicer based on reachability over a custom SDG.
This class provides Instance Key call backs where each instance is in the same equivalence class
as all other instances of the same concrete type.
This interface defines class file constants used by ShrikeCT.
An
SSAContextInterpreter specialized to interpret reflective class factories (e.g.A
ContextSelector to intercept calls to reflective class factories (e.g.A module which is a wrapper around a .class file
Simple implementation of a class hierarchy.
This class takes the raw information from a ClassHierarchyProvider and computes type operations
(subtype check, type union).
A
ClassTargetSelector that simply looks up the declared type of a NewSiteReference in the appropriate class hierarchy.An exception that means something went wrong when constructing a
ClassHierarchy.A
MethodTargetSelector that simply looks up the declared type, name and descriptor of a
CallSiteReference in the appropriate class hierarchy.This interface provides information about the class hierarchy to some consumer, such as a
bytecode verifier.
Statistics about a class hierarchy.
This implementation of ClassHierarchyProvider is a simple writable data structure representing a
class hierarchy.
Utilities for querying a class hierarchy
A warning for when we get a class not found exception
This class provides a convenient way to instrument every method in a class.
Implement this interface to instrument every method of a class using visitMethods() below.
An implementation of the class loader factory that produces ClassLoaderImpls
A class loader that reads class definitions from a set of Modules.
Defines the meta-information that identifies a class loader.
Class is not in scope.
An
SSAContextInterpreter specialized to interpret Class.newInstance in a JavaTypeContext which represents the point-type of the class object created by the call.This class prints the contents of a class file.
This is the core class for reading class file data.
AttrIterator provides access to attributes in the class file.
This is a demo class.
Under construction.
This interface represents policies for selecting a class to allocate at a given new site.
Under construction.
This class formats and writes class data into JVM format.
An Element is an object that can be serialized into a byte buffer.
A RawElement is an Element that is already available as some chunk of a byte buffer.
This context selector selects a context based on the concrete type of the receiver to a call of
java.lang.Object.clone
A context interpreter for java.lang.Object.clone
A CAst rewriter for extracting bits of code into one-shot closures.
This attribute reader reads Code attributes from methods.
Simple utilities to scan
IMethods to gather information without building an IR.This class helps emit Code elements.
A filter defined by set membership
Use this class to combine multiple
ExceptionFilterutilities for parsing a command line
This class represents comparisons between floats, longs and doubles.
This class generates Java bytecode from ShrikeBT Instructions.
This class represents a method generated by a Compiler.
This class represents the union of two sets of
Entrypoints.A 2-level iterator.
An Iterator which provides a concatenation of two IntIterators.
An iterator which provides a logical concatenation of the lists from two other iterators
A Combination of 2
SSAPiNodePolicys.An instance key which represents a unique set for each concrete type.
This class represents conditional branches.
ConditionNormalizer normalizes a branch condition.
Represents a type and its subtypes.
A flow function which maps the zero fact to a set of new dataflow facts, essentially introducing
them from nothing.
A ConstantInstruction pushes some constant value onto the stack.
An instance key which represents a unique, constant object.
A ConstantPoolParser provides read-only access to the constant pool of a class file.
This class provides read-only access to a constant pool.
This interface defines a bunch of constants from the JVM spec.
The value of a constant which appears in an SSA IR.
This class reads ConstantValue attributes.
This class builds serializable ConstantValue attributes.
This context selector returns a context customized for the
InstanceKey of the receiver if
receiver is a container, or
was allocated in a node whose context was a ReceiverInstanceContext, and the type
is interesting according to a delegate ZeroXInstanceKeys
Additionally, we add one level of call string context to a few well-known static factory methods
from the standard libraries.Utilities for container class analysis
A Context is a mapping from a name (ContextKey) to a value (ContextItem)
Computes interprocedural reaching definitions for static fields in a context-insensitive manner.
Default implementation of MethodContextInterpreter for context-insensitive analysis
A basic context selector that ignores context.
Default implementation of SSAContextInterpreter for context-insensitive analysis.
A placeholder for strong typing.
This just exists to enforce strong typing.
context key representing some parameter index, useful, e.g.
An interface to an object which helps control context-sensitivity.
Computes interprocedural reaching definitions for static fields in a context-sensitive manner via
tabulation.A state machine for tracking calling context during a points-to query.
handles method recursion by only collapsing cycles of recursive calls observed during analysis
misc utilities for dealing with contexts
Control Dependence Graph
An interface that is common to the Shrike and SSA CFG implementations.
This class represents instructions that convert from one primitive type to another.
The main plugin class to be used in the desktop.
An
ExtractionPolicy that specifies that correlated pairs should be extracted.A correlation exists between a dynamic property read r and a dynamic property write w such that
the value read in r may flow into w, and r and w are guaranteed to access a property of the same
name.
Helper class for identifying correlated read/write pairs.
A utility class holding information about correlations identified by a
CorrelationFinder.Visitor class for performing case analysis on
Correlations.A CallGraph implementation adapted to work for graphs that contain code entities from multiple
languages, and hence multiple specialized forms of IR.
This class hierarchy represents a family of disjoint class hierarchies, one for each of a
selection of languages.
A ClassTargetSelector implementation that delegates to one of several child selectors based on
the language of the type being allocated.
A ContextSelector implementation adapted to work for analysis across multiple languages.
An InstanceKeyFactory implementation that is designed to support multiple languages.
A MethodTargetSelector implementation that supports multiple languages.
This class represents the CharacterRangeTable attribute.
This class represents an entry in the CharacterRangeTable.
This class represents the flags which a entry in the CharacterRangeTable can have.
This class lets you compile ShrikeBT intermediate code into real Java bytecodes using ShrikeCT.
This class decodes Java bytecodes into ShrikeBT code using a ShrikeCT class reader.
This is a dumping ground for useful functions that manipulate class info.
Iterative solver for a Killdall dataflow framework
Eliminate dead assignments (phis) from an SSA IR.
A debugging factory that creates debugging bitsets that are implemented as two bitsets that
perform consistency checks for every operation.
A Decoder translates a method's Java bytecode into shrikeBT code, i.e.
This exception is thrown when the Decoder detects invalid incoming bytecode (code that would
not pass the Java verifier).
Default object to control context-insensitive context selection, This includes reflection logic.
An entrypoint whose parameter types are the declared types.
Default implementation of a fixed point solver.
Default implementation of a dataflow graph
Contains some predefined behaviors.
Default implementation of
IRFactory.Default implementation of
PointerKeyFactoryBasic analysis; context-insensitive
Basic analysis; context-insensitive except for newInstance and clone
An object which represent Def-Use information for an SSA
IRExtend
CAstVisitor<C> to delegate unimplemented functionality to another visitor.A context that first checks with A, then defaults to B.
A context selector that first checks with A, then defaults to B.
A call graph implementation where some edges are delegated to other call sites, since they are
guaranteed to be the same.
An implementation of
ExtendedHeapModel based on a normal HeapModelA field refine policy that first checks with A, then delegates to B
A utility class.
An object that delegates edge management to the nodes,
INodeWithNumberedEdgesBasic functionality for a graph that delegates node and edge management, and tracks node numbers
Basic implementation of a numbered graph -- this implementation relies on nodes that carry
numbers and edges.
A context interpreter that first checks with A, then defaults to B.
An
SSAContextInterpreter that first checks with A, then defaults to B.A graph representation of statements flowing pointer values, but not primitive values.
A visitor that generates graph nodes and edges for an IR.
Demand-driven refinement-based points-to analysis.
Possible results of a query.
A flow graph including both pointer and primitive values.
A method descriptor; something like: (Ljava/langString;)Ljava/lang/Class;
Create AnalysisScope from java & dalvik file.
A module which is a wrapper around .dex and .apk file.
A wrapper around a EncodedMethod object (from dexlib) that represents a method.
This class constructs an SSA
IR from a backing ShrikeBT instruction stream.utilities related to depth-first search.
Extends
DFSPathFinder to discover all paths from a set of root nodes to nodes passing
some Predicate.This class implements depth-first search over a
NumberedGraph, return an enumeration of
the nodes of the graph in order of increasing discover time.This class implements depth-first search over a
Graph, return an enumeration of the nodes
of the graph in order of increasing finishing time.This class searches depth-first search for node that matches some criteria.
A DirectedHyperEdge is an edge of a
DirectedHyperGraph.Implementation of a directed hyper graph.
A module containing files under some directory.
This is a very simple component to disassemble a ShrikeBT method.
An object that computes the dominance frontiers of a graph
Calculate dominators using Langauer and Tarjan's fastest algorithm.
extracts JavaScript source code from HTML, with no model of the actual DOM data structure
utilities for interfacing with DOT
possible output formats for dot
A dummy state machine with a single, non-error state.
This class represents dup instructions.
This instruction represents iterating through the properties of its receiver object.
This instruction represents iterating through the properties of its receiver object.
A SourceModuleTranslator whose implementation of loadAllSources() uses the PolyglotFrontEnd
pseudo-compiler to generate DOMO IR for the sources in the compile-time classpath.
Representation of an analysis scope from an Eclipse project.
Eclipse projects are modeled with 3 loaders, as described above.
An
EclipseProjectAnalysisEngine specialized for source code analysisA module which is a wrapper around a .java file
This class is used by the PrunedCFG to determine which edges in a given CFG should be kept in the
pruned version.
View of a
NumberedGraph in which some edges have been filtered outAn object which manages edges in a directed graph.
The weight of an edge can produce a new value for the tail nodes given the head nodes.
A singleton instance of an empty iterator; this is better than Collections.EMPTY_SET.iterator(),
which allocates an iterator object;
A singleton instance of an empty iterator; this is better than Collections.EMPTY_SET.iterator(),
which allocates an iterator object;
The CAst source language front end for Java has explicit support for lexically-enclosing objects,
rather than compiling them away into extra fields and access-control thwarting accessor methods
as is done in bytecode.
An object to track performance of analysis engine
Entry arg source specs represent sources that are arguments to methods that are entry points.
A representation of an entrypoint in the call graph.
An escape correlation conservatively captures inter-procedural correlated pairs: for a dynamic
property read r of the form
e[p], if both the result of r and the value of
p flow into a function call c, we consider r and c to be a
correlated pair to account for the fact that the function called by c may perform a write
of property p.An object that represent the context everywhere; used for context-insensitive analysis
A
Statement representing the exceptional return value in a callee, immediately before
returning to the caller.A
Statement representing the exceptional return value in a caller, immediately after
returning to the caller.This class analyzes the exceptional control flow.
Converter to use the results of the exception analysis with an edge filter.
To filter exceptions you can implement this interface and use it in combination with
ExceptionFilter2EdgeFilter.This class converts an exception filter to an edge filter.
An ExceptionHandler represents a single handler covering a single instruction.
Helper class to check if an exception is part of a set of filtered exceptions.
A view of a CFG that ignores exceptional edges
This abstract class is used as interface for analysis that remove impossible control flow from a
CFG.
A key which represents the return value for a node.
Utility class to help deal with analysis of exceptions.
A warning for when we fail to resolve the type for a checkcast
This class reads Exceptions attributes.
This class builds serializable Exceptions attributes.
A call graph which explicitly holds the target for each call site in each node.
An abstract
NumberedEdgeManager where predecessor edges are represented explicitly.Intraprocedural null pointer analysis for the exploded control flow graph.
A view of a control flow graph where each basic block corresponds to exactly one SSA instruction
index.
Exploded interprocedural control-flow graph, constructed lazily.
discovers which names declared by an
entity are exposed, i.e., accessed by
nested functions.An extension of a heap model that returns a
PointerKey to represent an array length fieldThis is generates a dummy for the call to an external Activity.
An extraction policy tells a
ClosureExtractor which bits of code to extract into
closures.A special
ChildPos representing the position of a node which is the body of a for-in
loop.A region for the
ClosureExtractor to extract.Factorial utilities
Logic to interpret "factory" methods in context.
This is a hack to get around the fact that AST.resolveWellKnownTypes() doesn't know about some
implicitly declared exceptions, such as ArithmeticException (implicitly thrown in a division
operation) and NullPointerException (implicitly thrown in a field access).
A synthetic class for the fake root method.
A synthetic method that models the fake root node.
A synthetic method that calls all class initializers
This ContextInterpreter can be used when using another WALA frontend than the shrike frontend.
Abstract call graph builder class for building a call graph from a field-based flow graph.
Full result of call graph computation
Utility class for building call graphs.
A flow to or from a field.
Implementation of a canonical field reference.
A class to represent the reference in a class file to a field.
An identifier/selector for fields.
Interface for specifying a policy for refinement of field access handling.
FIFO work queue management of Objects that prevents an object from being added to the queue if it
is already enqueued and has not yet been popped.
FIFO work queue management of Objects that prevents an Object from being added to the queue if it
was ever previously enqueued.
A module which is a wrapper around a file in the filesystem
An object which represents a set of classes read from a text file.
This class provides files that are packaged with this plug-in
Some simple utilities used to manipulate Strings
Simple utilities for accessing files.
A simple liveness analysis based on flow-insensitive pointer analysis.
FilteredException represents either a single exception or an exception and all its subclasses.
A
PointerKey which carries a type filter, used during pointer analysisA
FilterIterator filters an Iterator to generate a new one.intersection of two filters
This abstract instruction extends the abstract invoke with functionality to support invocations
with a fixed number of arguments---the only case in some languages and a common case even in
scripting languages.
Constants used in the fixed-point solver framework
Add code to create an instance of a type in a synthetic method.
A flow graph models data flow between vertices representing local variables, properties, return
values, and so forth.
Class for building intra-procedural flow graphs for a given class hierarchy.
Flow types represent specific instances of sources or sinks.
Floyd-Warshall algorithm to compute all-pairs shortest path in graph with no negative cycles.
A policy telling a
ClosureExtractor to extract the body of every for-in loop.Under construction.
Hardcoded EntryPoint-specifications for an Android-Activity.
A function vertex represents a function object (or, more precisely, all function objects arising
from a single function expression or declaration).
Represents a single step in an iterative solver
Calculate dominators using Langauer and Tarjan's fastest algorithm.
Generic dataflow framework to accumulate reachable gen'ned values in a graph.
identifier of a GetCaughtException instruction
SSAContextInterpreter specialized to interpret Object.getClass() in a JavaTypeContextA
ContextSelector to intercept calls to Object.getClass()This class represents get and getstatic instructions.
A context which may be used if
the method to be interpreted is either
Class.getMethod(String, Class...)
or Class.getDeclaredMethod(String, Class...),
the type of the "this" argument is known and
the value of the first argument (the method name) is a constant.Understands
GetMethodContext.Produces
GetMethodContext if appropriate.Flow function that only permits globals - and the zero element - to flow through
Represents the JavaScript global object.
Propagates heap information from InstanceKeys to the LocalElements that point to those keys
This class represents goto and goto_w instructions.
Basic interface for a directed graph.
Utility class to check integrity of a graph data structure.
A graph view that reverses the edges in a graph
Simple graph printing utility
A dataflow system that computes, for each graph node, the set of "interesting" nodes that are
reachable
Utilities related to simple graph subset operations.
Utility methods for graphs.
A debugging aid.
A debugging aid.
Simple Heap data structure.
heap locations that should be excluded from data dependence during slicing
A
Graph view of a pointer analysis solution.A
Graph view of a pointer analysis solution.A
HeapModel embodies how a pointer analysis abstracts heap locations.Computation of reaching definitions for heap locations, relying on pointer analysis
Simple utility that uses reflection to trace memory
A HyperNode is a node of a
DirectedHyperGraph.An interface for a basic block in a control flow graph.
a relation R(x,y) where x >= 0
A binary flow function corresponding to a return statements combining information from the call
site and the exit site.
A method which originated in bytecode, decoded by Shrike
Forward supergraph induced over an
ExplodedInterproceduralCFGBasic interface for an object that represents a single Java class for analysis purposes,
including array classes.
General interface for a type hierarchy
Something that lives in a class hierarchy
Base class for an object that represents a single Java classloader for analysis purposes.
Basic interface for a demand-driven points-to analysis.
A flow function where out == in
A silly debugging aid that always returns the identity flow function
A basic block with exactly one normal instruction (which may be null), corresponding to a single
instruction index in the SSA instruction array.
Explore the result of an IFDS problem with an SWT viewer and ghostview.
Deprecated.
Replaced by TaintTransferFunctions.
Solves a set of constraints
The general form of a statement definition in an iterative solver is: x >= term, where term
can be any complex expression whose free variables are among the IVariables of the constraint
system this
IFixedPointStatementis part of (x represents the left-hand side of the
constraint).Represents a set of
IFixedPointStatements to be solved by a IFixedPointSolverA flow function corresponding to an edge in the supergraph.
A map from an edge in a supergraph to a flow function
An edge label in a flow graph
For filtering specific exceptions.
Callback which is implemented by users of the IHtmlParser.
Information on how the IInstanciationBehavior made its decision for
IInstantiationBehavior.InstanceBehaviorThe handling for a variable occurring in the AndroidModel.
Used for CallBacks to create an Instance.
This class is used by IInstruction.visit to dispatch based on the instruction type.
A dataflow framework in the style of Kildall, POPL 73 This represents a dataflow problem induced
over a graph.
Basic interface for liveness analysis of heap-allocated objects.
Basic interface for an object that represents a single Java member (method or field) for analysis
purposes.
Special case: if supportsMerge(), then the problem is not really IFDS anymore.
Basic interface for an object that represents a single Java method for analysis purposes.
Basic interface from which to execute and get the results of escape analysis.
A read-only byte array.
An immutable stack of objects.
A
CAstSourcePositionMap.Position for source code that has been included in some enclosing file, e.g.,
JavaScript code included in an HTML file via a script node.A filter that accepts everything.
A
ControlFlowGraph computed from a set of SSAInstruction instructions.TODO: Move this somewhere.
A method annotated with @Initializer is expected to always be invoked before the object is used.
This class reads InnerClasses attributes.
This class builds serializable InnerClasses attributes.
Basic interface from which to execute and get the results of escape analysis.
Basic interface for a node which lives in one graph ...
Basic interface for a node which lives in one graph ...
An pointer key which represents a unique set for a field associated with a set of instances.
an instance field pointer key key that carries a type filter
An InstanceKey serves as the representative for an equivalence class of objects in the heap, that
can be pointed to.
An object that abstracts how to model instances in the heap.
An instance key which has an associated
CGNode.This class represents instanceof instructions.
A pi node policy with the following rule:
Add code to create an instance of a type in a synthetic method.
Instructions are immutable objects.
Collection of Instruction wich allow to get an instruction from its table index id or from its
bytecode index.
This method annotation counts the number of instructions of each type (according to each
Instruction subclass).
An implementation of Tarjan's union-find, using path compression and balancing, for non-negative
integers
Determines the target of an Android-Intent.
Wraps an Intent to be suitable to be a Context-Element.
An
SSAContextInterpreter that redirects functions that start Android-Components.Adds Intents to the Context of functions that start Android-Components.
Like MicroModel but includes CallBacks.
Contains Information on functions that start Android-Components based on an Intent.
The flags influence the later model.
Contains information on how to call a starter-function.
Interface to retrieve the result of the interprocedural analysis.
Interprocedural control-flow graph.
Interprocedural NullPointer Analysis.
a more efficient iterator for sets of integers
An
IntMapIterator maps an Iterator contents to produce a new IteratorA pair of ints.
Intraprocedural dataflow analysis to detect impossible NullPointerExceptions.
State machine that only allows intraprocedural paths.
Intraprocedural dataflow analysis to detect impossible NullPointerExceptions.
Compute intraprocedural reaching defs of global variables, i.e., the defs are
SSAPutInstructions on static state.Set of integers; not necessary mutable TODO: extract a smaller interface?
Utilities for dealing with
IntSetsA variable for dataflow analysis, representing a set of integers.
A stack of integer primitives.
interface for array of integer
This exception is thrown when we detect that the incoming class file data was not a valid class
file.
An
InvalidSourceInfoException is thrown if SourceInfo could not be initialized.A graph view that reverses the edges in a graph
A graph view that reverses the edges in a graph
An edge manager that reverses the edges in a graph
An edge manager that reverses the edges in a graph
This class represents method invocation instructions.
Flow functions for a
PartiallyBalancedTabulationProblemAn operator in pointer analysis constraints.
Basic interface for a pointer analysis solver.
An SSA IR.
A Map that gives the names of the local variables corresponding to SSA value numbers at
particular IR instruction indices, if such information is available from source code mapping.
A flow function corresponding to an edge in the supergraph.
This is intended as an internal interface; clients probably shouldn't be using this directly.
Interface for an SDG (loosely defined here as a graph of
Statements.Common interface to all SSA BasicBlocks
A supergraph as defined by Reps, Horwitz, and Sagiv POPL95
Converts an
Iterator to a Collection.A utility to efficiently compose an iterator and a singleton
utilities dealing with Iterators
The
DataflowSolver builds system over graphs, with dataflow transfer functions on the
nodes, the edges or both.A flow function corresponding to an edge in the supergraph.
Used for handling resources that were copied from the web to local files (and still contain
references to the web)
Represents a single variable in a fixed-point iterative system.
simple interface for a vector.
An entry in a Jar file.
A module which is a wrapper around a Jar file
Read in a jar file from an input stream.
An
SSAContextInterpreter specialized to interpret methods on java.lang.Class in a JavaTypeContext which represents the point-type of the class object created by the call.The implementation of
Language which defines Java semantics.A Java process launcher
Abstraction of a primitive type in Java.
Checks if a reference is null or undefined, and if so, throws a ReferenceError.
generates instructions to simulate the semantics of JS constructor invocations
TODO cache generated IRs
We need to generate synthetic methods for Function.apply() in the target selector, so that the
AstMethod for Function_prototype_apply() in the prologue doesn't actually get used in the CGNodes
used for calls to Function.prototype.apply().
Generate IR to model Function.call()
Creates the single
class loader used for JavaScript.Factory interface for creating translators that generate the CAst for some JavaScript source
file.
JavaScriptTranslatorToCAst.MemberDestructuringContext<C extends JavaScriptTranslatorToCAst.WalkContext<C,T>,T>
Used to determine the value to be passed as the 'this' argument for a function call.
A
ClassLoaderImpl that processes source file entities in the compile-time classpath.WALA representation of a field on a Java type that resides in a source file
Implements a Context which corresponds to a given type abstraction.
Allows viewing the ClassHeirarcy, CallGraph and Pointer Analysis built from a given classpath.
Class responsible for mapping JDT type system objects representing types, methods and fields to
the corresponding WALA TypeReferences, MethodReferences and FieldReferences.
Default context functions.
Contains things needed by in the visit() of some nodes to process the nodes.
A SourceModuleTranslator whose implementation of loadAllSources() uses the PolyglotFrontEnd
pseudo-compiler to generate DOMO IR for the sources in the compile-time classpath.
Convenience methods to get information from JDT
IJavaElement model.ITag impel for Jericho generated tags
call graph construction options specific to JavaScript.
Specialization of
AstTranslator for JavaScript.TODO this class is a mess.
Common utilities for CFA-style call graph builders.
A
JSAbstractInstructionVisitor that is used to only visit instructions of a single
method.Augments the PaPanel with: 1) global pointer keys at the root level.
Extracts scripts from a given URL of an HTML.
Specialized pointer analysis constraint generation for JavaScript.
0-x-CFA Call graph builder, optimized to not disambiguate instances of "uninteresting" types
This class represents entry points (
Entrypoint)s of JUnit test methods.Note that classes from JVML have some features that are not present in all "bytecode" languages
currently supported.
A flow function that kills everything (even 0)
An object which tracks labeled edges in a graph.
A graph with labeled edges.
A
NodePos for a node that labels a CFG edge; currently only seems to occur with 'switch'
statements.Generates synthetic summaries to model the behavior of Java 8 lambdas.
Synthetic class modeling the anonymous class generated at runtime for a lambda expression.
Main interface for language-specific information.
Common functionality for most
Language implementations.Abstract base class for a process launcher
Compute mod-ref information limited to accesses of lexical variables.
A lexical access vertex represents a lexical variable, i.e., a local variable that is accessed
from within a nested function.
This class reads LineNumberTable attributes.
This class helps emit LineNumberTable attributes.
Behavior loaded from a file.
Hardcoded specifications of androids loader call-backs.
This class represents local variable load instructions.
This method annotation parcels out fresh local variables for use as temporaries by
instrumentation code.
Intraprocedural SSA-based live range analysis.
A set of path edges for a particular procedure entry s_p.
A pointer key which provides a unique set for each local in each call graph node.
a local pointer key that carries a type filter
A set of summary edges for a particular procedure.
This class reads LocalVariableTable attributes.
This class helps emit LocalVariableTable attributes.
Hardcoded specifications of androids location handling call-backs.
A stop watch that prints log messages.
simple utilities with logarithms
a more efficient iterator for sets of longs
Set of longs; not necessary mutable TODO: extract a smaller interface?
Utilities for dealing with LongSets
Builds an Android Model incorporating two loops.
Builds an Android Model incorporating three loops.
A dummy main class that runs WALA in a headless Eclipse platform.
This is a demo class.
A call graph refinement policy with manual annotations for which virtual call sites to refine.
Manually annotated policy for refining field accesses.
A refinement policy specified manually with annotations.
An
MapIterator maps an Iterator contents to produce a new Iteratorutilities for managing
MapsAbstract superclass of
MethodReference and FieldReference* represents a single static occurrence of a memory access (i.e., an access to a field or to the
contents of an array) in the code
"Non-standard" bypass rules to use during call graph construction.
This class is a container for a bunch of information that we might know about a method.
Annotation objects implement this Results interface.
The MethodEditor is the core of the ShrikeBT code rewriting mechanism.
Output is the interface that patches use to emit their code into a method body.
This class is subclassed for each kind of patch that you want to apply.
A specialized Instruction.Visitor providing convenience methods for inserting patches.
A statement representing method entry, used for managing control dependence.
A
Statement representing method exit used as a dummy exit for starting propagation to a
seed statement in backwards slicing.Deprecated.
This class represents the MethodPositions attribute.
A class to represent the reference in a class file to a method.
An identifier/selector for methods.
Provides a way for the nullpointer analysis to decide whether or not a called method may throw an
exception.
Summary information for a method.
This interface represents policies for selecting a method to call at a given invocation site.
This is a demo class.
UNDER CONSTRUCTION.
Model for single Target Class.
Models all classes derived from the given AndroidComponent.
Mod-ref analysis for heap locations.
Computes interprocedural field accesses for a given method.
A
Module represents a set of files to analyze.A ModuleEntry represents a wrapper around a file representation in a
Module.This class represents monitorenter and monitorexit instructions.
Simple utilities for Eclipse progress monitors
Use this interface to decouple core utilities from the Eclipse layer
an implementation of
IntVector that uses a mix of backing arrays of type int, char, and
byte array, in an attempt to save space for common data structures.An
InstanceKey which represents a multinewarray allocation site in a CGNode.A modifiable control flow graph.
An
IntSet that can be changed.An object that creates some flavor of mutable int set.
An object that creates some flavor of mutable int set.
A bit set mapping based on an object array.
The shared bit vector implementation described by [Heintze 1999] TODO: much optimization
possible.
A factory for mutable shared bit vector int sets
A sparse ordered, mutable duplicate-free, fully-encapsulated set of integers.
An object that creates mutable sparse int sets.
A sparse ordered, mutable duplicate-free, fully-encapsulated set of longs.
An object that creates mutable sparse int sets.
superclass for CAst parsers / translators making use of native code.
common functionality for any
TranslatorToCAst making use of native codenCFA Call graph builder.
An EdgeFilter that ignores all edges contained in a given graph.
Represents a textual allocation site
call graph builder based on object sensitivity
k-limited object sensitive context selector
for static method : For a few well-known static factory methods from the standard
libraries, use
CallerSiteContext.Otherwise, directly copy the context of the last
non-static method
for virtual method : The Context consists of n allocation sites
for an object(fixed at allocation) : The heap context consists of n allocation sites
inherited from CGNode
This class is intended to be used whenever a JavaScript module is dynamically required by
JavaScript (CommonJS).
This class is used by WALA internals to resolve to what functions a call could potentially
invoke.
A key which represents a set corresponding to a call graph node.
A node labeller keeps a mapping from nodes to integers to allow consistent labelling of nodes.
An object which tracks graph nodes.
A node pattern that matches an AST node of a certain kind; additionally, the node's children have
to match the pattern's child patterns.
Interface for lightweight AST patterns.
Representation of a node's position in a CAst entity's syntax tree.
A node which carries it's own number; which identifies it in a
NumberedGraph
implementation.Simple implementation of
INodeWithNumberedEdgesA singleton iterator for an object which is guaranteed to be not-null.
Defines a normal Order on Weight: unlimited < ...
A
Statement representing the normal return value in a callee, immediately before
returning to the caller.A
Statement representing the normal return value in a caller, immediately after returning
to the caller.A statement that has a corresponding index in the SSA IR
Indicates the superclass for a class was not found in the
AnalysisScopeAn operator of the form lhs = op
Represents a single step, restricted to a nullary operator.
Tries to detect impossible (or always appearing) NullPointerExceptions and removes impossible
control flow from the CFG.
Adapter for
IntraproceduralNullPointerAnalysis.Nullpointer analysis - NOT A REAL KILDALL framework instance, because the transfer functions are
not distribute (similar to constant propagation).
Intraprocedural dataflow analysis to detect impossible NullPointerExceptions.
States for the ssa variables.
A pi node policy with the following rule:
This class implements depth-first search over a NumberedGraph, return an enumeration of the nodes
of the graph in order of increasing discover time.
This class implements depth-first search over a NumberedGraph, return an enumeration of the nodes
of the graph in order of increasing discover time.
Calculate dominators using Langauer and Tarjan's fastest algorithm.
Additional functionality for edges in numbered graphs
A numbered graph is a
Graph where each node has a unique persistent non-negative integer
id.An object which tracks nodes with numbers.
A bit set mapping based on an immutable object array.
Class files are taken as input arguments (or if there are none, from standard input).
This class provides a convenient way to iterate through a collection of Java classes and
instrument their code.
This class provides functionality for performing offline instrumentation.
Thiscallback is notified whenever an entry has been added to the output zip file.
An ordinal set mapping, backed a delegate, but adding an offset to each index.
Adds one-level of
ArgumentInstanceContext on the function argument for functions that
perform lexical accesses (i.e., those functions represented by a ScopeMappingInstanceKeys.ScopeMappingInstanceKey).This is a context selector that adds one level of calling context to a base context selector.
Only refines for the array contents pseudo-field.
Combinators for
UnaryOperatorAn operator of the form lhs = op_1(op_2(..op_n(rhs)..))
Optimistic call graph builder that propagates inter-procedural data flow iteratively as call
edges are discovered.
A Set backed by a set of integers.
An object that implements a bijection between whole numbers and objects.
Context Free overrides for the startComponent-Methods.
A
MemoryAccessMap that makes use of a pre-computed PointerAnalysis to reduce the
number of considered accesses.Panel for showing the Pointer Analysis results.
A
Statement representing a formal parameterA
Statement representing an actual parameterAccess parameters without confusion on their numbers.
The Constructor used to create ParameterAccessor influences the parameter-offset.
The kind of parameter.
The representation of a Parameter handled using a ParameterAccessor.
This key is identified by type and parameter number.
A flow to or from the parameter of a method.
Encapsulates the state of all parameters of an invoked method
A parameter vertex represents a positional parameter of a function.
a debugging aid.
a debugging aid.
a view of a portion of a call graph.
A
TabulationProblem with additional support for computing with partially balanced
parentheses.Utilities for dealing with tabulation with partially balanced parentheses.
We represent a path in a numbered graph as a vector of integers <i_1, ..., i_n> where node
i_1 is the src and node i_n is the sink
an individual edge <entry, d1> -> <target, d2>
This simple example WALA application builds a call graph and fires off ghostview to visualize a
DOT representation.
This simple example application builds a WALA CDG and fires off ghostview to viz a DOT
representation.
This simple example WALA application builds an SDG and fires off ghostview to viz a DOT
representation.
This simple example WALA application computes a slice (see
Slicer) and fires off the PDF
viewer to view a dot-ted representation of the slice.This simple example WALA application builds a TypeHierarchy and fires off ghostview to viz a DOT
representation.
Launch gsview on a postscript file
utilities for integrating with ghostview (or another PS/PDF viewer)
This simple example application builds a WALA IR and fires off a PDF viewer to visualize a DOT
representation.
Program dependence graph for a single call graph node
Call graph builder for building pessimistic call graphs, where inter-procedural flows are not
tracked except in the trivial case of local calls.
dummy class representing a missing superclass
identifier of a phi instruction
A value generated by a phi instruction.
identifier of a Pi instruction
Platform-specific utility functions.
Abstract definition of pointer analysis
General representation of the results of pointer analysis
A PointerKey instance serves as the representative for an equivalence class of pointers.
An object that abstracts how to model pointers in the heap.
Iterates over the value numbers of the pointer parameters of a method.
An object that tracks the mapping between pointer keys and points-to set variables
Representation of a points-to set during an andersen-style analysis.
Represents a single concrete type.
PopInstructions pop one or two elements off the working stack.
Represents a source file position.
Offers checks like ClassHierarchy.isAssignable but for primitives.
Abstraction of a primitive type.
Simple object that represents a program counter value (i.e., an instruction in the bytecode)
A class to control execution through the
MonitorUtil.IProgressMonitor interface.A Wrapper around an Eclipse IProgressMonitor
This abstract base class provides the general algorithm for a call graph builder that relies on
propagation through an iterative dataflow solver
A pointer key that delegates to an untyped variant, but adds a type filter
A dataflow graph implementation specialized for propagation-based pointer analysis
System of constraints that define propagation for call graph construction
A context selector that applies object sensitivity for the i'th parameter if it is used as a
property name in a dynamic property access.
Transforms property reads to make prototype chain operations explicit.
A property vertex represents all properties with a given name.
Non-deterministically assigns some object in the prototype chain of val (or val itself) to
result.
Hardcoded EntryPoint-specifications for an Android-ContentProvider.
A pruned view of a
ControlFlowGraph.Policy which decides which branch of a call graph is going to be pruned.
This class represents put and putstatic instructions.
Misc SQL-like support for queries on tables
This class represents a range in the source file.
Trivial flow functions to represent simple reachability.
The most basic form of correlation: an intra-procedurally correlated pair of a dynamic property
read and a dynamic property write.
This is a context which is customized for the
InstanceKey of the receiver.This context selector selects a context based on the concrete type of the receiver.
A context selector that attempts to detect recursion beyond some depth in a base selector.
ensures that no contexts returned by a base context selector are recursive (assertion failure
otherwise)
For some reason (either a bug in our code that defeats soft references, or a bad policy in the
GC), leaving soft reference caches to clear themselves out doesn't work.
A complete refinement policy for a points-to analysis.
SSAContextInterpreter to handle all reflection procession.A
ContextSelector to handle default reflection logic.A helper class which can modify a
PropagationCallGraphBuilder to deal with reflective
factory methods.An
SSAContextInterpreter specialized to interpret reflective invocations such as
Constructor.newInstance and Method.invoke on an IMethod constant.TODO: document me.
Helper class to find the variable that may be null.
A return flow represents either a flow from a method that was just invoked if this points to an
invoke instruction (in which case this is a source) or a method return, if this points to a
return instruction (in which case it is a sink).
This instruction represents all return instructions.
A key which represents the return value for a node.
a helper class which can modify a PropagationCallGraphBuilder to deal with reflective factory
methods.
A return vertex represents all return values of a given function.
Helper for building the Descriptor of a model.
An iterator that reverses an input iterator.
Defines a reverse Order on Weight: ...
This object will analyze a method in a context and return information needed for RTA.
This RTA implementation tracks a single set of Classes for each Selector
This class computes strongly connected components for a Graph (or a subset of it).
Driver that constructs a call graph for an application specified via a scope file.
An
InstanceKeyFactory that returns ScopeMappingInstanceKeys.ScopeMappingInstanceKeys as necessary to
handle interprocedural lexical scoping (specifically, to handle closure creation when a function
escapes its allocating scope)System dependence graph.
A selective Cartesian product context that enforces object sensitivity on some set of parameter
positions.
A method selector; something like: foo(Ljava/lang/String;)Ljava/lang/Class;
Functions get called once in sequential order.
Hardcoded EntryPoint-specifications for an Android-Service.
Logically, a set of
Class.A serializable version of
AnalysisScope.ShiftInstructions are distinguished from BinaryOpInstructions because most binary operations in
the JVM require both parameters to be the same type, but shifts always take one int parameter.
A wrapper around a Shrike object that represents a method
A graph of basic blocks.
A class read from Shrike
A soft handle to a Shrike class reader
A wrapper around a Shrike object that represents a method
An implementation of
SSAIndirectionData specialized for IRs originated from Shrike.In Shrike, the only "source" level entities which have names relevant to indirect pointer
operations are bytecode locals.
An
IRFactory that for methods that originate from Shrike.Utilities to interface with the Shrike CT library.
Base class for wrappers around Strings that represent Signature annotations according to Java 5.0
JVM spec enhancements.
This class reads Signature attributes.
The nodes in this graph are PointerKeys corresponding to local variables and static fields,
InstanceKeys, and FieldRefs (see below).
Purely field-based, context-insensitive demand-driven points-to analysis with very simple
implementation.
simple implementation of IntVector
simple implementation of IVector
Abstract
ClassLoaderFactory for languages modeled as having a single class loader.A policy for performing a single analysis pass, i.e., with no refinement.
Builds an Android Model incorporating a single loop.
A flow function which has only the edge 0 -> dest
flow functions for flow-sensitive context-sensitive slicer
A demand-driven context-sensitive slicer.
options to control control dependence edges in the sdg
options to control data dependence edges in the SDG
Tabulation problem representing slicing
utility methods for working with slices and slice
StatementsThis class implements depth-first search over a Graph, return an enumeration of the nodes of the
graph in order of increasing discover time.
This class implements depth-first search over a Graph, return an enumeration of the nodes of the
graph in order of increasing finishing time.
An object which manages node numbers via a mapping.
A graph of numbered nodes, expected to have a fairly sparse edge structure.
A labeled graph implementation suitable for sparse graphs.
A simple implementation of Map; intended for Maps with few elements.
An
InstanceKey which represents the set of all allocation sites of a given type in a
CGNode.This class provides instance keys where for a given type T in a CGNode N, there is one "abstract
allocation site" instance for all T allocations in node N.
A node pattern matching any constant.
Driver that constructs a call graph for an application specified as a directory of source code.
a module representing a directory tree of source files.
A
Module which is a wrapper around a source fileThis class reads SourceFile attributes.
This class builds serializable SourceFile attributes.
An interface used by the JavaSourceLoaderImpl to encapsulate the loading of source entities on
the compile-time classpath into the DOMO analysis infrastructure.
Represents a region of source code, with source locations.
A sparse ordered, duplicate-free, fully-encapsulated set of integers; not necessary mutable
an int vector implementation designed for low occupancy.
an int vector implementation designed for low occupancy.
A sparse ordered, duplicate-free, fully-encapsulated set of longs; not necessary mutable
An object which tracks edges for nodes that have numbers.
A graph of numbered nodes, expected to have a fairly sparse edge structure.
An
IVector implementation designed for low occupancy.Instantiates certain android-types differently.
A Call instruction.
An instruction which unconditionally throws an exception
An
SSAAddressOfInstruction represents storing the address of some "source" level entity
(@see SSAIndirectionData.Name) into an SSA value number.SSA instruction representing v_x := arraylength v_y
SSA instruction representing an array load.
Abstract base class for instructions that load or store from array contents.
SSA instruction representing an array store.
This class constructs an SSA
IR from a backing ShrikeBT instruction stream.A mapping from IMethod -> SSAOptions -> SoftReference -> Something
A control-flow graph for ssa form.
A checkcast (dynamic type test) instruction.
SSA Instruction for comparisons between floats, longs and doubles
A conditional branch instruction, which tests two values according to some
IConditionalBranchInstruction.IOperator.An object that provides an interface to local method information needed for CFA.
An instruction which converts a value of one primitive type into another primitive type.
Abstract base class for
SSAGetInstruction and SSAPutInstruction.A "catch" instruction, inserted at the head of a catch block, which assigns a pending exception
object to a local variable.
SSA instruction that reads a field (i.e.
Unconditional branch instruction for SSA form.
A mapping that tells, for a given instruction s, what "names" does s def and use
indirectly.
A Name is a mock interface introduced just for strong typing.
This class performs intra-procedural propagation over an SSA form.
A dynamic type test (instanceof) instruction.
An instruction in SSA form.
This interface is used by Instruction.visit to dispatch based on the instruction type.
A base visitor implementation that does nothing.
An instruction factory for SSA.
Used for representing the JVML invokedynamic instruction.
A load from a pointer.
An instruction that represents a reflective or meta-programming operation, like loadClass in Java
An instruction representing a monitorenter or monitorexit operation.
An allocation instruction ("new") for SSA form.
Options that govern SSA construction
While SSA form makes the not-unreasonable assumption that values must be defined before they
are used, many languages permit using undefined variables and simply give them some default
value.
A phi instruction in SSA form.
A Pi instruction is a dummy assignment inserted at the tail of a basic block, in order to get a
new variable name to associate with some flow-insensitive dataflow fact.
The
SSABuilder consults this as an oracle to decide how to insert SSAPiInstructionsThis abstract base class provides the general algorithm for a call graph builder that relies on
propagation through an iterative dataflow solver, and constraints generated by statements in SSA
form.
A visitor that generates constraints based on statements in SSA form.
sets bingo to true when it visits an interesting instruction
A putfield or putstatic instruction
A return instruction.
Utility class used by
CorrelationSummary to map SSA instructions to source positions.A store from a pointer.
SSA instruction representing a switch statement.
An instruction which unconditionally throws an exception
An SSA instruction for some unary operator.
A number representating an SSA-Value and its type.
Identify variables by a string and type.
A key that matches variables by their type - does not compare to NamedKey.
A key that cannot be recreated.
All variables with the same name in the source code.
This NamedKey also equals to TypeKeys.
Manage SSA-Variables in synthetic methods.
standard fixed-point iterative solver for pointer analysis
A state machine with an error state.
Identifier of a statement in an SDG.
A
Statement which carries an instruction index, representing the index of an SSAInstruction in the IR instruction array.Exception thrown when a state machine needs to merge states and treat them as equivalent.
An pointer key which represents a unique set for each static field.
This is a demo class.
Basic class to time events
A
Stopwatch that also queries the free memory from the GC.This class represents instructions that store to local variables.
utilities for IO streams
An
InstanceKey which represents the constant char[] contents of a string constant object.Some simple utilities used to manipulate Strings
A node pattern matching a node of a given kind, without regard to its children.
An entrypoint whose parameter types are cones based on declared types.
A
SyntheticMethod representing the semantics encoded in a MethodSummaryA SummarizedMethod (for synthetic functions) with variable names.
This instruction represents the swap instruction, which swaps the two values on top of the
working stack.
This instruction represents all forms of switch instructions.
A class to view a WALA
Graph with an SWT TreeViewerA symbol table which associates information with each variable (value number) in an SSA IR.
transforms each synchronized block to execute under a conditional test calling some method m(),
where the block is duplicated in both the if and else branches.
An
IClass that exists nowhere in bytecode.A bogus class to support returning "unknown" objects
A synthetic model of java.lang.System native methods.
This is generates a dummy for the call to an external Activity.
A
CancelException thrown during tabulation; holds a pointer to a partial TabulationSolver.Result.Domain of facts for tabulation.
Representation of a Dyck-language graph reachability problem for the tabulation solver.
The solution of a tabulation problem: a mapping from supergraph node -> bit vector
representing the dataflow facts that hold at the entry to the supergraph node.
A precise interprocedural tabulation solver.
This context selector selects a context based on whether the receiver type dispatches to a given
method.
A cheap, context-insensitive thin slicer based on reachability over a custom SDG.
This method annotation checks to see whether "this" is assigned to by the method.
A synthetic model of single-threaded behavior
This class represents the athrow instruction.
Utilities for iterating over graphs in topological order.
A comparator based on lexicographical ordering of toString()
Type that performs the translation from the CAst to WALA IR (as extended for the language).
Trivial method-level escape analysis.
Operator U(n) = true
A
MutableSparseIntSet that allows for tuning of its initial size and expansion factor.A refinement policy that iteratively adds more types to refine, based on which type was
encountered first in each analysis pass.
a simple implementation of int vector that can be tuned to control space usage
an int vector implementation which delegates to pages of int vectors.
An
IVector implementation which delegates to pages of int vectors.Abstraction of a Java type.
A
TypeAnnotation represents a JSR 308 Java Type Annotation.A
TypeAnnotation.TypeAnnotationTarget represents the "target" of a Type Annotation.A @{TypeAnnotationTargetConverter} takes "unresolved" instances of
TypeAnnotationsReader.TypeAnnotationTarget, resolves some
byte-code specific data, and returns instances of the corresponding TypeAnnotation.TypeAnnotationTarget subclass.This class reads TypeAnnotations attributes, i.e.: RuntimeInvisibleTypeAnnotations and
RuntimeVisibleTypeAnnotations
Possible target_type items.
Known target_types for JSR 308 Type-Annotation.
Enumeration of those Bytecode locations where type annotation may appear (in the corresponding
attribute table).
A
TypeAnnotationsReader.TypeAnnotationTarget represents one of the possible target_info structureUNDER CONSTRUCTION
A trivial field-based heap model, which only uses the information of which types (classes) are
live.
A trivial field-based pointer analysis solution, which only uses the information of which types
(classes) are live.
This class performs intraprocedural type propagation on an SSA IR.
An operator which initializes a type to a declared type.
We've introduced this class to canonicalize Atoms that represent package names.
A class to represent the reference in a class file to some type (class, primitive or array).
Intended for SyntheticMethods, uses JavaInstructionFactory.
UNDER CONSTRUCTION.
A type variable in the dataflow system for type inference.
TypeVariableSignature: T identifier ;
Operator U(n) = U(n) U U(j)
for unary ops not defined in JVML
An operator of the form lhs = op (rhs)
This class represents unary operators where the result is the same type as the operand.
Operator U(n) = U(n) | U(j)
A SideEffect is a constraint which carries a points-to-set which is def'fed or used in created
constraints.
Represents a single step, restricted to a unary operator.
Something that's not implemented yet.
Checks ContextSelectors A and B, then returns the union of their findings.
This Model is used to start an Android-Component of unknown Target.
The unknown vertex is used to model complicated data flow.
A
TabulationDomain with no build-in partial order defining priority.Abstract class that contains conversion routines to/from utf8 and/or pseudo-utf8.
Convenience methods for navigating a
ControlFlowGraph.Call graph utilities
This class contains miscellaneous useful functions.
Miscellaneous utility functions.
Representation of a particular value which appears in an SSA IR.
A variable vertex represents an SSA variable inside a given function.
A function which gens a vector of outgoing dataflow facts.
A function which kills a vector of incoming dataflow facts
An optional interface for data structures that provide a verbose option for debugging purposes.
This class typechecks intermediate code.
Class representing a flow graph vertex.
A vertex factory is associated with a flow graph.
An SWT action that spawns spawns a ghostview to see the local supergraph for a procedure node
which is the current selection in a tree viewer.
An SWT action that spawns spawns a ghostview to see the IR for a call graph node which is the
current selection in a tree viewer.
Instructions can be added in a non-ascending manner.
An exception to raise for some WALA failure
Runtime exception for some WALA failure.
Viewer for ClassHeirarcy, CallGraph and Pointer Analysis results.
A warning message.
A global, static dictionary of warnings
ClassLoader for Java & Dalvik.
A weight may be not set, a number or unlimited, note that the meaning of unlimited is given by
the chosen order (see
NormalOrder and ReverseOrder).Simple abstraction for pairing some type with a
StateMachine.State.Worklist for fixed-point solver implementation
Optimistic call graph builder that propagates inter-procedural data flow iteratively as call
edges are discovered.
This class reads method summaries from an XML Stream.
Represents an array with length zero.
0-1-CFA Call graph builder, optimized to not disambiguate instances of "uninteresting" types.
0-X-CFA Call graph builder which analyzes calls to "container methods" in a context which is
defined by the receiver instance.
Flexible class to create
InstanceKeys depending on various policies ranging from
class-based (i.e.