java - Wala Java Slicer - 切片中缺少语句

Question

我刚开始使用 Wala Java Slicer 来做一些源代码分析任务。我对图书馆的正确使用有疑问。假设我有以下示例代码:

public void main(String[] args) {
    ...
    UserType ut = userType;
    int i = ut.getInt();
    ...
    System.out.println(i);
}

用 Wala 计算 println 语句的切片给出以下语句:

NORMAL_RET_CALLER:Node: < Application, LRTExecutionClass, main([Ljava/lang/String;)V > Context: Everywhere[15]13 = invokevirtual < Application, LUserType, getInt()I > 11 @27 exception:12
NORMAL main:23 = getstatic < Application, Ljava/lang/System, out, <Application,Ljava/io/PrintStream> > Node: < Application, LRTExecutionClass, main([Ljava/lang/String;)V > Context: Everywhere
NORMAL main:invokevirtual < Application, Ljava/io/PrintStream, println(I)V > 23,13 @63 exception:24 Node: < Application, LRTExecutionClass, main([Ljava/lang/String;)V > Context: Everywhere

我使用 Wala 创建切片的代码如下所示:

AnalysisScope scope = AnalysisScopeReader.readJavaScope("...", 
                            null, WalaJavaSlicer.class.getClassLoader());
ClassHierarchy cha = ClassHierarchy.make(scope);

Iterable<Entrypoint> entrypoints = Util.makeMainEntrypoints(scope, cha);
AnalysisOptions options = new AnalysisOptions(scope, entrypoints);

// Build the call graph
CallGraphBuilder cgb = Util.makeZeroCFABuilder(options, new AnalysisCache(),cha, scope, null, null);
CallGraph cg = cgb.makeCallGraph(options, null);
PointerAnalysis pa = cgb.getPointerAnalysis();

// Find seed statement
Statement statement = findCallTo(findMainMethod(cg), "println");

// Context-sensitive thin slice
Collection<Statement> slice = Slicer.computeBackwardSlice(statement, cg, pa, DataDependenceOptions.NO_BASE_NO_HEAP, ControlDependenceOptions.NONE);
dumpSlice(slice);

我希望在切片中找到许多语句，但它们不存在:

• 即使依赖方法调用 ut.getInt() 包含在切片中，也不包含赋值语句 ut = userType
• 不包含getInt() 实现中的语句。是否有激活“程序间”切片的选项？我应该在这里提一下，.class 文件包含在用于创建 AnalysisScope 的路径中。

如您所见，我使用 DataDependenceOptions.NO_BASE_NO_HEAP 和 ControlDependenceOptions.NONE 作为依赖选项。但即使我对两者都使用 FULL，问题仍然存在。

我做错了什么？

Answer 1

The assign statement ut = userType is not included even though the dependent method call ut.getInt(), IS included in the slice

我怀疑赋值永远不会进入字节码，因为它是一个不需要的局部变量，因此对 WALA 是不可见的:

Because the SSA IR has already been somewhat optimized, some statements such as simple assignments (x=y, y=z) do not appear in the IR, due to copy propagation optimizations done automatically during SSA construction by the SSABuilder class. In fact, there is no SSA assignment instruction; additionally, a javac compiler is free to do these optimizations, so the statements may not even appear in the bytecode. Thus, these Java statements will never appear in the slice.

http://wala.sourceforge.net/wiki/index.php/UserGuide:Slicer#Warning:_exclusion_of_copy_statements_from_slice