├── .gitignore ├── A1 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── ResultProcessor.java │ │ ├── StmtResult.java │ │ ├── dataflow │ │ │ ├── analysis │ │ │ │ ├── AbstractDataflowAnalysis.java │ │ │ │ ├── DataflowAnalysis.java │ │ │ │ └── LiveVariableAnalysis.java │ │ │ ├── fact │ │ │ │ ├── DataflowResult.java │ │ │ │ ├── NodeResult.java │ │ │ │ └── SetFact.java │ │ │ └── solver │ │ │ │ ├── IterativeSolver.java │ │ │ │ └── Solver.java │ │ └── graph │ │ │ ├── callgraph │ │ │ └── CallGraphBuilder.java │ │ │ └── cfg │ │ │ └── CFG.java │ │ ├── ir │ │ ├── exp │ │ │ ├── Exp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ └── Stmt.java │ │ └── util │ │ └── graph │ │ └── Graph.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ ├── Tests.java │ │ └── dataflow │ │ └── analysis │ │ └── LiveVarTest.java │ └── resources │ └── dataflow │ └── livevar │ ├── Array-livevar-expected.txt │ ├── Array.java │ ├── Assign-livevar-expected.txt │ ├── Assign.java │ ├── Branch-livevar-expected.txt │ ├── Branch.java │ ├── BranchLoop-livevar-expected.txt │ ├── BranchLoop.java │ ├── Fibonacci-livevar-expected.txt │ ├── Fibonacci.java │ ├── Reference-livevar-expected.txt │ └── Reference.java ├── A2 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── ResultProcessor.java │ │ ├── StmtResult.java │ │ ├── dataflow │ │ │ ├── analysis │ │ │ │ ├── AbstractDataflowAnalysis.java │ │ │ │ ├── DataflowAnalysis.java │ │ │ │ └── constprop │ │ │ │ │ ├── CPFact.java │ │ │ │ │ ├── ConstantPropagation.java │ │ │ │ │ └── Value.java │ │ │ ├── fact │ │ │ │ ├── DataflowResult.java │ │ │ │ ├── MapFact.java │ │ │ │ └── NodeResult.java │ │ │ └── solver │ │ │ │ ├── Solver.java │ │ │ │ └── WorkListSolver.java │ │ └── graph │ │ │ ├── callgraph │ │ │ └── CallGraphBuilder.java │ │ │ └── cfg │ │ │ └── CFG.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── ArithmeticExp.java │ │ │ ├── BinaryExp.java │ │ │ ├── BitwiseExp.java │ │ │ ├── ConditionExp.java │ │ │ ├── Exp.java │ │ │ ├── IntLiteral.java │ │ │ ├── ShiftExp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ ├── DefinitionStmt.java │ │ │ └── Stmt.java │ │ └── util │ │ └── graph │ │ └── Graph.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ ├── Tests.java │ │ └── dataflow │ │ └── analysis │ │ └── constprop │ │ └── CPTest.java │ └── resources │ └── dataflow │ └── constprop │ ├── Assign-constprop-expected.txt │ ├── Assign.java │ ├── BranchConstant-constprop-expected.txt │ ├── BranchConstant.java │ ├── Interprocedural-constprop-expected.txt │ ├── Interprocedural.java │ ├── SimpleBinary-constprop-expected.txt │ ├── SimpleBinary.java │ ├── SimpleBranch-constprop-expected.txt │ ├── SimpleBranch.java │ ├── SimpleChar-constprop-expected.txt │ ├── SimpleChar.java │ ├── SimpleConstant-constprop-expected.txt │ └── SimpleConstant.java ├── A3 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── ResultProcessor.java │ │ ├── dataflow │ │ │ ├── analysis │ │ │ │ ├── AbstractDataflowAnalysis.java │ │ │ │ ├── DataflowAnalysis.java │ │ │ │ ├── DeadCodeDetection.java │ │ │ │ ├── LiveVariableAnalysis.java │ │ │ │ └── constprop │ │ │ │ │ ├── CPFact.java │ │ │ │ │ ├── ConstantPropagation.java │ │ │ │ │ └── Value.java │ │ │ ├── fact │ │ │ │ ├── DataflowResult.java │ │ │ │ ├── MapFact.java │ │ │ │ ├── NodeResult.java │ │ │ │ └── SetFact.java │ │ │ └── solver │ │ │ │ ├── Solver.java │ │ │ │ └── WorkListSolver.java │ │ └── graph │ │ │ ├── callgraph │ │ │ └── CallGraphBuilder.java │ │ │ └── cfg │ │ │ ├── CFG.java │ │ │ └── Edge.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── ArithmeticExp.java │ │ │ ├── BinaryExp.java │ │ │ ├── BitwiseExp.java │ │ │ ├── ConditionExp.java │ │ │ ├── Exp.java │ │ │ ├── IntLiteral.java │ │ │ ├── ShiftExp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ ├── AssignStmt.java │ │ │ ├── DefinitionStmt.java │ │ │ ├── If.java │ │ │ ├── Stmt.java │ │ │ └── SwitchStmt.java │ │ └── util │ │ └── graph │ │ └── Graph.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ ├── Tests.java │ │ └── dataflow │ │ └── analysis │ │ └── DeadCodeTest.java │ └── resources │ └── dataflow │ └── deadcode │ ├── ControlFlowUnreachable-deadcode-expected.txt │ ├── ControlFlowUnreachable.java │ ├── DeadAssignment-deadcode-expected.txt │ ├── DeadAssignment.java │ ├── Loops-deadcode-expected.txt │ ├── Loops.java │ ├── UnreachableIfBranch-deadcode-expected.txt │ ├── UnreachableIfBranch.java │ ├── UnreachableSwitchBranch-deadcode-expected.txt │ └── UnreachableSwitchBranch.java ├── A4 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── ResultProcessor.java │ │ ├── StmtResult.java │ │ ├── dataflow │ │ │ ├── analysis │ │ │ │ ├── AbstractDataflowAnalysis.java │ │ │ │ ├── DataflowAnalysis.java │ │ │ │ └── constprop │ │ │ │ │ ├── CPFact.java │ │ │ │ │ ├── ConstantPropagation.java │ │ │ │ │ └── Value.java │ │ │ ├── fact │ │ │ │ ├── DataflowResult.java │ │ │ │ ├── MapFact.java │ │ │ │ └── NodeResult.java │ │ │ ├── inter │ │ │ │ ├── AbstractInterDataflowAnalysis.java │ │ │ │ ├── InterConstantPropagation.java │ │ │ │ ├── InterDataflowAnalysis.java │ │ │ │ └── InterSolver.java │ │ │ └── solver │ │ │ │ ├── Solver.java │ │ │ │ └── WorkListSolver.java │ │ └── graph │ │ │ ├── callgraph │ │ │ ├── AbstractCallGraph.java │ │ │ ├── CGBuilder.java │ │ │ ├── CHABuilder.java │ │ │ ├── CallGraph.java │ │ │ ├── CallGraphBuilder.java │ │ │ ├── CallGraphs.java │ │ │ ├── CallKind.java │ │ │ ├── DefaultCallGraph.java │ │ │ ├── Edge.java │ │ │ └── MethodEdge.java │ │ │ ├── cfg │ │ │ └── CFG.java │ │ │ └── icfg │ │ │ ├── CallEdge.java │ │ │ ├── CallToReturnEdge.java │ │ │ ├── ICFG.java │ │ │ ├── ICFGEdge.java │ │ │ ├── NormalEdge.java │ │ │ └── ReturnEdge.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── ArithmeticExp.java │ │ │ ├── BinaryExp.java │ │ │ ├── BitwiseExp.java │ │ │ ├── ConditionExp.java │ │ │ ├── Exp.java │ │ │ ├── IntLiteral.java │ │ │ ├── InvokeExp.java │ │ │ ├── ShiftExp.java │ │ │ └── Var.java │ │ ├── proginfo │ │ │ └── MethodRef.java │ │ └── stmt │ │ │ ├── DefinitionStmt.java │ │ │ ├── Invoke.java │ │ │ └── Stmt.java │ │ ├── language │ │ └── classes │ │ │ ├── ClassHierarchy.java │ │ │ ├── ClassHierarchyImpl.java │ │ │ ├── JClass.java │ │ │ ├── JMethod.java │ │ │ └── Subsignature.java │ │ └── util │ │ └── graph │ │ └── Graph.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ ├── Tests.java │ │ ├── dataflow │ │ └── analysis │ │ │ └── constprop │ │ │ └── InterCPTest.java │ │ └── graph │ │ └── callgraph │ │ └── cha │ │ └── CHATest.java │ └── resources │ ├── cha │ ├── AbstractMethod-cg-expected.txt │ ├── AbstractMethod.java │ ├── Interface-cg-expected.txt │ ├── Interface.java │ ├── StaticCall-cg-expected.txt │ ├── StaticCall.java │ ├── VirtualCall-cg-expected.txt │ └── VirtualCall.java │ └── dataflow │ └── constprop │ └── inter │ ├── Example-inter-constprop-expected.txt │ ├── Example.java │ ├── Fibonacci-inter-constprop-expected.txt │ ├── Fibonacci.java │ ├── MultiIntArgs-inter-constprop-expected.txt │ ├── MultiIntArgs.java │ ├── Reference-inter-constprop-expected.txt │ └── Reference.java ├── A5 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── Tests.java │ │ ├── graph │ │ │ └── callgraph │ │ │ │ ├── AbstractCallGraph.java │ │ │ │ ├── CallGraph.java │ │ │ │ ├── CallGraphBuilder.java │ │ │ │ ├── CallKind.java │ │ │ │ ├── DefaultCallGraph.java │ │ │ │ └── Edge.java │ │ └── pta │ │ │ ├── PointerAnalysisResult.java │ │ │ ├── ci │ │ │ ├── ArrayIndex.java │ │ │ ├── CIPTA.java │ │ │ ├── CIPTAResult.java │ │ │ ├── InstanceField.java │ │ │ ├── Pointer.java │ │ │ ├── PointerFlowGraph.java │ │ │ ├── PointsToSet.java │ │ │ ├── ResultProcessor.java │ │ │ ├── Solver.java │ │ │ ├── StaticField.java │ │ │ ├── VarPtr.java │ │ │ └── WorkList.java │ │ │ └── core │ │ │ └── heap │ │ │ ├── HeapModel.java │ │ │ └── Obj.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── InvokeExp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ ├── ArrayStmt.java │ │ │ ├── AssignStmt.java │ │ │ ├── Copy.java │ │ │ ├── DefinitionStmt.java │ │ │ ├── FieldStmt.java │ │ │ ├── Invoke.java │ │ │ ├── LoadArray.java │ │ │ ├── LoadField.java │ │ │ ├── New.java │ │ │ ├── Stmt.java │ │ │ ├── StmtVisitor.java │ │ │ ├── StoreArray.java │ │ │ └── StoreField.java │ │ └── language │ │ └── classes │ │ ├── JField.java │ │ └── JMethod.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ └── pta │ │ └── CIPTATest.java │ └── resources │ └── pta │ └── cipta │ ├── Array-cipta-expected.txt │ ├── Array.java │ ├── Assign-cipta-expected.txt │ ├── Assign.java │ ├── Assign2-cipta-expected.txt │ ├── Assign2.java │ ├── Call-cipta-expected.txt │ ├── Call.java │ ├── Example-cipta-expected.txt │ ├── Example.java │ ├── InstanceField-cipta-expected.txt │ ├── InstanceField.java │ ├── MergeParam-cipta-expected.txt │ ├── MergeParam.java │ ├── StaticCall-cipta-expected.txt │ ├── StaticCall.java │ ├── StaticField-cipta-expected.txt │ ├── StaticField.java │ ├── StoreLoad-cipta-expected.txt │ └── StoreLoad.java ├── A6 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── Tests.java │ │ ├── graph │ │ │ └── callgraph │ │ │ │ ├── AbstractCallGraph.java │ │ │ │ ├── CallGraph.java │ │ │ │ ├── CallGraphBuilder.java │ │ │ │ ├── CallKind.java │ │ │ │ └── Edge.java │ │ └── pta │ │ │ ├── core │ │ │ ├── cs │ │ │ │ ├── CSCallGraph.java │ │ │ │ ├── context │ │ │ │ │ ├── Context.java │ │ │ │ │ └── ListContext.java │ │ │ │ ├── element │ │ │ │ │ ├── AbstractPointer.java │ │ │ │ │ ├── ArrayIndex.java │ │ │ │ │ ├── CSCallSite.java │ │ │ │ │ ├── CSElement.java │ │ │ │ │ ├── CSManager.java │ │ │ │ │ ├── CSMethod.java │ │ │ │ │ ├── CSObj.java │ │ │ │ │ ├── CSVar.java │ │ │ │ │ ├── InstanceField.java │ │ │ │ │ ├── Pointer.java │ │ │ │ │ └── StaticField.java │ │ │ │ └── selector │ │ │ │ │ ├── CISelector.java │ │ │ │ │ ├── ContextSelector.java │ │ │ │ │ ├── _1CallSelector.java │ │ │ │ │ ├── _1ObjSelector.java │ │ │ │ │ ├── _1TypeSelector.java │ │ │ │ │ ├── _2CallSelector.java │ │ │ │ │ ├── _2ObjSelector.java │ │ │ │ │ └── _2TypeSelector.java │ │ │ └── heap │ │ │ │ ├── HeapModel.java │ │ │ │ └── Obj.java │ │ │ ├── cs │ │ │ ├── CSPTA.java │ │ │ ├── PointerFlowGraph.java │ │ │ ├── Solver.java │ │ │ └── WorkList.java │ │ │ ├── plugin │ │ │ └── ResultProcessor.java │ │ │ └── pts │ │ │ ├── PointsToSet.java │ │ │ └── PointsToSetFactory.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── InvokeExp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ ├── ArrayStmt.java │ │ │ ├── AssignStmt.java │ │ │ ├── Copy.java │ │ │ ├── DefinitionStmt.java │ │ │ ├── FieldStmt.java │ │ │ ├── Invoke.java │ │ │ ├── LoadArray.java │ │ │ ├── LoadField.java │ │ │ ├── New.java │ │ │ ├── Stmt.java │ │ │ ├── StmtVisitor.java │ │ │ ├── StoreArray.java │ │ │ └── StoreField.java │ │ └── language │ │ └── classes │ │ ├── JField.java │ │ └── JMethod.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ └── pta │ │ └── CSPTATest.java │ └── resources │ └── pta │ └── cspta │ ├── Array-cspta-expected.txt │ ├── Array.java │ ├── Assign-cspta-expected.txt │ ├── Assign.java │ ├── Call-cspta-expected.txt │ ├── Call.java │ ├── InstanceField-cspta-expected.txt │ ├── InstanceField.java │ ├── New-cspta-expected.txt │ ├── New.java │ ├── OneCall-cspta-expected.txt │ ├── OneCall.java │ ├── OneObject-cspta-expected.txt │ ├── OneObject.java │ ├── OneType-cspta-expected.txt │ ├── OneType.java │ ├── StaticField-cspta-expected.txt │ ├── StaticField.java │ ├── StoreLoad-cspta-expected.txt │ ├── StoreLoad.java │ ├── TwoCall-cspta-expected.txt │ ├── TwoCall.java │ ├── TwoObject-cspta-expected.txt │ ├── TwoObject.java │ ├── TwoType-cspta-expected.txt │ └── TwoType.java ├── A7 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── ResultProcessor.java │ │ ├── StmtResult.java │ │ ├── dataflow │ │ │ ├── analysis │ │ │ │ ├── AbstractDataflowAnalysis.java │ │ │ │ ├── DataflowAnalysis.java │ │ │ │ └── constprop │ │ │ │ │ ├── CPFact.java │ │ │ │ │ ├── ConstantPropagation.java │ │ │ │ │ └── Value.java │ │ │ ├── fact │ │ │ │ ├── DataflowResult.java │ │ │ │ ├── MapFact.java │ │ │ │ └── NodeResult.java │ │ │ ├── inter │ │ │ │ ├── AbstractInterDataflowAnalysis.java │ │ │ │ ├── InterConstantPropagation.java │ │ │ │ ├── InterDataflowAnalysis.java │ │ │ │ └── InterSolver.java │ │ │ └── solver │ │ │ │ ├── Solver.java │ │ │ │ └── WorkListSolver.java │ │ ├── graph │ │ │ ├── callgraph │ │ │ │ ├── AbstractCallGraph.java │ │ │ │ ├── CGBuilder.java │ │ │ │ ├── CallGraph.java │ │ │ │ ├── CallGraphBuilder.java │ │ │ │ ├── CallKind.java │ │ │ │ ├── DefaultCallGraph.java │ │ │ │ └── Edge.java │ │ │ ├── cfg │ │ │ │ └── CFG.java │ │ │ └── icfg │ │ │ │ ├── CallEdge.java │ │ │ │ ├── CallToReturnEdge.java │ │ │ │ ├── ICFG.java │ │ │ │ ├── ICFGEdge.java │ │ │ │ ├── NormalEdge.java │ │ │ │ └── ReturnEdge.java │ │ └── pta │ │ │ ├── PointerAnalysisResult.java │ │ │ ├── core │ │ │ ├── cs │ │ │ │ ├── CSCallGraph.java │ │ │ │ ├── context │ │ │ │ │ ├── Context.java │ │ │ │ │ └── ListContext.java │ │ │ │ ├── element │ │ │ │ │ ├── AbstractPointer.java │ │ │ │ │ ├── ArrayIndex.java │ │ │ │ │ ├── CSCallSite.java │ │ │ │ │ ├── CSElement.java │ │ │ │ │ ├── CSManager.java │ │ │ │ │ ├── CSMethod.java │ │ │ │ │ ├── CSObj.java │ │ │ │ │ ├── CSVar.java │ │ │ │ │ ├── InstanceField.java │ │ │ │ │ ├── Pointer.java │ │ │ │ │ └── StaticField.java │ │ │ │ └── selector │ │ │ │ │ ├── CISelector.java │ │ │ │ │ ├── ContextSelector.java │ │ │ │ │ ├── _1CallSelector.java │ │ │ │ │ ├── _1ObjSelector.java │ │ │ │ │ ├── _1TypeSelector.java │ │ │ │ │ ├── _2CallSelector.java │ │ │ │ │ ├── _2ObjSelector.java │ │ │ │ │ └── _2TypeSelector.java │ │ │ └── heap │ │ │ │ ├── HeapModel.java │ │ │ │ └── Obj.java │ │ │ ├── cs │ │ │ ├── CSPTA.java │ │ │ ├── PointerFlowGraph.java │ │ │ ├── Solver.java │ │ │ └── WorkList.java │ │ │ ├── plugin │ │ │ └── ResultProcessor.java │ │ │ └── pts │ │ │ ├── PointsToSet.java │ │ │ └── PointsToSetFactory.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── ArithmeticExp.java │ │ │ ├── ArrayAccess.java │ │ │ ├── BinaryExp.java │ │ │ ├── BitwiseExp.java │ │ │ ├── ConditionExp.java │ │ │ ├── Exp.java │ │ │ ├── IntLiteral.java │ │ │ ├── InvokeExp.java │ │ │ ├── ShiftExp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ ├── ArrayStmt.java │ │ │ ├── AssignStmt.java │ │ │ ├── Copy.java │ │ │ ├── DefinitionStmt.java │ │ │ ├── FieldStmt.java │ │ │ ├── Invoke.java │ │ │ ├── LoadArray.java │ │ │ ├── LoadField.java │ │ │ ├── New.java │ │ │ ├── Stmt.java │ │ │ ├── StmtVisitor.java │ │ │ ├── StoreArray.java │ │ │ └── StoreField.java │ │ └── language │ │ └── classes │ │ ├── JField.java │ │ └── JMethod.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ ├── Tests.java │ │ └── dataflow │ │ └── analysis │ │ └── constprop │ │ └── InterCPAliasTest.java │ └── resources │ └── dataflow │ └── constprop │ └── alias │ ├── Array-inter-constprop-expected.txt │ ├── Array.java │ ├── ArrayInter2-inter-constprop-expected.txt │ ├── ArrayInter2.java │ ├── ArrayLoops-inter-constprop-expected.txt │ ├── ArrayLoops.java │ ├── InstanceField-inter-constprop-expected.txt │ ├── InstanceField.java │ ├── Interprocedural2-inter-constprop-expected.txt │ ├── Interprocedural2.java │ ├── MultiStores-inter-constprop-expected.txt │ ├── MultiStores.java │ ├── ObjSens-inter-constprop-expected.txt │ ├── ObjSens.java │ ├── StaticField-inter-constprop-expected.txt │ ├── StaticField.java │ ├── StaticFieldMultiStores-inter-constprop-expected.txt │ └── StaticFieldMultiStores.java ├── A8 └── tai-e │ ├── COPYING │ ├── COPYING.LESSER │ ├── build.gradle.kts │ ├── gradle │ └── wrapper │ │ ├── gradle-wrapper.jar │ │ └── gradle-wrapper.properties │ ├── gradlew │ ├── gradlew.bat │ ├── lib │ └── tai-e-assignment.jar │ ├── plan.yml │ └── src │ ├── main │ └── java │ │ └── pascal │ │ └── taie │ │ ├── Assignment.java │ │ ├── analysis │ │ ├── Tests.java │ │ ├── graph │ │ │ └── callgraph │ │ │ │ ├── AbstractCallGraph.java │ │ │ │ ├── CallGraph.java │ │ │ │ ├── CallGraphBuilder.java │ │ │ │ ├── CallKind.java │ │ │ │ └── Edge.java │ │ └── pta │ │ │ ├── core │ │ │ ├── cs │ │ │ │ ├── CSCallGraph.java │ │ │ │ ├── context │ │ │ │ │ ├── Context.java │ │ │ │ │ └── ListContext.java │ │ │ │ ├── element │ │ │ │ │ ├── AbstractPointer.java │ │ │ │ │ ├── ArrayIndex.java │ │ │ │ │ ├── CSCallSite.java │ │ │ │ │ ├── CSElement.java │ │ │ │ │ ├── CSManager.java │ │ │ │ │ ├── CSMethod.java │ │ │ │ │ ├── CSObj.java │ │ │ │ │ ├── CSVar.java │ │ │ │ │ ├── InstanceField.java │ │ │ │ │ ├── Pointer.java │ │ │ │ │ └── StaticField.java │ │ │ │ └── selector │ │ │ │ │ ├── CISelector.java │ │ │ │ │ ├── ContextSelector.java │ │ │ │ │ ├── _1CallSelector.java │ │ │ │ │ ├── _1ObjSelector.java │ │ │ │ │ ├── _1TypeSelector.java │ │ │ │ │ ├── _2CallSelector.java │ │ │ │ │ ├── _2ObjSelector.java │ │ │ │ │ └── _2TypeSelector.java │ │ │ └── heap │ │ │ │ ├── HeapModel.java │ │ │ │ └── Obj.java │ │ │ ├── cs │ │ │ ├── CSPTA.java │ │ │ ├── PointerFlowGraph.java │ │ │ ├── Solver.java │ │ │ └── WorkList.java │ │ │ ├── plugin │ │ │ ├── ResultProcessor.java │ │ │ └── taint │ │ │ │ ├── Sink.java │ │ │ │ ├── Source.java │ │ │ │ ├── TaintAnalysiss.java │ │ │ │ ├── TaintConfig.java │ │ │ │ ├── TaintFlow.java │ │ │ │ ├── TaintManager.java │ │ │ │ └── TaintTransfer.java │ │ │ └── pts │ │ │ ├── PointsToSet.java │ │ │ └── PointsToSetFactory.java │ │ ├── ir │ │ ├── IR.java │ │ ├── exp │ │ │ ├── InvokeExp.java │ │ │ └── Var.java │ │ └── stmt │ │ │ ├── ArrayStmt.java │ │ │ ├── AssignStmt.java │ │ │ ├── Copy.java │ │ │ ├── DefinitionStmt.java │ │ │ ├── FieldStmt.java │ │ │ ├── Invoke.java │ │ │ ├── LoadArray.java │ │ │ ├── LoadField.java │ │ │ ├── New.java │ │ │ ├── Stmt.java │ │ │ ├── StmtVisitor.java │ │ │ ├── StoreArray.java │ │ │ └── StoreField.java │ │ └── language │ │ └── classes │ │ ├── JField.java │ │ └── JMethod.java │ └── test │ ├── java │ └── pascal │ │ └── taie │ │ └── analysis │ │ └── pta │ │ └── TaintTest.java │ └── resources │ └── pta │ └── taint │ ├── ArgToResult-cspta-expected.txt │ ├── ArgToResult.java │ ├── BaseToResult-cspta-expected.txt │ ├── BaseToResult.java │ ├── InterTaintTransfer-cspta-expected.txt │ ├── InterTaintTransfer.java │ ├── OneCallTaint-cspta-expected.txt │ ├── OneCallTaint.java │ ├── SimpleTaint-cspta-expected.txt │ ├── SimpleTaint.java │ ├── SourceSink.java │ ├── StringAppend-cspta-expected.txt │ ├── StringAppend.java │ ├── TaintInList-cspta-expected.txt │ ├── TaintInList.java │ └── taint-config.yml ├── COPYING ├── COPYING.LESSER ├── README.md └── lib ├── dependencies.jar └── rt.jar /.gitignore: -------------------------------------------------------------------------------- 1 | .idea/ 2 | .gradle/ 3 | build/ 4 | out/ 5 | output/ 6 | sootOutput/ 7 | -------------------------------------------------------------------------------- /A1/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A1/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A1/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A1/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A1/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A1/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A1/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: throw 2 | options: 3 | exception: explicit 4 | algorithm: intra 5 | - id: cfg 6 | options: 7 | exception: explicit 8 | dump: true 9 | - id: livevar 10 | options: 11 | strongly: false 12 | - id: process-result 13 | options: 14 | analyses: 15 | - livevar 16 | action: dump 17 | file: null 18 | -------------------------------------------------------------------------------- /A1/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A1/tai-e/src/main/java/pascal/taie/analysis/StmtResult.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis; 24 | 25 | import pascal.taie.ir.stmt.Stmt; 26 | 27 | /** 28 | * An interface for querying analysis results of Stmt. 29 | * 30 | * @param type of analysis results 31 | */ 32 | public interface StmtResult { 33 | 34 | /** 35 | * @return if {@code stmt} is relevant in this result. 36 | */ 37 | boolean isRelevant(Stmt stmt); 38 | 39 | /** 40 | * @return analysis result of given stmt. 41 | */ 42 | R getResult(Stmt stmt); 43 | } 44 | -------------------------------------------------------------------------------- /A1/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallGraphBuilder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | import pascal.taie.analysis.ProgramAnalysis; 26 | import pascal.taie.config.AnalysisConfig; 27 | 28 | public class CallGraphBuilder extends ProgramAnalysis { 29 | 30 | public static final String ID = "cg"; 31 | 32 | public CallGraphBuilder(AnalysisConfig config) { 33 | super(config); 34 | } 35 | 36 | @Override 37 | public Object analyze() { 38 | throw new UnsupportedOperationException(); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A1/tai-e/src/main/java/pascal/taie/ir/exp/Exp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | import pascal.taie.language.type.Type; 26 | 27 | import java.util.List; 28 | 29 | /** 30 | * Representation of expressions in Tai-e IR. 31 | */ 32 | public interface Exp { 33 | 34 | /** 35 | * @return type of this expression. 36 | */ 37 | Type getType(); 38 | 39 | /** 40 | * @return a list of expressions which are used by (contained in) this Exp. 41 | */ 42 | default List getUses() { 43 | return List.of(); 44 | } 45 | 46 | T accept(ExpVisitor visitor); 47 | } 48 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Array-livevar-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (livevar) -------------------- 2 | [0@L1] invokespecial %this.()>(); [] 3 | [1@L1] return; [] 4 | 5 | -------------------- (livevar) -------------------- 6 | [0@L4] result = 0; [arr, result] 7 | [1@L5] i = 0; [arr, i, result] 8 | [2@L5] nop; [arr, i, result] 9 | [3@L5] temp$0 = arr.length; [arr, i, result, temp$0] 10 | [4@L5] if (i < temp$0) goto 6; [arr, i, result] 11 | [5@L5] goto 13; [result] 12 | [6@L5] nop; [arr, i, result] 13 | [7@L6] temp$4 = arr[i]; [arr, i, result, temp$4] 14 | [8@L6] result = result + temp$4; [arr, i, result] 15 | [9@L6] nop; [arr, i, result] 16 | [10@L5] %intconst0 = 1; [%intconst0, arr, i, result] 17 | [11@L5] i = i + %intconst0; [arr, i, result] 18 | [12@L5] goto 2; [arr, i, result] 19 | [13@L5] nop; [result] 20 | [14@L8] return result; [] 21 | 22 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Array.java: -------------------------------------------------------------------------------- 1 | class Array { 2 | 3 | int sum(int arr[]) { 4 | int result = 0; 5 | for (int i = 0; i < arr.length; i++) { 6 | result += arr[i]; 7 | } 8 | return result; 9 | } 10 | 11 | } -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Assign-livevar-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (livevar) -------------------- 2 | [0@L1] invokespecial %this.()>(); [] 3 | [1@L1] return; [] 4 | 5 | -------------------- (livevar) -------------------- 6 | [0@L4] d = a + b; [a, d] 7 | [1@L5] b = d; [a, b] 8 | [2@L6] c = a; [b] 9 | [3@L7] return b; [] 10 | 11 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Assign.java: -------------------------------------------------------------------------------- 1 | class Assign { 2 | 3 | int assign(int a, int b, int c) { 4 | int d = a + b; 5 | b = d; 6 | c = a; 7 | return b; 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Branch-livevar-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (livevar) -------------------- 2 | [0@L1] invokespecial %this.()>(); [] 3 | [1@L1] return; [] 4 | 5 | -------------------- (livevar) -------------------- 6 | [0@L4] x = m; [k, n, x] 7 | [1@L5] %intconst0 = 0; [%intconst0, k, n, x] 8 | [2@L5] if (n > %intconst0) goto 4; [k, n, x] 9 | [3@L5] goto 7; [k, n] 10 | [4@L5] nop; [n, x] 11 | [5@L5] temp$1 = x + n; [temp$1] 12 | [6@L6] return temp$1; [] 13 | [7@L6] nop; [k, n] 14 | [8@L6] temp$3 = k + n; [temp$3] 15 | [9@L8] return temp$3; [] 16 | 17 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Branch.java: -------------------------------------------------------------------------------- 1 | class Branch { 2 | 3 | int ifElse(int m, int n, int k) { 4 | int x = m; 5 | if (n > 0) { 6 | return x + n; 7 | } else { 8 | return k + n; 9 | } 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/BranchLoop.java: -------------------------------------------------------------------------------- 1 | class BranchLoop { 2 | 3 | int loopBranch(int m, int n, int k) { 4 | int a, i; 5 | for (i = m - 1; i < k; i++) { 6 | if (i >= n) { 7 | a = n; 8 | } 9 | a = a + i; 10 | } 11 | return a; 12 | } 13 | 14 | void branchLoop(int c, boolean d) { 15 | int x, y, z; 16 | x = 1; 17 | y = 2; 18 | if (c > 0) { 19 | do { 20 | x = y + 1; 21 | y = 2 * z; 22 | if (d) { 23 | x = y + z; 24 | } 25 | z = 1; 26 | } while (c < 20); 27 | } 28 | z = x; 29 | } 30 | } 31 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Fibonacci-livevar-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (livevar) -------------------- 2 | [0@L1] invokespecial %this.()>(); [] 3 | [1@L1] return; [] 4 | 5 | -------------------- (livevar) -------------------- 6 | [0@L3] %intconst0 = 0; [%intconst0, %this, n] 7 | [1@L3] if (n == %intconst0) goto 8; [%this, n] 8 | [2@L3] goto 3; [%this, n] 9 | [3@L3] nop; [%this, n] 10 | [4@L3] %intconst1 = 1; [%intconst1, %this, n] 11 | [5@L3] if (n == %intconst1) goto 8; [%intconst1, %this, n] 12 | [6@L3] goto 10; [%intconst1, %this, n] 13 | [7@L3] goto 10; [%intconst1, %this, n] 14 | [8@L3] nop; [n] 15 | [9@L4] return n; [] 16 | [10@L4] nop; [%intconst1, %this, n] 17 | [11@L6] temp$0 = n - %intconst1; [%this, n, temp$0] 18 | [12@L6] temp$1 = invokevirtual %this.(temp$0); [%this, n, temp$1] 19 | [13@L6] %intconst2 = 2; [%intconst2, %this, n, temp$1] 20 | [14@L6] temp$3 = n - %intconst2; [%this, temp$1, temp$3] 21 | [15@L6] temp$4 = invokevirtual %this.(temp$3); [temp$1, temp$4] 22 | [16@L6] temp$5 = temp$1 + temp$4; [temp$5] 23 | [17@L6] return temp$5; [] 24 | 25 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Fibonacci.java: -------------------------------------------------------------------------------- 1 | class Fibonacci { 2 | int getFibonacci(int n) { 3 | if ((n == 0) || (n == 1)) { 4 | return n; 5 | } else { 6 | return getFibonacci(n - 1) + getFibonacci(n - 2); 7 | } 8 | } 9 | 10 | } -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Reference-livevar-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (livevar) -------------------- 2 | [0@L4] invokespecial %this.()>(); [%this] 3 | [1@L5] temp$0 = null; [%this, temp$0] 4 | [2@L5] %this. = temp$0; [] 5 | [3@L5] return; [] 6 | 7 | -------------------- (livevar) -------------------- 8 | [0@L9] %this. = c; [] 9 | [1@L9] return; [] 10 | 11 | -------------------- ()> (livevar) -------------------- 12 | [0@L15] invokespecial %this.()>(); [] 13 | [1@L15] return; [] 14 | 15 | -------------------- ()> (livevar) -------------------- 16 | [0@L19] invokespecial %this.()>(); [] 17 | [1@L19] return; [] 18 | 19 | -------------------- ()> (livevar) -------------------- 20 | [0@L22] invokespecial %this.()>(); [] 21 | [1@L22] return; [] 22 | 23 | -------------------- (livevar) -------------------- 24 | [0@L24] temp$0 = new B; [c, temp$0] 25 | [1@L24] invokespecial temp$0.()>(); [c, temp$0] 26 | [2@L24] b = temp$0; [b, c] 27 | [3@L25] invokevirtual b.(c); [b] 28 | [4@L26] return b; [] 29 | 30 | -------------------------------------------------------------------------------- /A1/tai-e/src/test/resources/dataflow/livevar/Reference.java: -------------------------------------------------------------------------------- 1 | class A { 2 | C c; 3 | 4 | A() { 5 | this.c = null; 6 | } 7 | 8 | void setC(C c) { 9 | this.c = c; 10 | } 11 | } 12 | 13 | class B extends A { 14 | B() { 15 | super(); 16 | } 17 | } 18 | 19 | class C { 20 | } 21 | 22 | class Reference { 23 | A referenceType(C c) { 24 | B b = new B(); 25 | b.setC(c); 26 | return b; 27 | } 28 | } 29 | -------------------------------------------------------------------------------- /A2/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A2/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A2/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A2/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A2/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A2/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A2/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: throw 2 | options: 3 | exception: explicit 4 | algorithm: intra 5 | - id: cfg 6 | options: 7 | exception: explicit 8 | dump: true 9 | - id: constprop 10 | options: 11 | edge-refine: false 12 | - id: process-result 13 | options: 14 | analyses: 15 | - constprop 16 | action: dump 17 | file: null 18 | log-mismatches: false 19 | -------------------------------------------------------------------------------- /A2/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A2/tai-e/src/main/java/pascal/taie/analysis/StmtResult.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis; 24 | 25 | import pascal.taie.ir.stmt.Stmt; 26 | 27 | /** 28 | * An interface for querying analysis results of Stmt. 29 | * 30 | * @param type of analysis results 31 | */ 32 | public interface StmtResult { 33 | 34 | /** 35 | * @return if {@code stmt} is relevant in this result. 36 | */ 37 | boolean isRelevant(Stmt stmt); 38 | 39 | /** 40 | * @return analysis result of given stmt. 41 | */ 42 | R getResult(Stmt stmt); 43 | } 44 | -------------------------------------------------------------------------------- /A2/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallGraphBuilder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | import pascal.taie.analysis.ProgramAnalysis; 26 | import pascal.taie.config.AnalysisConfig; 27 | 28 | public class CallGraphBuilder extends ProgramAnalysis { 29 | 30 | public static final String ID = "cg"; 31 | 32 | public CallGraphBuilder(AnalysisConfig config) { 33 | super(config); 34 | } 35 | 36 | @Override 37 | public Object analyze() { 38 | throw new UnsupportedOperationException(); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A2/tai-e/src/main/java/pascal/taie/ir/exp/BinaryExp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | /** 26 | * Representation of binary expression. 27 | */ 28 | public interface BinaryExp extends RValue { 29 | 30 | /** 31 | * Representation of binary operators. 32 | */ 33 | interface Op { 34 | } 35 | 36 | /** 37 | * @return the operator. 38 | */ 39 | Op getOperator(); 40 | 41 | /** 42 | * @return the first operand. 43 | */ 44 | Var getOperand1(); 45 | 46 | /** 47 | * @return the second operand. 48 | */ 49 | Var getOperand2(); 50 | } 51 | -------------------------------------------------------------------------------- /A2/tai-e/src/main/java/pascal/taie/ir/exp/Exp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | import pascal.taie.language.type.Type; 26 | 27 | import java.util.List; 28 | 29 | /** 30 | * Representation of expressions in Tai-e IR. 31 | */ 32 | public interface Exp { 33 | 34 | /** 35 | * @return type of this expression. 36 | */ 37 | Type getType(); 38 | 39 | /** 40 | * @return a list of expressions which are used by (contained in) this Exp. 41 | */ 42 | default List getUses() { 43 | return List.of(); 44 | } 45 | 46 | T accept(ExpVisitor visitor); 47 | } 48 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/Assign-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (constprop) -------------------- 2 | [0@L1] invokespecial %this.()>(); {} 3 | [1@L1] return; {} 4 | 5 | -------------------- (constprop) -------------------- 6 | [0@L4] x = 1; {x=1} 7 | [1@L5] x = 2; {x=2} 8 | [2@L6] x = 3; {x=3} 9 | [3@L7] x = 4; {x=4} 10 | [4@L8] y = x; {x=4, y=4} 11 | [5@L8] return; {x=4, y=4} 12 | 13 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/Assign.java: -------------------------------------------------------------------------------- 1 | class Assign { 2 | 3 | void assign() { 4 | int x = 1, y; 5 | x = 2; 6 | x = 3; 7 | x = 4; 8 | y = x; 9 | } 10 | } 11 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/BranchConstant-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (constprop) -------------------- 2 | [0@L1] invokespecial %this.()>(); {} 3 | [1@L1] return; {} 4 | 5 | -------------------- (constprop) -------------------- 6 | [0@L4] x = 2; {b=NAC, x=2} 7 | [1@L5] y = 2; {b=NAC, x=2, y=2} 8 | [2@L7] %intconst0 = 0; {%intconst0=0, b=NAC, x=2, y=2} 9 | [3@L7] if (b == %intconst0) goto 8; {%intconst0=0, b=NAC, x=2, y=2} 10 | [4@L7] goto 5; {%intconst0=0, b=NAC, x=2, y=2} 11 | [5@L7] nop; {%intconst0=0, b=NAC, x=2, y=2} 12 | [6@L8] z = x + y; {%intconst0=0, b=NAC, x=2, y=2, z=4} 13 | [7@L7] goto 10; {%intconst0=0, b=NAC, x=2, y=2, z=4} 14 | [8@L7] nop; {%intconst0=0, b=NAC, x=2, y=2} 15 | [9@L10] z = x * y; {%intconst0=0, b=NAC, x=2, y=2, z=4} 16 | [10@L10] nop; {%intconst0=0, b=NAC, x=2, y=2, z=4} 17 | [11@L12] n = z; {%intconst0=0, b=NAC, n=4, x=2, y=2, z=4} 18 | [12@L12] return; {%intconst0=0, b=NAC, n=4, x=2, y=2, z=4} 19 | 20 | -------------------- (constprop) -------------------- 21 | [0@L17] %intconst0 = 0; {%intconst0=0, b=NAC} 22 | [1@L17] if (b == %intconst0) goto 5; {%intconst0=0, b=NAC} 23 | [2@L17] goto 3; {%intconst0=0, b=NAC} 24 | [3@L17] nop; {%intconst0=0, b=NAC} 25 | [4@L18] x = 10; {%intconst0=0, b=NAC, x=10} 26 | [5@L18] nop; {%intconst0=0, b=NAC, x=10} 27 | [6@L20] y = x; {%intconst0=0, b=NAC, x=10, y=10} 28 | [7@L20] return; {%intconst0=0, b=NAC, x=10, y=10} 29 | 30 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/BranchConstant.java: -------------------------------------------------------------------------------- 1 | class BranchConstant { 2 | 3 | void constant1(boolean b) { 4 | int x = 2; 5 | int y = 2; 6 | int z; 7 | if (b) { 8 | z = x + y; 9 | } else { 10 | z = x * y; 11 | } 12 | int n = z; 13 | } 14 | 15 | void constant2(boolean b) { 16 | int x; 17 | if (b) { 18 | x = 10; 19 | } 20 | int y = x; 21 | } 22 | } 23 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/Interprocedural-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (constprop) -------------------- 2 | [0@L1] invokespecial %this.()>(); {} 3 | [1@L1] return; {} 4 | 5 | -------------------- (constprop) -------------------- 6 | [0@L4] x = i; {b=NAC, i=NAC, x=NAC} 7 | [1@L5] %intconst0 = 10; {%intconst0=10, b=NAC, i=NAC, x=NAC} 8 | [2@L5] y = i + %intconst0; {%intconst0=10, b=NAC, i=NAC, x=NAC, y=NAC} 9 | [3@L6] p = b; {%intconst0=10, b=NAC, i=NAC, p=NAC, x=NAC, y=NAC} 10 | [4@L6] return; {%intconst0=10, b=NAC, i=NAC, p=NAC, x=NAC, y=NAC} 11 | 12 | -------------------- (constprop) -------------------- 13 | [0@L10] temp$0 = invokevirtual %this.(); {temp$0=NAC} 14 | [1@L10] x = temp$0; {temp$0=NAC, x=NAC} 15 | [2@L11] %intconst0 = 10; {%intconst0=10, temp$0=NAC, x=NAC} 16 | [3@L11] temp$1 = invokevirtual %this.(%intconst0); {%intconst0=10, temp$0=NAC, temp$1=NAC, x=NAC} 17 | [4@L11] y = temp$1; {%intconst0=10, temp$0=NAC, temp$1=NAC, x=NAC, y=NAC} 18 | [5@L11] return; {%intconst0=10, temp$0=NAC, temp$1=NAC, x=NAC, y=NAC} 19 | 20 | -------------------- (constprop) -------------------- 21 | [0@L14] temp$0 = 10; {temp$0=10} 22 | [1@L15] return temp$0; {temp$0=10} 23 | 24 | -------------------- (constprop) -------------------- 25 | [0@L19] return x; {x=NAC} 26 | 27 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/Interprocedural.java: -------------------------------------------------------------------------------- 1 | class Interprocedural { 2 | 3 | void param(int i, boolean b) { 4 | int x = i; 5 | int y = i + 10; 6 | boolean p = b; 7 | } 8 | 9 | void invoke() { 10 | int x = ten(); 11 | int y = id(10); 12 | } 13 | 14 | int ten() { 15 | return 10; 16 | } 17 | 18 | int id(int x) { 19 | return x; 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleBinary.java: -------------------------------------------------------------------------------- 1 | class SimpleBinary { 2 | 3 | int arithmetic() { 4 | int x = 1, y = 2; 5 | int z = x + y; 6 | return z; 7 | } 8 | 9 | boolean condition() { 10 | int x = 1, y = 2; 11 | boolean z = x == y; 12 | return z; 13 | } 14 | 15 | int shift() { 16 | int x = 1, y = 2; 17 | int z = x << y; 18 | return z; 19 | } 20 | 21 | int bitwise() { 22 | int x = 1, y = 2; 23 | int z = x | y; 24 | return z; 25 | } 26 | 27 | int nac(int p) { 28 | int x = 1, y = p; 29 | int z = x * y; 30 | return z; 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleBranch-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (constprop) -------------------- 2 | [0@L1] invokespecial %this.()>(); {} 3 | [1@L1] return; {} 4 | 5 | -------------------- (constprop) -------------------- 6 | [0@L5] %intconst0 = 0; {%intconst0=0, p=NAC} 7 | [1@L5] if (p > %intconst0) goto 3; {%intconst0=0, p=NAC} 8 | [2@L5] goto 6; {%intconst0=0, p=NAC} 9 | [3@L5] nop; {%intconst0=0, p=NAC} 10 | [4@L6] x = 1; {%intconst0=0, p=NAC, x=1} 11 | [5@L5] goto 8; {%intconst0=0, p=NAC, x=1} 12 | [6@L5] nop; {%intconst0=0, p=NAC} 13 | [7@L8] x = 2; {%intconst0=0, p=NAC, x=2} 14 | [8@L8] nop; {%intconst0=0, p=NAC, x=NAC} 15 | [9@L10] y = x; {%intconst0=0, p=NAC, x=NAC, y=NAC} 16 | [10@L10] return; {%intconst0=0, p=NAC, x=NAC, y=NAC} 17 | 18 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleBranch.java: -------------------------------------------------------------------------------- 1 | class SimpleBranch { 2 | 3 | static void NAC(int p) { 4 | int x; 5 | if (p > 0) { 6 | x = 1; 7 | } else { 8 | x = 2; 9 | } 10 | int y = x; 11 | } 12 | } 13 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleChar-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (constprop) -------------------- 2 | [0@L1] invokespecial %this.()>(); {} 3 | [1@L1] return; {} 4 | 5 | -------------------- (constprop) -------------------- 6 | [0@L4] a = 97; {a=97} 7 | [1@L5] x = 120; {a=97, x=120} 8 | [2@L5] return; {a=97, x=120} 9 | 10 | -------------------- (constprop) -------------------- 11 | [0@L10] z = 122; {z=122} 12 | [1@L10] return; {z=122} 13 | 14 | -------------------- (constprop) -------------------- 15 | [0@L14] a = 97; {a=97} 16 | [1@L15] b = a; {a=97, b=97} 17 | [2@L16] c = b; {a=97, b=97, c=97} 18 | [3@L16] return; {a=97, b=97, c=97} 19 | 20 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleChar.java: -------------------------------------------------------------------------------- 1 | class SimpleChar { 2 | 3 | void constant() { 4 | char a = 'a'; 5 | char x = 'x'; 6 | } 7 | 8 | void undefined() { 9 | char x, y, z; 10 | z = 'z'; 11 | } 12 | 13 | void propagation() { 14 | char a = 'a'; 15 | char b = a; 16 | char c = b; 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleConstant-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (constprop) -------------------- 2 | [0@L1] invokespecial %this.()>(); {} 3 | [1@L1] return; {} 4 | 5 | -------------------- (constprop) -------------------- 6 | [0@L4] x = 1; {x=1} 7 | [1@L5] y = 2; {x=1, y=2} 8 | [2@L6] z = 3; {x=1, y=2, z=3} 9 | [3@L6] return; {x=1, y=2, z=3} 10 | 11 | -------------------- (constprop) -------------------- 12 | [0@L10] x = 10; {x=10} 13 | [1@L11] y = x; {x=10, y=10} 14 | [2@L12] z = y; {x=10, y=10, z=10} 15 | [3@L12] return; {x=10, y=10, z=10} 16 | 17 | -------------------------------------------------------------------------------- /A2/tai-e/src/test/resources/dataflow/constprop/SimpleConstant.java: -------------------------------------------------------------------------------- 1 | class SimpleConstant { 2 | 3 | static void constant() { 4 | int x = 1; 5 | int y = 2; 6 | int z = 3; 7 | } 8 | 9 | static void propagation() { 10 | int x = 10; 11 | int y = x; 12 | int z = y; 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /A3/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A3/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A3/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A3/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A3/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A3/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A3/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: throw 2 | options: 3 | exception: explicit 4 | algorithm: intra 5 | - id: cfg 6 | options: 7 | exception: explicit 8 | dump: true 9 | - id: constprop 10 | options: 11 | edge-refine: false 12 | - id: livevar 13 | options: 14 | strongly: false 15 | - id: deadcode 16 | options: {} 17 | - id: process-result 18 | options: 19 | analyses: 20 | - livevar 21 | - constprop 22 | - deadcode 23 | action: dump 24 | file: null 25 | log-mismatches: false 26 | -------------------------------------------------------------------------------- /A3/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A3/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallGraphBuilder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | import pascal.taie.analysis.ProgramAnalysis; 26 | import pascal.taie.config.AnalysisConfig; 27 | 28 | public class CallGraphBuilder extends ProgramAnalysis { 29 | 30 | public static final String ID = "cg"; 31 | 32 | public CallGraphBuilder(AnalysisConfig config) { 33 | super(config); 34 | } 35 | 36 | @Override 37 | public Object analyze() { 38 | throw new UnsupportedOperationException(); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A3/tai-e/src/main/java/pascal/taie/ir/exp/BinaryExp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | /** 26 | * Representation of binary expression. 27 | */ 28 | public interface BinaryExp extends RValue { 29 | 30 | /** 31 | * Representation of binary operators. 32 | */ 33 | interface Op { 34 | } 35 | 36 | /** 37 | * @return the operator. 38 | */ 39 | Op getOperator(); 40 | 41 | /** 42 | * @return the first operand. 43 | */ 44 | Var getOperand1(); 45 | 46 | /** 47 | * @return the second operand. 48 | */ 49 | Var getOperand2(); 50 | } 51 | -------------------------------------------------------------------------------- /A3/tai-e/src/main/java/pascal/taie/ir/exp/Exp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | import pascal.taie.language.type.Type; 26 | 27 | import java.util.List; 28 | 29 | /** 30 | * Representation of expressions in Tai-e IR. 31 | */ 32 | public interface Exp { 33 | 34 | /** 35 | * @return type of this expression. 36 | */ 37 | Type getType(); 38 | 39 | /** 40 | * @return a list of expressions which are used by (contained in) this Exp. 41 | */ 42 | default List getUses() { 43 | return List.of(); 44 | } 45 | 46 | T accept(ExpVisitor visitor); 47 | } 48 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/ControlFlowUnreachable-deadcode-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (deadcode) -------------------- 2 | 3 | -------------------- (deadcode) -------------------- 4 | [2@L6] invokestatic (); 5 | 6 | -------------------- (deadcode) -------------------- 7 | 8 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/ControlFlowUnreachable.java: -------------------------------------------------------------------------------- 1 | public class ControlFlowUnreachable { 2 | 3 | static int foo() { 4 | int x = 1; 5 | return x; 6 | dead(); // unreachable 7 | } 8 | 9 | static void dead() { 10 | } 11 | } 12 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/DeadAssignment-deadcode-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (deadcode) -------------------- 2 | 3 | -------------------- (deadcode) -------------------- 4 | [2@L5] y = x + %intconst0; 5 | [6@L8] a = x; 6 | 7 | -------------------- (deadcode) -------------------- 8 | 9 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/DeadAssignment.java: -------------------------------------------------------------------------------- 1 | class DeadAssignment { 2 | 3 | void deadAssign() { 4 | int x = 1; 5 | int y = x + 2; // dead assignment 6 | int z = x + 3; 7 | use(z); 8 | int a = x; // dead assignment 9 | } 10 | 11 | void use(int n) { 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/Loops-deadcode-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (deadcode) -------------------- 2 | 3 | -------------------- (deadcode) -------------------- 4 | [5@L7] goto 9; 5 | [9@L7] nop; 6 | [10@L10] invokevirtual %this.(); 7 | [11@L10] return; 8 | 9 | -------------------- (deadcode) -------------------- 10 | 11 | -------------------- (deadcode) -------------------- 12 | 13 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/Loops.java: -------------------------------------------------------------------------------- 1 | class Loops { 2 | 3 | void deadLoop() { 4 | int x = 1; 5 | int y = 0; 6 | int z = 100; 7 | while (x > y) { 8 | use(z); 9 | } 10 | dead(); // unreachable branch 11 | } 12 | 13 | void dead() { 14 | } 15 | 16 | void use(int n) { 17 | } 18 | } 19 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/UnreachableIfBranch-deadcode-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (deadcode) -------------------- 2 | 3 | -------------------- (deadcode) -------------------- 4 | [3@L7] goto 7; 5 | [7@L7] nop; 6 | [8@L10] z = 200; 7 | 8 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/UnreachableIfBranch.java: -------------------------------------------------------------------------------- 1 | class UnreachableIfBranch { 2 | 3 | int branch() { 4 | int x = 10; 5 | int y = 1; 6 | int z; 7 | if (x > y) { 8 | z = 100; 9 | } else { 10 | z = 200; // unreachable branch 11 | } 12 | return z; 13 | } 14 | } 15 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/UnreachableSwitchBranch-deadcode-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (deadcode) -------------------- 2 | 3 | -------------------- (deadcode) -------------------- 4 | [4@L6] nop; 5 | [5@L8] %intconst1 = 2; 6 | [6@L8] invokevirtual %this.(%intconst1); 7 | [7@L9] goto 24; 8 | [8@L9] nop; 9 | [9@L11] %intconst2 = 4; 10 | [10@L11] invokevirtual %this.(%intconst2); 11 | [11@L12] goto 24; 12 | [16@L15] nop; 13 | [17@L17] %intconst4 = 666; 14 | [18@L17] invokevirtual %this.(%intconst4); 15 | [19@L18] goto 24; 16 | [20@L6] goto 24; 17 | 18 | -------------------- (deadcode) -------------------- 19 | 20 | -------------------------------------------------------------------------------- /A3/tai-e/src/test/resources/dataflow/deadcode/UnreachableSwitchBranch.java: -------------------------------------------------------------------------------- 1 | class UnreachableSwitchBranch { 2 | 3 | void lookupSwitch() { 4 | int x = 1; 5 | int y = x << 3; 6 | switch (y) { 7 | case 2: 8 | use(2); 9 | break; // unreachable case 10 | case 4: 11 | use(4); 12 | break; // unreachable case 13 | case 8: 14 | use(8); 15 | break; 16 | default: 17 | use(666); 18 | break; // unreachable case 19 | } 20 | } 21 | 22 | void use(int x) { 23 | } 24 | } 25 | -------------------------------------------------------------------------------- /A4/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A4/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A4/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A4/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A4/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A4/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A4/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: cg 2 | options: 3 | algorithm: cha 4 | action: dump 5 | file: null 6 | - id: throw 7 | options: 8 | exception: explicit 9 | algorithm: intra 10 | - id: cfg 11 | options: 12 | exception: explicit 13 | dump: false 14 | - id: icfg 15 | options: 16 | dump: true 17 | - id: inter-constprop 18 | options: 19 | edge-refine: false 20 | alias-aware: false 21 | pta: null 22 | - id: process-result 23 | options: 24 | analyses: 25 | - inter-constprop 26 | action: dump 27 | file: null 28 | log-mismatches: false 29 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/analysis/StmtResult.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis; 24 | 25 | import pascal.taie.ir.stmt.Stmt; 26 | 27 | /** 28 | * An interface for querying analysis results of Stmt. 29 | * 30 | * @param type of analysis results 31 | */ 32 | public interface StmtResult { 33 | 34 | /** 35 | * @return if {@code stmt} is relevant in this result. 36 | */ 37 | boolean isRelevant(Stmt stmt); 38 | 39 | /** 40 | * @return analysis result of given stmt. 41 | */ 42 | R getResult(Stmt stmt); 43 | } 44 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CGBuilder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | interface CGBuilder { 26 | 27 | CallGraph build(); 28 | } 29 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallKind.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | public enum CallKind { 26 | // regular calls 27 | INTERFACE, 28 | VIRTUAL, 29 | SPECIAL, 30 | STATIC, 31 | DYNAMIC, 32 | /** 33 | * Non-regular calls, such calls are typically handled 34 | * by pointer analysis plugins. 35 | */ 36 | OTHER, 37 | } 38 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/MethodEdge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | import pascal.taie.util.graph.Edge; 26 | 27 | /** 28 | * Represents call edge between caller and callee. 29 | */ 30 | record MethodEdge( 31 | Method caller, Method callee, CallSite callSite) 32 | implements Edge { 33 | 34 | @Override 35 | public Method getSource() { 36 | return caller; 37 | } 38 | 39 | @Override 40 | public Method getTarget() { 41 | return callee; 42 | } 43 | } 44 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/analysis/graph/icfg/CallEdge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.icfg; 24 | 25 | import pascal.taie.language.classes.JMethod; 26 | 27 | /** 28 | * The edge connecting a call site to method entry of the callee. 29 | * 30 | * @param type of nodes 31 | */ 32 | public class CallEdge extends ICFGEdge { 33 | 34 | /** 35 | * Callee of the call edge. 36 | */ 37 | private final JMethod callee; 38 | 39 | CallEdge(Node source, Node target, JMethod callee) { 40 | super(source, target); 41 | this.callee = callee; 42 | } 43 | 44 | /** 45 | * @return the callee of the call edge. 46 | */ 47 | public JMethod getCallee() { 48 | return callee; 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/analysis/graph/icfg/CallToReturnEdge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.icfg; 24 | 25 | import pascal.taie.analysis.graph.cfg.Edge; 26 | 27 | /** 28 | * The edge connecting a call site and its return site. 29 | * 30 | * @param type of nodes 31 | */ 32 | public class CallToReturnEdge extends ICFGEdge { 33 | 34 | public CallToReturnEdge(Edge edge) { 35 | super(edge.getSource(), edge.getTarget()); 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/ir/exp/BinaryExp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | /** 26 | * Representation of binary expression. 27 | */ 28 | public interface BinaryExp extends RValue { 29 | 30 | /** 31 | * Representation of binary operators. 32 | */ 33 | interface Op { 34 | } 35 | 36 | /** 37 | * @return the operator. 38 | */ 39 | Op getOperator(); 40 | 41 | /** 42 | * @return the first operand. 43 | */ 44 | Var getOperand1(); 45 | 46 | /** 47 | * @return the second operand. 48 | */ 49 | Var getOperand2(); 50 | } 51 | -------------------------------------------------------------------------------- /A4/tai-e/src/main/java/pascal/taie/ir/exp/Exp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | import pascal.taie.language.type.Type; 26 | 27 | import java.util.List; 28 | 29 | /** 30 | * Representation of expressions in Tai-e IR. 31 | */ 32 | public interface Exp { 33 | 34 | /** 35 | * @return type of this expression. 36 | */ 37 | Type getType(); 38 | 39 | /** 40 | * @return a list of expressions which are used by (contained in) this Exp. 41 | */ 42 | default List getUses() { 43 | return List.of(); 44 | } 45 | 46 | T accept(ExpVisitor visitor); 47 | } 48 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/AbstractMethod-cg-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (cg) -------------------- 2 | [0@L9] invokespecial %this.()>(); [()>] 3 | 4 | -------------------- (cg) -------------------- 5 | [1@L4] invokespecial temp$0.()>(); [()>] 6 | [3@L5] invokevirtual a.(); [] 7 | 8 | -------------------- ()> (cg) -------------------- 9 | [0@L13] invokespecial %this.()>(); [()>] 10 | 11 | -------------------- (cg) -------------------- 12 | 13 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/AbstractMethod.java: -------------------------------------------------------------------------------- 1 | public class AbstractMethod { 2 | 3 | public static void main(String[] args) { 4 | A a = new B(); 5 | a.foo(); 6 | } 7 | } 8 | 9 | abstract class A { 10 | abstract void foo(); 11 | } 12 | 13 | class B extends A { 14 | void foo() { 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/Interface-cg-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- (cg) -------------------- 2 | [1@L8] invokespecial temp$0.()>(); [()>] 3 | [3@L9] invokeinterface n.(); [, , ] 4 | 5 | -------------------- ()> (cg) -------------------- 6 | [0@L20] invokespecial %this.()>(); [()>] 7 | 8 | -------------------- (cg) -------------------- 9 | 10 | -------------------- (cg) -------------------- 11 | 12 | -------------------- (cg) -------------------- 13 | 14 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/Interface.java: -------------------------------------------------------------------------------- 1 | interface Number { 2 | int get(); 3 | } 4 | 5 | public class Interface { 6 | 7 | public static void main(String[] args) { 8 | Number n = new One(); 9 | n.get(); 10 | } 11 | } 12 | 13 | class Zero implements Number { 14 | 15 | public int get() { 16 | return 0; 17 | } 18 | } 19 | 20 | class One implements Number { 21 | 22 | public int get() { 23 | return 1; 24 | } 25 | } 26 | 27 | class Two implements Number { 28 | 29 | public int get() { 30 | return 2; 31 | } 32 | } 33 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/StaticCall-cg-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- (cg) -------------------- 2 | [0@L18] invokestatic (); [] 3 | 4 | -------------------- (cg) -------------------- 5 | [0@L24] invokestatic (); [] 6 | 7 | -------------------- (cg) -------------------- 8 | [0@L4] invokestatic (); [] 9 | [1@L5] invokestatic (); [] 10 | 11 | -------------------- (cg) -------------------- 12 | [0@L9] invokestatic (); [] 13 | 14 | -------------------- (cg) -------------------- 15 | 16 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/StaticCall.java: -------------------------------------------------------------------------------- 1 | public class StaticCall { 2 | 3 | public static void main(String[] args) { 4 | foo(); 5 | A.baz(); 6 | } 7 | 8 | static void foo() { 9 | bar(); 10 | } 11 | 12 | static void bar() { 13 | } 14 | } 15 | 16 | class A { 17 | static void baz() { 18 | B.qux(); 19 | } 20 | } 21 | 22 | class B { 23 | static void qux() { 24 | A.baz(); 25 | } 26 | } 27 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/VirtualCall-cg-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (cg) -------------------- 2 | [0@L9] invokespecial %this.()>(); [()>] 3 | 4 | -------------------- (cg) -------------------- 5 | 6 | -------------------- ()> (cg) -------------------- 7 | [0@L14] invokespecial %this.()>(); [()>] 8 | 9 | -------------------- (cg) -------------------- 10 | 11 | -------------------- (cg) -------------------- 12 | 13 | -------------------- (cg) -------------------- 14 | [1@L4] invokespecial temp$0.()>(); [()>] 15 | [3@L5] invokevirtual b.(); [, , ] 16 | 17 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/cha/VirtualCall.java: -------------------------------------------------------------------------------- 1 | public class VirtualCall { 2 | 3 | public static void main(String[] args) { 4 | B b = new B(); 5 | b.foo(); 6 | } 7 | } 8 | 9 | class A { 10 | void foo() { 11 | } 12 | } 13 | 14 | class B extends A { 15 | } 16 | 17 | class C extends B { 18 | void foo() { 19 | } 20 | } 21 | 22 | class D extends B { 23 | void foo() { 24 | } 25 | } 26 | 27 | class E extends A { 28 | void foo() { 29 | } 30 | } 31 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/dataflow/constprop/inter/Example-inter-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- (inter-constprop) -------------------- 2 | [0@L5] a = 6; {a=6} 3 | [1@L6] temp$1 = invokestatic (a); {a=6} 4 | [2@L6] b = temp$1; {a=6, b=7, temp$1=7} 5 | [3@L7] %intconst0 = 3; {%intconst0=3, a=6, b=7, temp$1=7} 6 | [4@L7] c = b - %intconst0; {%intconst0=3, a=6, b=7, c=4, temp$1=7} 7 | [5@L8] temp$3 = invokestatic (); {%intconst0=3, a=6, b=7, c=4, temp$1=7} 8 | [6@L8] b = temp$3; {%intconst0=3, a=6, b=10, c=4, temp$1=7, temp$3=10} 9 | [7@L9] c = a * b; {%intconst0=3, a=6, b=10, c=60, temp$1=7, temp$3=10} 10 | [8@L9] return; {%intconst0=3, a=6, b=10, c=60, temp$1=7, temp$3=10} 11 | 12 | -------------------- (inter-constprop) -------------------- 13 | [0@L13] %intconst0 = 1; {%intconst0=1, x=6} 14 | [1@L13] y = x + %intconst0; {%intconst0=1, x=6, y=7} 15 | [2@L14] return y; {%intconst0=1, x=6, y=7} 16 | 17 | -------------------- (inter-constprop) -------------------- 18 | [0@L17] temp$0 = 10; {temp$0=10} 19 | [1@L18] return temp$0; {temp$0=10} 20 | 21 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/dataflow/constprop/inter/Example.java: -------------------------------------------------------------------------------- 1 | class Example { 2 | 3 | static void main(String[] args) { 4 | int a, b, c; 5 | a = 6; 6 | b = addOne(a); 7 | c = b - 3; 8 | b = ten(); 9 | c = a * b; 10 | } 11 | 12 | static int addOne(int x) { 13 | int y = x + 1; 14 | return y; 15 | } 16 | 17 | static int ten() { 18 | return 10; 19 | } 20 | } 21 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/dataflow/constprop/inter/Fibonacci.java: -------------------------------------------------------------------------------- 1 | public class Fibonacci { 2 | public static void main(String args[]) { 3 | int n = 5; 4 | int z = 0; 5 | z = getFibonacci(n); 6 | } 7 | 8 | public static int getFibonacci(int n) { 9 | if ((n == 0) || (n == 1)) { 10 | return n; 11 | } else { 12 | return getFibonacci(n - 1) + getFibonacci(n - 2); 13 | } 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/dataflow/constprop/inter/MultiIntArgs-inter-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- (inter-constprop) -------------------- 2 | [0@L3] temp$1 = x + y; {temp$1=5, x=2, y=3} 3 | [1@L4] return temp$1; {temp$1=5, x=2, y=3} 4 | 5 | -------------------- (inter-constprop) -------------------- 6 | [0@L7] temp$0 = x * y; {temp$0=NAC, x=NAC, y=NAC} 7 | [1@L8] return temp$0; {temp$0=NAC, x=NAC, y=NAC} 8 | 9 | -------------------- (inter-constprop) -------------------- 10 | [0@L13] a = 2; {a=2} 11 | [1@L14] b = 3; {a=2, b=3} 12 | [2@L15] temp$0 = invokestatic (a, b); {a=2, b=3} 13 | [3@L15] c = temp$0; {a=2, b=3, c=5, temp$0=5} 14 | [4@L18] x = 2; {a=2, b=3, c=5, temp$0=5, x=2} 15 | [5@L19] y = 3; {a=2, b=3, c=5, temp$0=5, x=2, y=3} 16 | [6@L20] temp$1 = invokestatic (x, y); {a=2, b=3, c=5, temp$0=5, x=2, y=3} 17 | [7@L20] z = temp$1; {a=2, b=3, c=5, temp$0=5, temp$1=NAC, x=2, y=3, z=NAC} 18 | [8@L22] r = 4; {a=2, b=3, c=5, r=4, temp$0=5, temp$1=NAC, x=2, y=3, z=NAC} 19 | [9@L23] s = 5; {a=2, b=3, c=5, r=4, s=5, temp$0=5, temp$1=NAC, x=2, y=3, z=NAC} 20 | [10@L24] temp$2 = invokestatic (r, s); {a=2, b=3, c=5, r=4, s=5, temp$0=5, temp$1=NAC, x=2, y=3, z=NAC} 21 | [11@L24] t = temp$2; {a=2, b=3, c=5, r=4, s=5, t=NAC, temp$0=5, temp$1=NAC, temp$2=NAC, x=2, y=3, z=NAC} 22 | [12@L24] return; {a=2, b=3, c=5, r=4, s=5, t=NAC, temp$0=5, temp$1=NAC, temp$2=NAC, x=2, y=3, z=NAC} 23 | 24 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/dataflow/constprop/inter/MultiIntArgs.java: -------------------------------------------------------------------------------- 1 | public class MultiIntArgs { 2 | 3 | static int goo(int x, int y) { 4 | return (x + y); 5 | } 6 | 7 | static int foo(int x, int y) { 8 | return (x * y); 9 | } 10 | 11 | public static void main(String[] args) { 12 | //call goo once 13 | int a = 2; 14 | int b = 3; 15 | int c = goo(a, b); 16 | 17 | //call foo twice with different args 18 | int x = 2; 19 | int y = 3; 20 | int z = foo(x, y); 21 | 22 | int r = 4; 23 | int s = 5; 24 | int t = foo(r, s); 25 | 26 | } 27 | } 28 | -------------------------------------------------------------------------------- /A4/tai-e/src/test/resources/dataflow/constprop/inter/Reference.java: -------------------------------------------------------------------------------- 1 | public class Reference { 2 | public static void main(String args[]) { 3 | Point p = new Point(); 4 | p.x = 2; 5 | p.y = 3; 6 | int offset = 1; 7 | Point p2 = adjustPoint(p, offset); 8 | int z = p2.x + p2.y; 9 | } 10 | 11 | public static Point adjustPoint(Point p, int offset) { 12 | p.x += offset; 13 | p.y += offset; 14 | return p; 15 | } 16 | } 17 | 18 | class Point { 19 | public int x; 20 | public int y; 21 | } 22 | -------------------------------------------------------------------------------- /A5/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A5/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A5/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A5/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A5/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A5/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A5/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: cipta 2 | options: 3 | merge-string-constants: false 4 | merge-string-objects: false 5 | merge-string-builders: false 6 | merge-exception-objects: true 7 | only-app: false 8 | action: dump 9 | file: null 10 | - id: cg 11 | options: 12 | algorithm: cipta 13 | action: dump 14 | file: null 15 | - id: class-dumper 16 | options: {} 17 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallKind.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | public enum CallKind { 26 | // regular calls 27 | INTERFACE, 28 | VIRTUAL, 29 | SPECIAL, 30 | STATIC, 31 | DYNAMIC, 32 | /** 33 | * Non-regular calls, such calls are typically handled 34 | * by pointer analysis plugins. 35 | */ 36 | OTHER, 37 | } 38 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/analysis/pta/ci/Pointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.ci; 24 | 25 | /** 26 | * Represents pointers in pointer analysis and nodes in pointer flow graph. 27 | * 28 | * @see PointerFlowGraph 29 | */ 30 | abstract class Pointer { 31 | 32 | private final PointsToSet pointsToSet = new PointsToSet(); 33 | 34 | PointsToSet getPointsToSet() { 35 | return pointsToSet; 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/analysis/pta/core/heap/HeapModel.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.heap; 24 | 25 | import pascal.taie.ir.exp.ReferenceLiteral; 26 | import pascal.taie.ir.stmt.New; 27 | 28 | /** 29 | * Represents of heap models for heap objects. 30 | */ 31 | public interface HeapModel { 32 | 33 | /** 34 | * @return the abstract object for given new statement. 35 | */ 36 | Obj getObj(New allocSite); 37 | 38 | /** 39 | * @return the constant object for given value. 40 | */ 41 | Obj getConstantObj(ReferenceLiteral value); 42 | } 43 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/ir/stmt/ArrayStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | 29 | abstract class ArrayStmt extends AssignStmt { 30 | 31 | ArrayStmt(L lvalue, R rvalue) { 32 | super(lvalue, rvalue); 33 | } 34 | 35 | public abstract ArrayAccess getArrayAccess(); 36 | } 37 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/ir/stmt/Copy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.Var; 26 | 27 | /** 28 | * Representation of copy statement, e.g., a = b. 29 | */ 30 | public class Copy extends AssignStmt { 31 | 32 | public Copy(Var lvalue, Var rvalue) { 33 | super(lvalue, rvalue); 34 | } 35 | 36 | @Override 37 | public T accept(StmtVisitor visitor) { 38 | return visitor.visit(this); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/ir/stmt/FieldStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.FieldAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | import pascal.taie.ir.proginfo.FieldRef; 29 | 30 | /** 31 | * Load/Store field statements. 32 | */ 33 | public abstract class FieldStmt extends AssignStmt { 34 | 35 | FieldStmt(L lvalue, R rvalue) { 36 | super(lvalue, rvalue); 37 | } 38 | 39 | public abstract FieldAccess getFieldAccess(); 40 | 41 | public FieldRef getFieldRef() { 42 | return getFieldAccess().getFieldRef(); 43 | } 44 | 45 | public boolean isStatic() { 46 | return getFieldRef().isStatic(); 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/ir/stmt/LoadArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of load array statement, e.g., x = a[..]. 30 | */ 31 | public class LoadArray extends ArrayStmt { 32 | 33 | public LoadArray(Var lvalue, ArrayAccess rvalue) { 34 | super(lvalue, rvalue); 35 | rvalue.getBase().addLoadArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getRValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A5/tai-e/src/main/java/pascal/taie/ir/stmt/StoreArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of store array statement, e.g., a[..] = x. 30 | */ 31 | public class StoreArray extends ArrayStmt { 32 | 33 | public StoreArray(ArrayAccess lvalue, Var rvalue) { 34 | super(lvalue, rvalue); 35 | lvalue.getBase().addStoreArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getLValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Array.java: -------------------------------------------------------------------------------- 1 | class Array { 2 | 3 | public static void main(String[] args) { 4 | A[] arr = new A[10]; 5 | arr[0] = new A(); 6 | arr[1] = new A(); 7 | A a = arr[0]; 8 | arr.hashCode(); 9 | B[] barr = new B[10]; 10 | arrayStore(barr, new A()); 11 | Object o = barr[0]; 12 | } 13 | 14 | private static void arrayStore(Object[] a, Object o) { 15 | a[0] = o; 16 | } 17 | } 18 | 19 | class A { 20 | } 21 | 22 | class B { 23 | } 24 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Assign-cipta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | ()>/%this -> [NewObj{[0@L4] new A}, NewObj{[5@L7] new B}] 3 | /a1 -> [NewObj{[0@L4] new A}, NewObj{[5@L7] new B}] 4 | /a2 -> [NewObj{[0@L4] new A}, NewObj{[5@L7] new B}] 5 | /a3 -> [NewObj{[0@L4] new A}, NewObj{[5@L7] new B}] 6 | /b -> [NewObj{[5@L7] new B}] 7 | /temp$0 -> [NewObj{[0@L4] new A}] 8 | /temp$1 -> [NewObj{[5@L7] new B}] 9 | ()>/%this -> [NewObj{[5@L7] new B}] 10 | ()>/%this -> [NewObj{[0@L4] new A}, NewObj{[5@L7] new B}] 11 | 12 | Points-to sets of all static fields 13 | 14 | Points-to sets of all instance fields 15 | 16 | Points-to sets of all array indexes 17 | 18 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Assign.java: -------------------------------------------------------------------------------- 1 | public class Assign { 2 | 3 | public static void main(String[] args) { 4 | A a1 = new A(); 5 | A a2 = a1; 6 | A a3 = a1; 7 | B b = new B(); 8 | a1 = b; 9 | } 10 | } 11 | 12 | class A { 13 | } 14 | 15 | class B extends A { 16 | } 17 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Assign2-cipta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | ()>/%this -> [NewObj{[0@L10] new A}, NewObj{[3@L11] new A}, NewObj{[6@L12] new A}, NewObj{[0@L3] new A}] 3 | /%this -> [NewObj{[0@L3] new A}] 4 | /a1 -> [NewObj{[0@L10] new A}, NewObj{[3@L11] new A}, NewObj{[6@L12] new A}] 5 | /a2 -> [NewObj{[0@L10] new A}, NewObj{[3@L11] new A}, NewObj{[6@L12] new A}] 6 | /a3 -> [NewObj{[0@L10] new A}, NewObj{[3@L11] new A}, NewObj{[6@L12] new A}] 7 | /temp$0 -> [NewObj{[0@L10] new A}] 8 | /temp$1 -> [NewObj{[3@L11] new A}] 9 | /temp$2 -> [NewObj{[6@L12] new A}] 10 | /temp$0 -> [NewObj{[0@L3] new A}] 11 | ()>/%this -> [NewObj{[0@L10] new A}, NewObj{[3@L11] new A}, NewObj{[6@L12] new A}, NewObj{[0@L3] new A}] 12 | 13 | Points-to sets of all static fields 14 | 15 | Points-to sets of all instance fields 16 | 17 | Points-to sets of all array indexes 18 | 19 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Assign2.java: -------------------------------------------------------------------------------- 1 | class Assign2 { 2 | public static void main(String[] args) { 3 | new A().cycle(); 4 | } 5 | } 6 | 7 | class A { 8 | 9 | void cycle() { 10 | A a1 = new A(); 11 | A a2 = new A(); 12 | A a3 = new A(); 13 | a1 = a2; 14 | a2 = a3; 15 | a3 = a1; 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Call.java: -------------------------------------------------------------------------------- 1 | public class Call { 2 | 3 | public static void main(String[] args) { 4 | A a = new A(); 5 | B b = new B(); 6 | C c = new C(); 7 | C x = a.foo(b, c); 8 | } 9 | } 10 | 11 | class A { 12 | 13 | C foo(B b, C c) { 14 | return c; 15 | } 16 | } 17 | 18 | class B { 19 | } 20 | 21 | class C { 22 | } 23 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Example-cipta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | ()>/%this -> [NewObj{[0@L18] new A}, NewObj{[0@L4] new A}, NewObj{[3@L5] new B}] 3 | /%this -> [NewObj{[3@L5] new B}] 4 | /r -> [NewObj{[0@L18] new A}] 5 | /temp$0 -> [NewObj{[0@L18] new A}] 6 | /y -> [NewObj{[0@L4] new A}] 7 | ()>/%this -> [NewObj{[3@L5] new B}] 8 | /a -> [NewObj{[0@L4] new A}] 9 | /b -> [NewObj{[3@L5] new B}] 10 | /c -> [NewObj{[0@L18] new A}] 11 | /temp$0 -> [NewObj{[0@L4] new A}] 12 | /temp$1 -> [NewObj{[3@L5] new B}] 13 | /temp$2 -> [NewObj{[0@L18] new A}] 14 | ()>/%this -> [NewObj{[0@L18] new A}, NewObj{[0@L4] new A}, NewObj{[3@L5] new B}] 15 | 16 | Points-to sets of all static fields 17 | 18 | Points-to sets of all instance fields 19 | 20 | Points-to sets of all array indexes 21 | 22 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/Example.java: -------------------------------------------------------------------------------- 1 | class Example { 2 | 3 | public static void main(String[] args) { 4 | A a = new A(); 5 | A b = new B(); 6 | A c = b.foo(a); 7 | } 8 | } 9 | 10 | class A { 11 | A foo(A x) { 12 | return null; 13 | } 14 | } 15 | 16 | class B extends A { 17 | A foo(A y) { 18 | A r = new A(); 19 | return r; 20 | } 21 | } 22 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/InstanceField.java: -------------------------------------------------------------------------------- 1 | class InstanceField { 2 | 3 | public static void main(String[] args) { 4 | A a = new A(); 5 | a.longAP(); 6 | a.cycle(); 7 | a.callField(); 8 | } 9 | } 10 | 11 | class A { 12 | B b; 13 | 14 | void longAP() { 15 | A a = new A(); 16 | a.b = new B(); 17 | a.b.c = new C(); 18 | a.b.c.d = new D(); 19 | D x = a.b.c.d; 20 | } 21 | 22 | void cycle() { 23 | A a = new A(); 24 | B b = new B(); 25 | b.a = a; 26 | a.b = b; 27 | A x = b.a.b.a; 28 | } 29 | 30 | void callField() { 31 | A a = new A(); 32 | B b = new B(); 33 | a.b = b; 34 | C c = a.b.foo(); 35 | } 36 | } 37 | 38 | class B { 39 | A a; 40 | C c; 41 | 42 | C foo() { 43 | C x = new C(); 44 | return x; 45 | } 46 | } 47 | 48 | class C { 49 | D d; 50 | } 51 | 52 | class D { 53 | } 54 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/MergeParam.java: -------------------------------------------------------------------------------- 1 | class MergeParam { 2 | 3 | public static void main(String[] args) { 4 | A a1 = new A(); 5 | A a2 = new A(); 6 | 7 | A result = foo(a1); 8 | result = foo(a2); 9 | } 10 | 11 | public static A foo(A a) { 12 | return a; 13 | } 14 | 15 | } 16 | 17 | class A { 18 | 19 | } 20 | 21 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/StaticCall-cipta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | /n -> [] 3 | /o -> [NewObj{[0@L4] new java.lang.Object}] 4 | /temp$0 -> [] 5 | /temp$2 -> [NewObj{[0@L4] new java.lang.Object}] 6 | /n -> [] 7 | /o -> [NewObj{[0@L4] new java.lang.Object}] 8 | /temp$0 -> [NewObj{[0@L4] new java.lang.Object}] 9 | /%intconst0 -> [] 10 | /o -> [NewObj{[0@L4] new java.lang.Object}] 11 | /temp$0 -> [NewObj{[0@L4] new java.lang.Object}] 12 | /temp$1 -> [NewObj{[0@L4] new java.lang.Object}] 13 | ()>/%this -> [NewObj{[0@L4] new java.lang.Object}] 14 | 15 | Points-to sets of all static fields 16 | 17 | Points-to sets of all instance fields 18 | 19 | Points-to sets of all array indexes 20 | 21 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/StaticCall.java: -------------------------------------------------------------------------------- 1 | class StaticCall { 2 | 3 | public static void main(String[] args) { 4 | Object o = foo(100, new Object()); 5 | } 6 | 7 | static Object foo(int n, Object o) { 8 | if (n < 0) { 9 | return bar(n, o); 10 | } 11 | return o; 12 | } 13 | 14 | static Object bar(int n, Object o) { 15 | return foo(n--, o); 16 | } 17 | } 18 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/StaticField-cipta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | ()>/%this -> [NewObj{[0@L4] new B}] 3 | /b -> [NewObj{[0@L4] new B}] 4 | /temp$0 -> [NewObj{[0@L4] new B}] 5 | ()>/%this -> [NewObj{[0@L4] new B}] 6 | 7 | Points-to sets of all static fields 8 | -> [NewObj{[0@L4] new B}] 9 | 10 | Points-to sets of all instance fields 11 | 12 | Points-to sets of all array indexes 13 | 14 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/StaticField.java: -------------------------------------------------------------------------------- 1 | class StaticField { 2 | 3 | public static void main(String[] args) { 4 | A.b = new B(); 5 | B b = A.b; 6 | } 7 | 8 | } 9 | 10 | class A { 11 | static B b; 12 | } 13 | 14 | class B { 15 | } 16 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/StoreLoad-cipta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | ()>/%this -> [NewObj{[0@L4] new A}] 3 | ()>/%this -> [NewObj{[3@L5] new B}] 4 | /a1 -> [NewObj{[0@L4] new A}] 5 | /a2 -> [NewObj{[0@L4] new A}] 6 | /b1 -> [NewObj{[3@L5] new B}] 7 | /b2 -> [NewObj{[3@L5] new B}] 8 | /temp$0 -> [NewObj{[0@L4] new A}] 9 | /temp$1 -> [NewObj{[3@L5] new B}] 10 | ()>/%this -> [NewObj{[0@L4] new A}, NewObj{[3@L5] new B}] 11 | 12 | Points-to sets of all static fields 13 | 14 | Points-to sets of all instance fields 15 | NewObj{[0@L4] new A}.f -> [NewObj{[3@L5] new B}] 16 | 17 | Points-to sets of all array indexes 18 | 19 | -------------------------------------------------------------------------------- /A5/tai-e/src/test/resources/pta/cipta/StoreLoad.java: -------------------------------------------------------------------------------- 1 | public class StoreLoad { 2 | 3 | public static void main(String[] args) { 4 | A a1 = new A(); 5 | B b1 = new B(); 6 | a1.f = b1; 7 | A a2 = a1; 8 | B b2 = a2.f; 9 | } 10 | } 11 | 12 | class A { 13 | B f; 14 | } 15 | 16 | class B { 17 | } 18 | -------------------------------------------------------------------------------- /A6/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A6/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A6/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A6/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A6/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A6/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A6/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: cspta 2 | options: 3 | cs: ci 4 | merge-string-constants: false 5 | merge-string-objects: false 6 | merge-string-builders: false 7 | merge-exception-objects: true 8 | action: dump 9 | file: null 10 | - id: cg 11 | options: 12 | algorithm: cspta 13 | action: dump 14 | file: null 15 | - id: class-dumper 16 | options: {} 17 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallKind.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | public enum CallKind { 26 | // regular calls 27 | INTERFACE, 28 | VIRTUAL, 29 | SPECIAL, 30 | STATIC, 31 | DYNAMIC, 32 | /** 33 | * Non-regular calls, such calls are typically handled 34 | * by pointer analysis plugins. 35 | */ 36 | OTHER, 37 | } 38 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/context/Context.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.context; 24 | 25 | /** 26 | * Representation of contexts in context-sensitive pointer analysis. 27 | * Each context can be seen as a list of zero or more context elements. 28 | */ 29 | public interface Context { 30 | 31 | /** 32 | * @return the length (i.e., the number of elements) of this context. 33 | */ 34 | int getLength(); 35 | 36 | /** 37 | * @return the i-th element of this context. Starts from 0. 38 | */ 39 | Object getElementAt(int i); 40 | } 41 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/AbstractPointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.pts.PointsToSet; 26 | 27 | abstract class AbstractPointer implements Pointer { 28 | 29 | private PointsToSet pointsToSet; 30 | 31 | @Override 32 | public PointsToSet getPointsToSet() { 33 | return pointsToSet; 34 | } 35 | 36 | @Override 37 | public void setPointsToSet(PointsToSet pointsToSet) { 38 | this.pointsToSet = pointsToSet; 39 | } 40 | 41 | } 42 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/CSElement.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.core.cs.context.Context; 26 | 27 | /** 28 | * Context-sensitive elements. Each element is associate with a context. 29 | */ 30 | public interface CSElement { 31 | 32 | /** 33 | * @return the context of the context-sensitive element. 34 | */ 35 | Context getContext(); 36 | } 37 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/CSObj.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.core.cs.context.Context; 26 | import pascal.taie.analysis.pta.core.heap.Obj; 27 | 28 | /** 29 | * Represents context-sensitive objects. 30 | */ 31 | public class CSObj extends AbstractCSElement { 32 | 33 | private final Obj obj; 34 | 35 | CSObj(Obj obj, Context context) { 36 | super(context); 37 | this.obj = obj; 38 | } 39 | 40 | /** 41 | * @return the abstract object (without context). 42 | */ 43 | public Obj getObject() { 44 | return obj; 45 | } 46 | 47 | @Override 48 | public String toString() { 49 | return context + ":" + obj; 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/Pointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.pts.PointsToSet; 26 | import pascal.taie.language.type.Type; 27 | 28 | /** 29 | * Represents all pointers (nodes) in context-sensitive 30 | * pointer analysis (pointer flow graph). 31 | */ 32 | public interface Pointer { 33 | 34 | /** 35 | * @return the points-to set associated with the pointer. 36 | */ 37 | PointsToSet getPointsToSet(); 38 | 39 | /** 40 | * Sets the associated points-to set of the pointer. 41 | */ 42 | void setPointsToSet(PointsToSet pointsToSet); 43 | 44 | /** 45 | * @return the type of this pointer 46 | */ 47 | Type getType(); 48 | } 49 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/analysis/pta/core/heap/HeapModel.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.heap; 24 | 25 | import pascal.taie.ir.exp.ReferenceLiteral; 26 | import pascal.taie.ir.stmt.New; 27 | 28 | /** 29 | * Represents of heap models for heap objects. 30 | */ 31 | public interface HeapModel { 32 | 33 | /** 34 | * @return the abstract object for given new statement. 35 | */ 36 | Obj getObj(New allocSite); 37 | 38 | /** 39 | * @return the constant object for given value. 40 | */ 41 | Obj getConstantObj(ReferenceLiteral value); 42 | } 43 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/ir/stmt/ArrayStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | 29 | abstract class ArrayStmt extends AssignStmt { 30 | 31 | ArrayStmt(L lvalue, R rvalue) { 32 | super(lvalue, rvalue); 33 | } 34 | 35 | public abstract ArrayAccess getArrayAccess(); 36 | } 37 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/ir/stmt/Copy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.Var; 26 | 27 | /** 28 | * Representation of copy statement, e.g., a = b. 29 | */ 30 | public class Copy extends AssignStmt { 31 | 32 | public Copy(Var lvalue, Var rvalue) { 33 | super(lvalue, rvalue); 34 | } 35 | 36 | @Override 37 | public T accept(StmtVisitor visitor) { 38 | return visitor.visit(this); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/ir/stmt/FieldStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.FieldAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | import pascal.taie.ir.proginfo.FieldRef; 29 | 30 | /** 31 | * Load/Store field statements. 32 | */ 33 | public abstract class FieldStmt extends AssignStmt { 34 | 35 | FieldStmt(L lvalue, R rvalue) { 36 | super(lvalue, rvalue); 37 | } 38 | 39 | public abstract FieldAccess getFieldAccess(); 40 | 41 | public FieldRef getFieldRef() { 42 | return getFieldAccess().getFieldRef(); 43 | } 44 | 45 | public boolean isStatic() { 46 | return getFieldRef().isStatic(); 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/ir/stmt/LoadArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of load array statement, e.g., x = a[..]. 30 | */ 31 | public class LoadArray extends ArrayStmt { 32 | 33 | public LoadArray(Var lvalue, ArrayAccess rvalue) { 34 | super(lvalue, rvalue); 35 | rvalue.getBase().addLoadArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getRValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A6/tai-e/src/main/java/pascal/taie/ir/stmt/StoreArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of store array statement, e.g., a[..] = x. 30 | */ 31 | public class StoreArray extends ArrayStmt { 32 | 33 | public StoreArray(ArrayAccess lvalue, Var rvalue) { 34 | super(lvalue, rvalue); 35 | lvalue.getBase().addStoreArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getLValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/Array.java: -------------------------------------------------------------------------------- 1 | class Array { 2 | 3 | public static void main(String[] args) { 4 | A[] arr = new A[10]; 5 | arr[0] = new A(); 6 | arr[1] = new A(); 7 | A a = arr[0]; 8 | arr.hashCode(); 9 | B[] barr = new B[10]; 10 | arrayStore(barr, new A()); 11 | Object o = barr[0]; 12 | } 13 | 14 | private static void arrayStore(Object[] a, Object o) { 15 | a[0] = o; 16 | } 17 | } 18 | 19 | class A { 20 | } 21 | 22 | class B { 23 | } 24 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/Assign-cspta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | []:()>/%this -> [[]:NewObj{[0@L4] new A}, []:NewObj{[5@L7] new B}] 3 | []:/a1 -> [[]:NewObj{[0@L4] new A}, []:NewObj{[5@L7] new B}] 4 | []:/a2 -> [[]:NewObj{[0@L4] new A}, []:NewObj{[5@L7] new B}] 5 | []:/a3 -> [[]:NewObj{[0@L4] new A}, []:NewObj{[5@L7] new B}] 6 | []:/b -> [[]:NewObj{[5@L7] new B}] 7 | []:/temp$0 -> [[]:NewObj{[0@L4] new A}] 8 | []:/temp$1 -> [[]:NewObj{[5@L7] new B}] 9 | []:()>/%this -> [[]:NewObj{[5@L7] new B}] 10 | []:()>/%this -> [[]:NewObj{[0@L4] new A}, []:NewObj{[5@L7] new B}] 11 | 12 | Points-to sets of all static fields 13 | 14 | Points-to sets of all instance fields 15 | 16 | Points-to sets of all array indexes 17 | 18 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/Assign.java: -------------------------------------------------------------------------------- 1 | public class Assign { 2 | 3 | public static void main(String[] args) { 4 | A a1 = new A(); 5 | A a2 = a1; 6 | A a3 = a1; 7 | B b = new B(); 8 | a1 = b; 9 | } 10 | } 11 | 12 | class A { 13 | } 14 | 15 | class B extends A { 16 | } 17 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/Call.java: -------------------------------------------------------------------------------- 1 | public class Call { 2 | 3 | public static void main(String[] args) { 4 | A a = new A(); 5 | B b = new B(); 6 | C c = new C(); 7 | C x = a.foo(b, c); 8 | } 9 | } 10 | 11 | class A { 12 | 13 | C foo(B b, C c) { 14 | return c; 15 | } 16 | } 17 | 18 | class B { 19 | } 20 | 21 | class C { 22 | } 23 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/InstanceField.java: -------------------------------------------------------------------------------- 1 | class InstanceField { 2 | 3 | public static void main(String[] args) { 4 | A a = new A(); 5 | a.longAP(); 6 | a.cycle(); 7 | a.callField(); 8 | } 9 | } 10 | 11 | class A { 12 | B b; 13 | 14 | void longAP() { 15 | A a = new A(); 16 | a.b = new B(); 17 | a.b.c = new C(); 18 | a.b.c.d = new D(); 19 | D x = a.b.c.d; 20 | } 21 | 22 | void cycle() { 23 | A a = new A(); 24 | B b = new B(); 25 | b.a = a; 26 | a.b = b; 27 | A x = b.a.b.a; 28 | } 29 | 30 | void callField() { 31 | A a = new A(); 32 | B b = new B(); 33 | a.b = b; 34 | C c = a.b.foo(); 35 | } 36 | } 37 | 38 | class B { 39 | A a; 40 | C c; 41 | 42 | C foo() { 43 | C x = new C(); 44 | return x; 45 | } 46 | } 47 | 48 | class C { 49 | D d; 50 | } 51 | 52 | class D { 53 | } 54 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/New.java: -------------------------------------------------------------------------------- 1 | public class New { 2 | 3 | public static void main(String[] args) { 4 | A a = new A(); 5 | B b1 = new B(); 6 | B b2 = new C(); 7 | C c = new C(); 8 | } 9 | } 10 | 11 | class A { 12 | } 13 | 14 | class B { 15 | } 16 | 17 | class C extends B { 18 | } 19 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/OneCall.java: -------------------------------------------------------------------------------- 1 | class OneCall { 2 | public static void main(String[] args) { 3 | C c = new C(); 4 | c.m(); 5 | } 6 | } 7 | 8 | class C { 9 | 10 | void m() { 11 | Number n1, n2, x, y; 12 | n1 = new One(); 13 | n2 = new Two(); 14 | x = this.id(n1); 15 | y = this.id(n2); 16 | int i = x.get(); // x -> ?, i = ? 17 | } 18 | 19 | Number id(Number n) { 20 | return n; 21 | } 22 | } 23 | 24 | interface Number { 25 | int get(); 26 | } 27 | 28 | class Zero implements Number { 29 | public int get() { 30 | return 0; 31 | } 32 | } 33 | 34 | class One implements Number { 35 | public int get() { 36 | return 1; 37 | } 38 | } 39 | 40 | class Two implements Number { 41 | public int get() { 42 | return 2; 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/OneObject.java: -------------------------------------------------------------------------------- 1 | class OneObject { 2 | public static void main(String[] args) { 3 | m(); 4 | } 5 | 6 | static void m() { 7 | A a1 = new A(); 8 | A a2 = new A(); 9 | B b1 = new B(); 10 | B b2 = new B(); 11 | a1.set(b1); 12 | a2.set(b2); 13 | B x = a1.get(); // x -> ? 14 | } 15 | } 16 | 17 | class A { 18 | B f; 19 | 20 | void set(B b) { 21 | this.doSet(b); 22 | } 23 | 24 | void doSet(B p) { 25 | this.f = p; 26 | } 27 | 28 | B get() { 29 | return this.f; 30 | } 31 | } 32 | 33 | class B { 34 | } 35 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/OneType.java: -------------------------------------------------------------------------------- 1 | class OneType { 2 | public static void main(String[] args) { 3 | new A().m(); 4 | new B().m(); 5 | } 6 | } 7 | 8 | class A { 9 | void m() { 10 | C c1 = new C(); 11 | c1.set(new D()); 12 | C c2 = new C(); 13 | c2.set(new D()); 14 | D x = c1.get(); 15 | } 16 | } 17 | 18 | class B { 19 | void m() { 20 | C c3 = new C(); 21 | c3.set(new D()); 22 | D y = c3.get(); 23 | } 24 | } 25 | 26 | class C { 27 | D f; 28 | 29 | void set(D p) { 30 | this.f = p; 31 | } 32 | 33 | D get() { 34 | return this.f; 35 | } 36 | } 37 | 38 | class D { 39 | } 40 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/StaticField-cspta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | []:()>/%this -> [[]:NewObj{[0@L4] new B}] 3 | []:/b -> [[]:NewObj{[0@L4] new B}] 4 | []:/temp$0 -> [[]:NewObj{[0@L4] new B}] 5 | []:()>/%this -> [[]:NewObj{[0@L4] new B}] 6 | 7 | Points-to sets of all static fields 8 | -> [[]:NewObj{[0@L4] new B}] 9 | 10 | Points-to sets of all instance fields 11 | 12 | Points-to sets of all array indexes 13 | 14 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/StaticField.java: -------------------------------------------------------------------------------- 1 | class StaticField { 2 | 3 | public static void main(String[] args) { 4 | A.b = new B(); 5 | B b = A.b; 6 | } 7 | 8 | } 9 | 10 | class A { 11 | static B b; 12 | } 13 | 14 | class B { 15 | } 16 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/StoreLoad-cspta-expected.txt: -------------------------------------------------------------------------------- 1 | Points-to sets of all variables 2 | []:()>/%this -> [[]:NewObj{[0@L4] new A}] 3 | []:()>/%this -> [[]:NewObj{[3@L5] new B}] 4 | []:/a1 -> [[]:NewObj{[0@L4] new A}] 5 | []:/a2 -> [[]:NewObj{[0@L4] new A}] 6 | []:/b1 -> [[]:NewObj{[3@L5] new B}] 7 | []:/b2 -> [[]:NewObj{[3@L5] new B}] 8 | []:/temp$0 -> [[]:NewObj{[0@L4] new A}] 9 | []:/temp$1 -> [[]:NewObj{[3@L5] new B}] 10 | []:()>/%this -> [[]:NewObj{[0@L4] new A}, []:NewObj{[3@L5] new B}] 11 | 12 | Points-to sets of all static fields 13 | 14 | Points-to sets of all instance fields 15 | []:NewObj{[0@L4] new A}.f -> [[]:NewObj{[3@L5] new B}] 16 | 17 | Points-to sets of all array indexes 18 | 19 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/StoreLoad.java: -------------------------------------------------------------------------------- 1 | public class StoreLoad { 2 | 3 | public static void main(String[] args) { 4 | A a1 = new A(); 5 | B b1 = new B(); 6 | a1.f = b1; 7 | A a2 = a1; 8 | B b2 = a2.f; 9 | } 10 | } 11 | 12 | class A { 13 | B f; 14 | } 15 | 16 | class B { 17 | } 18 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/TwoCall.java: -------------------------------------------------------------------------------- 1 | class TwoCall { 2 | public static void main(String[] args) { 3 | m(); 4 | } 5 | 6 | static void m() { 7 | A a = new A(); 8 | B b = a.id(new B()); 9 | B c = a.id(new C()); 10 | } 11 | } 12 | 13 | class A { 14 | B id(B b) { 15 | return _id(b); 16 | } 17 | 18 | B _id(B p) { 19 | return p; 20 | } 21 | } 22 | 23 | class B { 24 | } 25 | 26 | class C extends B { 27 | } 28 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/TwoObject.java: -------------------------------------------------------------------------------- 1 | interface Iterator { 2 | Object next(); 3 | } 4 | 5 | class TwoObject { 6 | public static void main(String[] args) { 7 | m(); 8 | } 9 | 10 | static void m() { 11 | List l1 = new List(); 12 | l1.add(new Object()); 13 | List l2 = new List(); 14 | l2.add(new Object()); 15 | 16 | Iterator i1 = l1.iterator(); 17 | Object o1 = i1.next(); 18 | Iterator i2 = l2.iterator(); 19 | Object o2 = i2.next(); 20 | } 21 | } 22 | 23 | class List { 24 | 25 | Object element; 26 | 27 | void add(Object e) { 28 | this.element = e; 29 | } 30 | 31 | Iterator iterator() { 32 | return new ListIterator(); 33 | } 34 | 35 | class ListIterator implements Iterator { 36 | 37 | public Object next() { 38 | return element; 39 | } 40 | } 41 | } 42 | -------------------------------------------------------------------------------- /A6/tai-e/src/test/resources/pta/cspta/TwoType.java: -------------------------------------------------------------------------------- 1 | interface Iterator { 2 | Object next(); 3 | } 4 | 5 | class TwoType { 6 | public static void main(String[] args) { 7 | new A().a(); 8 | new B().b(); 9 | } 10 | } 11 | 12 | class A { 13 | void a() { 14 | List l1 = new List(); 15 | l1.add(new Object()); 16 | List l2 = new List(); 17 | l2.add(new Object()); 18 | 19 | Iterator i1 = l1.iterator(); 20 | Object o1 = i1.next(); 21 | Iterator i2 = l2.iterator(); 22 | Object o2 = i2.next(); 23 | } 24 | } 25 | 26 | class B { 27 | void b() { 28 | List l3 = new List(); 29 | l3.add(new Object()); 30 | 31 | Iterator i3 = l3.iterator(); 32 | Object o3 = i3.next(); 33 | } 34 | } 35 | 36 | class List { 37 | 38 | Object element; 39 | 40 | void add(Object e) { 41 | this.element = e; 42 | } 43 | 44 | Iterator iterator() { 45 | return new ListIterator(); 46 | } 47 | 48 | class ListIterator implements Iterator { 49 | 50 | public Object next() { 51 | return element; 52 | } 53 | } 54 | } 55 | -------------------------------------------------------------------------------- /A7/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A7/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A7/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A7/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A7/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A7/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A7/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: cspta 2 | options: 3 | cs: 2-obj 4 | merge-string-constants: false 5 | merge-string-objects: false 6 | merge-string-builders: false 7 | merge-exception-objects: true 8 | action: null 9 | file: null 10 | - id: cg 11 | options: 12 | algorithm: cspta 13 | action: dump 14 | file: null 15 | - id: throw 16 | options: 17 | exception: explicit 18 | algorithm: intra 19 | - id: cfg 20 | options: 21 | exception: explicit 22 | dump: false 23 | - id: icfg 24 | options: 25 | dump: true 26 | - id: inter-constprop 27 | options: 28 | edge-refine: false 29 | alias-aware: true 30 | pta: cspta 31 | - id: process-result 32 | options: 33 | analyses: 34 | - inter-constprop 35 | action: dump 36 | file: null 37 | log-mismatches: false 38 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/StmtResult.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis; 24 | 25 | import pascal.taie.ir.stmt.Stmt; 26 | 27 | /** 28 | * An interface for querying analysis results of Stmt. 29 | * 30 | * @param type of analysis results 31 | */ 32 | public interface StmtResult { 33 | 34 | /** 35 | * @return if {@code stmt} is relevant in this result. 36 | */ 37 | boolean isRelevant(Stmt stmt); 38 | 39 | /** 40 | * @return analysis result of given stmt. 41 | */ 42 | R getResult(Stmt stmt); 43 | } 44 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CGBuilder.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | interface CGBuilder { 26 | 27 | CallGraph build(); 28 | } 29 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallKind.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | public enum CallKind { 26 | // regular calls 27 | INTERFACE, 28 | VIRTUAL, 29 | SPECIAL, 30 | STATIC, 31 | DYNAMIC, 32 | /** 33 | * Non-regular calls, such calls are typically handled 34 | * by pointer analysis plugins. 35 | */ 36 | OTHER, 37 | } 38 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/graph/icfg/CallEdge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.icfg; 24 | 25 | import pascal.taie.language.classes.JMethod; 26 | 27 | /** 28 | * The edge connecting a call site to method entry of the callee. 29 | * 30 | * @param type of nodes 31 | */ 32 | public class CallEdge extends ICFGEdge { 33 | 34 | /** 35 | * Callee of the call edge. 36 | */ 37 | private final JMethod callee; 38 | 39 | CallEdge(Node source, Node target, JMethod callee) { 40 | super(source, target); 41 | this.callee = callee; 42 | } 43 | 44 | /** 45 | * @return the callee of the call edge. 46 | */ 47 | public JMethod getCallee() { 48 | return callee; 49 | } 50 | } 51 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/graph/icfg/CallToReturnEdge.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.icfg; 24 | 25 | import pascal.taie.analysis.graph.cfg.Edge; 26 | 27 | /** 28 | * The edge connecting a call site and its return site. 29 | * 30 | * @param type of nodes 31 | */ 32 | public class CallToReturnEdge extends ICFGEdge { 33 | 34 | public CallToReturnEdge(Edge edge) { 35 | super(edge.getSource(), edge.getTarget()); 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/context/Context.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.context; 24 | 25 | /** 26 | * Representation of contexts in context-sensitive pointer analysis. 27 | * Each context can be seen as a list of zero or more context elements. 28 | */ 29 | public interface Context { 30 | 31 | /** 32 | * @return the length (i.e., the number of elements) of this context. 33 | */ 34 | int getLength(); 35 | 36 | /** 37 | * @return the i-th element of this context. Starts from 0. 38 | */ 39 | Object getElementAt(int i); 40 | } 41 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/AbstractPointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.pts.PointsToSet; 26 | 27 | abstract class AbstractPointer implements Pointer { 28 | 29 | private PointsToSet pointsToSet; 30 | 31 | @Override 32 | public PointsToSet getPointsToSet() { 33 | return pointsToSet; 34 | } 35 | 36 | @Override 37 | public void setPointsToSet(PointsToSet pointsToSet) { 38 | this.pointsToSet = pointsToSet; 39 | } 40 | 41 | } 42 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/CSElement.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.core.cs.context.Context; 26 | 27 | /** 28 | * Context-sensitive elements. Each element is associate with a context. 29 | */ 30 | public interface CSElement { 31 | 32 | /** 33 | * @return the context of the context-sensitive element. 34 | */ 35 | Context getContext(); 36 | } 37 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/CSObj.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.core.cs.context.Context; 26 | import pascal.taie.analysis.pta.core.heap.Obj; 27 | 28 | /** 29 | * Represents context-sensitive objects. 30 | */ 31 | public class CSObj extends AbstractCSElement { 32 | 33 | private final Obj obj; 34 | 35 | CSObj(Obj obj, Context context) { 36 | super(context); 37 | this.obj = obj; 38 | } 39 | 40 | /** 41 | * @return the abstract object (without context). 42 | */ 43 | public Obj getObject() { 44 | return obj; 45 | } 46 | 47 | @Override 48 | public String toString() { 49 | return context + ":" + obj; 50 | } 51 | } 52 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/Pointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.pts.PointsToSet; 26 | import pascal.taie.language.type.Type; 27 | 28 | /** 29 | * Represents all pointers (nodes) in context-sensitive 30 | * pointer analysis (pointer flow graph). 31 | */ 32 | public interface Pointer { 33 | 34 | /** 35 | * @return the points-to set associated with the pointer. 36 | */ 37 | PointsToSet getPointsToSet(); 38 | 39 | /** 40 | * Sets the associated points-to set of the pointer. 41 | */ 42 | void setPointsToSet(PointsToSet pointsToSet); 43 | 44 | /** 45 | * @return the type of this pointer 46 | */ 47 | Type getType(); 48 | } 49 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/analysis/pta/core/heap/HeapModel.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.heap; 24 | 25 | import pascal.taie.ir.exp.ReferenceLiteral; 26 | import pascal.taie.ir.stmt.New; 27 | 28 | /** 29 | * Represents of heap models for heap objects. 30 | */ 31 | public interface HeapModel { 32 | 33 | /** 34 | * @return the abstract object for given new statement. 35 | */ 36 | Obj getObj(New allocSite); 37 | 38 | /** 39 | * @return the constant object for given value. 40 | */ 41 | Obj getConstantObj(ReferenceLiteral value); 42 | } 43 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/exp/BinaryExp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | /** 26 | * Representation of binary expression. 27 | */ 28 | public interface BinaryExp extends RValue { 29 | 30 | /** 31 | * Representation of binary operators. 32 | */ 33 | interface Op { 34 | } 35 | 36 | /** 37 | * @return the operator. 38 | */ 39 | Op getOperator(); 40 | 41 | /** 42 | * @return the first operand. 43 | */ 44 | Var getOperand1(); 45 | 46 | /** 47 | * @return the second operand. 48 | */ 49 | Var getOperand2(); 50 | } 51 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/exp/Exp.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.exp; 24 | 25 | import pascal.taie.language.type.Type; 26 | 27 | import java.util.List; 28 | 29 | /** 30 | * Representation of expressions in Tai-e IR. 31 | */ 32 | public interface Exp { 33 | 34 | /** 35 | * @return type of this expression. 36 | */ 37 | Type getType(); 38 | 39 | /** 40 | * @return a list of expressions which are used by (contained in) this Exp. 41 | */ 42 | default List getUses() { 43 | return List.of(); 44 | } 45 | 46 | T accept(ExpVisitor visitor); 47 | } 48 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/stmt/ArrayStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | 29 | abstract class ArrayStmt extends AssignStmt { 30 | 31 | ArrayStmt(L lvalue, R rvalue) { 32 | super(lvalue, rvalue); 33 | } 34 | 35 | public abstract ArrayAccess getArrayAccess(); 36 | } 37 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/stmt/Copy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.Var; 26 | 27 | /** 28 | * Representation of copy statement, e.g., a = b. 29 | */ 30 | public class Copy extends AssignStmt { 31 | 32 | public Copy(Var lvalue, Var rvalue) { 33 | super(lvalue, rvalue); 34 | } 35 | 36 | @Override 37 | public T accept(StmtVisitor visitor) { 38 | return visitor.visit(this); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/stmt/FieldStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.FieldAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | import pascal.taie.ir.proginfo.FieldRef; 29 | 30 | /** 31 | * Load/Store field statements. 32 | */ 33 | public abstract class FieldStmt extends AssignStmt { 34 | 35 | FieldStmt(L lvalue, R rvalue) { 36 | super(lvalue, rvalue); 37 | } 38 | 39 | public abstract FieldAccess getFieldAccess(); 40 | 41 | public FieldRef getFieldRef() { 42 | return getFieldAccess().getFieldRef(); 43 | } 44 | 45 | public boolean isStatic() { 46 | return getFieldRef().isStatic(); 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/stmt/LoadArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of load array statement, e.g., x = a[..]. 30 | */ 31 | public class LoadArray extends ArrayStmt { 32 | 33 | public LoadArray(Var lvalue, ArrayAccess rvalue) { 34 | super(lvalue, rvalue); 35 | rvalue.getBase().addLoadArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getRValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A7/tai-e/src/main/java/pascal/taie/ir/stmt/StoreArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of store array statement, e.g., a[..] = x. 30 | */ 31 | public class StoreArray extends ArrayStmt { 32 | 33 | public StoreArray(ArrayAccess lvalue, Var rvalue) { 34 | super(lvalue, rvalue); 35 | lvalue.getBase().addStoreArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getLValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/Array.java: -------------------------------------------------------------------------------- 1 | class Array { 2 | 3 | public static void main(String[] args) { 4 | int[] a1 = {1, 2, 3, 5, 7, 9}; 5 | int x = a1[3]; 6 | int[] a2 = new int[3]; 7 | a2[0] = 666; 8 | a2[1] = 888; 9 | a2[2] = 999; 10 | int y = a2[1]; 11 | int z = a2[2]; 12 | } 13 | } 14 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/ArrayInter2-inter-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- (inter-constprop) -------------------- 2 | [0@L4] %intconst0 = 1; {%intconst0=1} 3 | [1@L4] a = newarray int[%intconst0]; {%intconst0=1} 4 | [2@L5] %intconst1 = 0; {%intconst0=1, %intconst1=0} 5 | [3@L5] %intconst2 = 777; {%intconst0=1, %intconst1=0, %intconst2=777} 6 | [4@L5] invokestatic (a, %intconst1, %intconst2); {%intconst0=1, %intconst1=0, %intconst2=777} 7 | [5@L6] temp$0 = invokestatic (a, %intconst1); {%intconst0=1, %intconst1=0, %intconst2=777} 8 | [6@L6] x = temp$0; {%intconst0=1, %intconst1=0, %intconst2=777, temp$0=777, x=777} 9 | [7@L6] return; {%intconst0=1, %intconst1=0, %intconst2=777, temp$0=777, x=777} 10 | 11 | -------------------- (inter-constprop) -------------------- 12 | [0@L10] arr[i] = v; {i=0, v=777} 13 | [1@L10] return; {i=0, v=777} 14 | 15 | -------------------- (inter-constprop) -------------------- 16 | [0@L13] temp$2 = arr[i]; {i=0, temp$2=777} 17 | [1@L14] return temp$2; {i=0, temp$2=777} 18 | 19 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/ArrayInter2.java: -------------------------------------------------------------------------------- 1 | class ArrayInter2 { 2 | 3 | public static void main(String[] args) { 4 | int[] a = new int[1]; 5 | set(a, 0, 777); 6 | int x = get(a, 0); 7 | } 8 | 9 | static void set(int[] arr, int i, int v) { 10 | arr[i] = v; 11 | } 12 | 13 | static int get(int[] arr, int i) { 14 | return arr[i]; 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/ArrayLoops.java: -------------------------------------------------------------------------------- 1 | class ArrayLoops { 2 | 3 | public static void main(String[] args) { 4 | loopConst(); 5 | loopMix(); 6 | loopNAC(); 7 | } 8 | 9 | static void loopConst() { 10 | int[] a = new int[5]; 11 | for (int i = 0; i < a.length; ++i) { 12 | a[i] = 666; 13 | } 14 | int x = a[3]; 15 | } 16 | 17 | static void loopMix() { 18 | int[] a = new int[5]; 19 | for (int i = 0; i < a.length; ++i) { 20 | a[i] = 666; 21 | } 22 | a[4] = 777; 23 | int x = a[3]; 24 | int y = a[4]; 25 | } 26 | 27 | static void loopNAC() { 28 | int[] a = new int[5]; 29 | for (int i = 0; i < a.length; ++i) { 30 | a[i] = i; 31 | } 32 | int x = a[3]; 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/InstanceField-inter-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (inter-constprop) -------------------- 2 | [0@L13] invokespecial %this.()>(); {} 3 | [1@L13] return; {} 4 | 5 | -------------------- (inter-constprop) -------------------- 6 | [0@L4] temp$0 = new A; {} 7 | [1@L4] invokespecial temp$0.()>(); {} 8 | [2@L4] a1 = temp$0; {} 9 | [3@L5] temp$1 = 111; {temp$1=111} 10 | [4@L5] a1. = temp$1; {temp$1=111} 11 | [5@L6] x = a1.; {temp$1=111, x=111} 12 | [6@L7] temp$2 = new A; {temp$1=111, x=111} 13 | [7@L7] invokespecial temp$2.()>(); {temp$1=111, x=111} 14 | [8@L7] a2 = temp$2; {temp$1=111, x=111} 15 | [9@L8] temp$3 = 222; {temp$1=111, temp$3=222, x=111} 16 | [10@L8] a2. = temp$3; {temp$1=111, temp$3=222, x=111} 17 | [11@L9] y = a2.; {temp$1=111, temp$3=222, x=111, y=222} 18 | [12@L9] return; {temp$1=111, temp$3=222, x=111, y=222} 19 | 20 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/InstanceField.java: -------------------------------------------------------------------------------- 1 | class InstanceField { 2 | 3 | public static void main(String[] args) { 4 | A a1 = new A(); 5 | a1.f = 111; 6 | int x = a1.f; 7 | A a2 = new A(); 8 | a2.f = 222; 9 | int y = a2.f; 10 | } 11 | } 12 | 13 | class A { 14 | int f; 15 | } 16 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/Interprocedural2.java: -------------------------------------------------------------------------------- 1 | class Interprocedural2 { 2 | public static void main(String[] args) { 3 | X x = new X(); 4 | x.setF(123); 5 | int a = x.getF(); 6 | Y y = new Y(); 7 | y.setG(789); 8 | int b = y.getG(); 9 | } 10 | 11 | static class X { 12 | int f; 13 | 14 | int getF() { 15 | return f; 16 | } 17 | 18 | void setF(int f) { 19 | this.f = f; 20 | } 21 | } 22 | 23 | static class Y { 24 | int g; 25 | 26 | int getG() { 27 | return g; 28 | } 29 | 30 | void setG(int g) { 31 | this.g = g; 32 | } 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/MultiStores-inter-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- ()> (inter-constprop) -------------------- 2 | [0@L13] invokespecial %this.()>(); {} 3 | [1@L13] return; {} 4 | 5 | -------------------- (inter-constprop) -------------------- 6 | [0@L3] temp$0 = new A; {} 7 | [1@L3] invokespecial temp$0.()>(); {} 8 | [2@L3] a = temp$0; {} 9 | [3@L4] temp$1 = args.length; {temp$1=NAC} 10 | [4@L4] %intconst0 = 0; {%intconst0=0, temp$1=NAC} 11 | [5@L4] if (temp$1 > %intconst0) goto 7; {%intconst0=0, temp$1=NAC} 12 | [6@L4] goto 11; {%intconst0=0, temp$1=NAC} 13 | [7@L4] nop; {%intconst0=0, temp$1=NAC} 14 | [8@L5] temp$2 = 0; {%intconst0=0, temp$1=NAC, temp$2=0} 15 | [9@L5] a. = temp$2; {%intconst0=0, temp$1=NAC, temp$2=0} 16 | [10@L4] goto 14; {%intconst0=0, temp$1=NAC, temp$2=0} 17 | [11@L4] nop; {%intconst0=0, temp$1=NAC} 18 | [12@L7] temp$3 = 1; {%intconst0=0, temp$1=NAC, temp$3=1} 19 | [13@L7] a. = temp$3; {%intconst0=0, temp$1=NAC, temp$3=1} 20 | [14@L7] nop; {%intconst0=0, temp$1=NAC, temp$2=0, temp$3=1} 21 | [15@L9] x = a.; {%intconst0=0, temp$1=NAC, temp$2=0, temp$3=1, x=NAC} 22 | [16@L9] return; {%intconst0=0, temp$1=NAC, temp$2=0, temp$3=1, x=NAC} 23 | 24 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/MultiStores.java: -------------------------------------------------------------------------------- 1 | class MultiStores { 2 | public static void main(String[] args) { 3 | A a = new A(); 4 | if (args.length > 0) { 5 | a.f = 0; 6 | } else { 7 | a.f = 1; 8 | } 9 | int x = a.f; 10 | } 11 | } 12 | 13 | class A { 14 | int f; 15 | } 16 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/ObjSens.java: -------------------------------------------------------------------------------- 1 | class ObjSens { 2 | 3 | public static void main(String[] args) { 4 | X x1 = new X(); 5 | Y y1 = new Y(); 6 | x1.setY(y1); 7 | 8 | X x2 = new X(); 9 | Y y2 = new Y(); 10 | x2.setY(y2); 11 | 12 | Y yy1 = x1.getY(); 13 | yy1.f = 147; 14 | Y yy2 = x2.getY(); 15 | yy2.f = 258; 16 | int n = yy1.f; 17 | } 18 | } 19 | 20 | class X { 21 | 22 | private Y y; 23 | 24 | void setY(Y y) { 25 | this.y = y; 26 | } 27 | 28 | Y getY() { 29 | return y; 30 | } 31 | } 32 | 33 | class Y { 34 | int f; 35 | } 36 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/StaticField-inter-constprop-expected.txt: -------------------------------------------------------------------------------- 1 | -------------------- (inter-constprop) -------------------- 2 | [0@L6] temp$0 = 100; {temp$0=100} 3 | [1@L6] = temp$0; {temp$0=100} 4 | [2@L7] x = ; {temp$0=100, x=100} 5 | [3@L7] return; {temp$0=100, x=100} 6 | 7 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/StaticField.java: -------------------------------------------------------------------------------- 1 | class StaticField { 2 | 3 | static int f; 4 | 5 | public static void main(String[] args) { 6 | f = 100; 7 | int x = f; 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /A7/tai-e/src/test/resources/dataflow/constprop/alias/StaticFieldMultiStores.java: -------------------------------------------------------------------------------- 1 | class StaticFieldMultiStores { 2 | 3 | static int f; 4 | 5 | static int g; 6 | 7 | public static void main(String[] args) { 8 | storeConst(); 9 | storeNAC(); 10 | int x = f; 11 | int y = g; 12 | } 13 | 14 | static void storeConst() { 15 | if (getNAC() > 0) { 16 | f = 555; 17 | } else { 18 | f = 555; 19 | } 20 | } 21 | 22 | static void storeNAC() { 23 | if (getNAC() > 0) { 24 | g = 666; 25 | } else { 26 | g = 777; 27 | } 28 | } 29 | 30 | static int getNAC() { 31 | int i; 32 | for (i = 0; i < 5; ++i) { 33 | } 34 | return i; 35 | } 36 | } 37 | -------------------------------------------------------------------------------- /A8/tai-e/build.gradle.kts: -------------------------------------------------------------------------------- 1 | plugins { 2 | id("java") 3 | id("application") 4 | } 5 | 6 | repositories { 7 | mavenCentral() 8 | } 9 | 10 | dependencies { 11 | implementation(files("lib/tai-e-assignment.jar")) 12 | implementation(files("../../lib/dependencies.jar")) 13 | testImplementation("junit:junit:4.13") 14 | } 15 | 16 | application { 17 | mainClass.set("pascal.taie.Assignment") 18 | } 19 | 20 | tasks.compileJava { options.encoding = "UTF-8" } 21 | tasks.compileTestJava { options.encoding = "UTF-8" } 22 | 23 | tasks.test { 24 | useJUnit() 25 | maxHeapSize = "4G" 26 | } 27 | 28 | java { 29 | toolchain { 30 | languageVersion.set(JavaLanguageVersion.of(17)) 31 | } 32 | } 33 | 34 | val libDir = project.projectDir.parentFile.parentFile.resolve("lib") 35 | libDir.listFiles() 36 | ?.map { it.name } 37 | ?.toList() 38 | ?.containsAll(listOf("dependencies.jar", "rt.jar")) 39 | ?.takeIf { it } 40 | ?: throw IllegalStateException("Could not find dependencies.jar or rt.jar in ${libDir.absolutePath}") 41 | -------------------------------------------------------------------------------- /A8/tai-e/gradle/wrapper/gradle-wrapper.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A8/tai-e/gradle/wrapper/gradle-wrapper.jar -------------------------------------------------------------------------------- /A8/tai-e/gradle/wrapper/gradle-wrapper.properties: -------------------------------------------------------------------------------- 1 | distributionBase=GRADLE_USER_HOME 2 | distributionPath=wrapper/dists 3 | distributionUrl=https\://services.gradle.org/distributions/gradle-7.4-bin.zip 4 | zipStoreBase=GRADLE_USER_HOME 5 | zipStorePath=wrapper/dists 6 | -------------------------------------------------------------------------------- /A8/tai-e/lib/tai-e-assignment.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/A8/tai-e/lib/tai-e-assignment.jar -------------------------------------------------------------------------------- /A8/tai-e/plan.yml: -------------------------------------------------------------------------------- 1 | - id: cspta 2 | options: 3 | cs: ci 4 | merge-string-constants: false 5 | merge-string-objects: false 6 | merge-string-builders: false 7 | merge-exception-objects: true 8 | taint-config: src/test/resources/pta/taint/taint-config.yml 9 | action: dump 10 | file: null 11 | - id: cg 12 | options: 13 | algorithm: cspta 14 | action: dump 15 | file: null 16 | - id: class-dumper 17 | options: {} 18 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/Assignment.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie; 24 | 25 | import java.util.ArrayList; 26 | import java.util.Collections; 27 | import java.util.List; 28 | 29 | /** 30 | * Main class for assignments. 31 | */ 32 | public class Assignment { 33 | 34 | public static void main(String[] args) { 35 | if (args.length > 0) { 36 | List argList = new ArrayList<>(); 37 | Collections.addAll(argList, "-pp", "-p", "plan.yml"); 38 | Collections.addAll(argList, args); 39 | Main.main(argList.toArray(new String[0])); 40 | } else { 41 | System.out.println("Usage: -cp -m "); 42 | } 43 | } 44 | } 45 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/graph/callgraph/CallKind.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.graph.callgraph; 24 | 25 | public enum CallKind { 26 | // regular calls 27 | INTERFACE, 28 | VIRTUAL, 29 | SPECIAL, 30 | STATIC, 31 | DYNAMIC, 32 | /** 33 | * Non-regular calls, such calls are typically handled 34 | * by pointer analysis plugins. 35 | */ 36 | OTHER, 37 | } 38 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/context/Context.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.context; 24 | 25 | /** 26 | * Representation of contexts in context-sensitive pointer analysis. 27 | * Each context can be seen as a list of zero or more context elements. 28 | */ 29 | public interface Context { 30 | 31 | /** 32 | * @return the length (i.e., the number of elements) of this context. 33 | */ 34 | int getLength(); 35 | 36 | /** 37 | * @return the i-th element of this context. Starts from 0. 38 | */ 39 | Object getElementAt(int i); 40 | } 41 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/AbstractPointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.pts.PointsToSet; 26 | 27 | abstract class AbstractPointer implements Pointer { 28 | 29 | private PointsToSet pointsToSet; 30 | 31 | @Override 32 | public PointsToSet getPointsToSet() { 33 | return pointsToSet; 34 | } 35 | 36 | @Override 37 | public void setPointsToSet(PointsToSet pointsToSet) { 38 | this.pointsToSet = pointsToSet; 39 | } 40 | 41 | } 42 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/CSElement.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.core.cs.context.Context; 26 | 27 | /** 28 | * Context-sensitive elements. Each element is associate with a context. 29 | */ 30 | public interface CSElement { 31 | 32 | /** 33 | * @return the context of the context-sensitive element. 34 | */ 35 | Context getContext(); 36 | } 37 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/core/cs/element/Pointer.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.cs.element; 24 | 25 | import pascal.taie.analysis.pta.pts.PointsToSet; 26 | import pascal.taie.language.type.Type; 27 | 28 | /** 29 | * Represents all pointers (nodes) in context-sensitive 30 | * pointer analysis (pointer flow graph). 31 | */ 32 | public interface Pointer { 33 | 34 | /** 35 | * @return the points-to set associated with the pointer. 36 | */ 37 | PointsToSet getPointsToSet(); 38 | 39 | /** 40 | * Sets the associated points-to set of the pointer. 41 | */ 42 | void setPointsToSet(PointsToSet pointsToSet); 43 | 44 | /** 45 | * @return the type of this pointer 46 | */ 47 | Type getType(); 48 | } 49 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/core/heap/HeapModel.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.core.heap; 24 | 25 | import pascal.taie.ir.exp.ReferenceLiteral; 26 | import pascal.taie.ir.stmt.New; 27 | 28 | /** 29 | * Represents of heap models for heap objects. 30 | */ 31 | public interface HeapModel { 32 | 33 | /** 34 | * @return the abstract object for given new statement. 35 | */ 36 | Obj getObj(New allocSite); 37 | 38 | /** 39 | * @return the constant object for given value. 40 | */ 41 | Obj getConstantObj(ReferenceLiteral value); 42 | } 43 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/plugin/taint/Sink.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.plugin.taint; 24 | 25 | import pascal.taie.language.classes.JMethod; 26 | 27 | /** 28 | * Represents a sink that consists of a sink method and 29 | * a sensitive index. 30 | */ 31 | record Sink(JMethod method, int index) { 32 | 33 | @Override 34 | public String toString() { 35 | return method + "/" + index; 36 | } 37 | } 38 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/analysis/pta/plugin/taint/Source.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.analysis.pta.plugin.taint; 24 | 25 | import pascal.taie.language.classes.JMethod; 26 | import pascal.taie.language.type.Type; 27 | 28 | /** 29 | * Represents a source that consists of a source method and 30 | * type of taint object. 31 | */ 32 | record Source(JMethod method, Type type) { 33 | 34 | @Override 35 | public String toString() { 36 | return method + "(" + type + ")"; 37 | } 38 | } 39 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/ir/stmt/ArrayStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | 29 | abstract class ArrayStmt extends AssignStmt { 30 | 31 | ArrayStmt(L lvalue, R rvalue) { 32 | super(lvalue, rvalue); 33 | } 34 | 35 | public abstract ArrayAccess getArrayAccess(); 36 | } 37 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/ir/stmt/Copy.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.Var; 26 | 27 | /** 28 | * Representation of copy statement, e.g., a = b. 29 | */ 30 | public class Copy extends AssignStmt { 31 | 32 | public Copy(Var lvalue, Var rvalue) { 33 | super(lvalue, rvalue); 34 | } 35 | 36 | @Override 37 | public T accept(StmtVisitor visitor) { 38 | return visitor.visit(this); 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/ir/stmt/FieldStmt.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.FieldAccess; 26 | import pascal.taie.ir.exp.LValue; 27 | import pascal.taie.ir.exp.RValue; 28 | import pascal.taie.ir.proginfo.FieldRef; 29 | 30 | /** 31 | * Load/Store field statements. 32 | */ 33 | public abstract class FieldStmt extends AssignStmt { 34 | 35 | FieldStmt(L lvalue, R rvalue) { 36 | super(lvalue, rvalue); 37 | } 38 | 39 | public abstract FieldAccess getFieldAccess(); 40 | 41 | public FieldRef getFieldRef() { 42 | return getFieldAccess().getFieldRef(); 43 | } 44 | 45 | public boolean isStatic() { 46 | return getFieldRef().isStatic(); 47 | } 48 | } 49 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/ir/stmt/LoadArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of load array statement, e.g., x = a[..]. 30 | */ 31 | public class LoadArray extends ArrayStmt { 32 | 33 | public LoadArray(Var lvalue, ArrayAccess rvalue) { 34 | super(lvalue, rvalue); 35 | rvalue.getBase().addLoadArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getRValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A8/tai-e/src/main/java/pascal/taie/ir/stmt/StoreArray.java: -------------------------------------------------------------------------------- 1 | /* 2 | * Tai-e: A Static Analysis Framework for Java 3 | * 4 | * Copyright (C) 2022 Tian Tan 5 | * Copyright (C) 2022 Yue Li 6 | * 7 | * This file is part of Tai-e. 8 | * 9 | * Tai-e is free software: you can redistribute it and/or modify 10 | * it under the terms of the GNU Lesser General Public License 11 | * as published by the Free Software Foundation, either version 3 12 | * of the License, or (at your option) any later version. 13 | * 14 | * Tai-e is distributed in the hope that it will be useful,but WITHOUT 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY 16 | * or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General 17 | * Public License for more details. 18 | * 19 | * You should have received a copy of the GNU Lesser General Public 20 | * License along with Tai-e. If not, see . 21 | */ 22 | 23 | package pascal.taie.ir.stmt; 24 | 25 | import pascal.taie.ir.exp.ArrayAccess; 26 | import pascal.taie.ir.exp.Var; 27 | 28 | /** 29 | * Representation of store array statement, e.g., a[..] = x. 30 | */ 31 | public class StoreArray extends ArrayStmt { 32 | 33 | public StoreArray(ArrayAccess lvalue, Var rvalue) { 34 | super(lvalue, rvalue); 35 | lvalue.getBase().addStoreArray(this); 36 | } 37 | 38 | @Override 39 | public ArrayAccess getArrayAccess() { 40 | return getLValue(); 41 | } 42 | 43 | @Override 44 | public T accept(StmtVisitor visitor) { 45 | return visitor.visit(this); 46 | } 47 | } 48 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/ArgToResult.java: -------------------------------------------------------------------------------- 1 | class ArgToResult { 2 | 3 | public static void main(String[] args) { 4 | String taint = SourceSink.source(); 5 | String s1 = new String(); 6 | String s2 = s1.concat(taint); 7 | SourceSink.sink(s2); // taint 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/BaseToResult.java: -------------------------------------------------------------------------------- 1 | class BaseToResult { 2 | 3 | public static void main(String[] args) { 4 | String taint = SourceSink.source(); 5 | String s1 = new String(); 6 | String s2 = taint.concat(s1); 7 | SourceSink.sink(s2); // taint 8 | } 9 | } 10 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/InterTaintTransfer.java: -------------------------------------------------------------------------------- 1 | class InterTaintTransfer { 2 | 3 | public static void main(String[] args) { 4 | String t1 = SourceSink.source(); 5 | String t2 = SourceSink.source(); 6 | String t3 = SourceSink.source(); 7 | String s = new String(); 8 | SourceSink.sink(transfer(t1, s)); 9 | SourceSink.sink(transfer(t2, s)); 10 | SourceSink.sink(transfer(s, t3)); 11 | } 12 | 13 | static String transfer(String s1, String s2) { 14 | return s1.concat(s2); 15 | } 16 | } 17 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/OneCallTaint.java: -------------------------------------------------------------------------------- 1 | class OneCallTaint { 2 | public static void main(String args[]) { 3 | String s1 = new String(); //s1 safe 4 | String s2 = SourceSink.source(); //s2 not safe 5 | 6 | String ss1 = identity(s1); //ss1 safe, but ci mix s2 in ss1. 7 | String ss2 = identity(s2);// ss2 not safe 8 | 9 | SourceSink.sink(ss1); 10 | 11 | } 12 | 13 | static String identity(String s) { 14 | return s; 15 | } 16 | 17 | } -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/SimpleTaint.java: -------------------------------------------------------------------------------- 1 | class SimpleTaint { 2 | 3 | public static void main(String[] args) { 4 | String s1 = SourceSink.source(); 5 | SourceSink.sink(s1); // taint 6 | 7 | String s2 = SourceSink.source(); 8 | SourceSink.sink(s2); // taint 9 | 10 | String s3 = args == null ? s1 : s2; 11 | SourceSink.sink(s3, 0); // 2 taints 12 | 13 | SourceSink.sink(s3, new String()); // no taint 14 | } 15 | } 16 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/SourceSink.java: -------------------------------------------------------------------------------- 1 | class SourceSink { 2 | 3 | static String source() { 4 | return new String(); 5 | } 6 | 7 | static void sink(String s) { 8 | } 9 | 10 | static void sink(String s, int n) { 11 | } 12 | 13 | static void sink(String s1, String s2) { 14 | } 15 | 16 | static String sourceAndSink(String s1, String s2) { 17 | return new String(); 18 | } 19 | } 20 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/StringAppend.java: -------------------------------------------------------------------------------- 1 | class StringAppend { 2 | 3 | public static void main(String[] args) { 4 | stringAdd(); 5 | stringBuffer(); 6 | stringBuilder(); 7 | } 8 | 9 | static void stringAdd() { 10 | String taint = SourceSink.source(); 11 | String s = "abc" + taint + "xyz"; 12 | SourceSink.sink(s); 13 | } 14 | 15 | static void stringBuffer() { 16 | String taint = SourceSink.source(); 17 | StringBuffer sb = new StringBuffer(); 18 | sb.append("abc"); 19 | sb.append(taint); 20 | sb.append("xyz"); 21 | String s = sb.toString(); 22 | SourceSink.sink(s); // taint 23 | } 24 | 25 | static void stringBuilder() { 26 | String taint = SourceSink.source(); 27 | StringBuilder sb = new StringBuilder(); 28 | sb.append("abc"); 29 | sb.append(taint); 30 | sb.append("xyz"); 31 | String s = sb.toString(); 32 | SourceSink.sink(s); // taint 33 | } 34 | } 35 | -------------------------------------------------------------------------------- /A8/tai-e/src/test/resources/pta/taint/TaintInList.java: -------------------------------------------------------------------------------- 1 | class TaintInList { 2 | 3 | public static void main(String[] args) { 4 | StringList l1 = new StringList(); 5 | l1.add(SourceSink.source()); 6 | String s1 = l1.get(0); 7 | SourceSink.sink(s1); 8 | 9 | StringList l2 = new StringList(); 10 | l2.add(new String()); 11 | String s2 = l2.get(0); 12 | SourceSink.sink(s2); 13 | } 14 | } 15 | 16 | class StringList { 17 | 18 | private String[] elements = new String[10]; 19 | 20 | private int size = 0; 21 | 22 | void add(String s) { 23 | ensureCapacity(size + 1); 24 | elements[size++] = s; 25 | } 26 | 27 | private void ensureCapacity(int capacity) { 28 | if (capacity > elements.length) { 29 | String[] tmp = new String[elements.length * 2]; 30 | for (int i = 0; i < elements.length) { 31 | tmp[i] = elements[i]; 32 | } 33 | elements = tmp; 34 | } 35 | } 36 | 37 | String get(int i) { 38 | return elements[i]; 39 | } 40 | } 41 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 |
2 | 3 | 4 | 5 | 6 | ## Tai-e Assignments for Static Program Analysis 7 |
8 | 9 | ### Getting Started 10 | 11 | If you want to do the assignments, please start with "*Overview of Tai-e Assignments*" [[中文](https://tai-e.pascal-lab.net/intro/overview.html)][[English](https://tai-e.pascal-lab.net/en/intro/overview.html)]. 12 | -------------------------------------------------------------------------------- /lib/dependencies.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/lib/dependencies.jar -------------------------------------------------------------------------------- /lib/rt.jar: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/lxy417/software-analysis/a0acd36964a11019939ac7a9911f3e2e91ae739b/lib/rt.jar --------------------------------------------------------------------------------