search

pascal-lab / Tai-e

An easy-to-learn/use static analysis framework for Java
https://tai-e.pascal-lab.net/docs/index.html
GNU Lesser General Public License v3.0
1.32k stars 172 forks source link

How to dump call graph, pointer flow graph, and points-to set? #111

Closed koushik0329 closed 1 week ago

koushik0329 commented 2 weeks ago

Overall Description

Hello sir,

We have been using Tai-e and tried running the command to generate a .dot file. Here is the original command we used: java -cp tai-e-all.jar pascal.taie.Main -cp foo.jar;bar.jar -m baz.Main -java 8 -a pta=cs:2-type;time-limit:60

For our project, we modified the command as follows: java -cp tai-e-all-0.2.2.jar pascal.taie.Main -cp Person1.jar -m Person -java 8 -a pta=advanced:zipper-e;dump:true

the output is 8 -a pta=advanced:zipper-e;dump:true Tai-e starts ... Output directory: /home/koushik/O2PTA/tests/zipper_direct_flow/output Writing options to /home/koushik/O2PTA/tests/zipper_direct_flow/output/options.yml WARNING: sun.reflect.Reflection.getCallerClass is not supported. This will impact performance. Writing log to /home/koushik/O2PTA/tests/zipper_direct_flow/output/tai-e.log Writing analysis plan to /home/koushik/O2PTA/tests/zipper_direct_flow/output/tai-e-plan.yml WorldBuilder starts ... 6699 classes with 64241 methods in the world WorldBuilder finishes, elapsed time: 4.24s pta starts ... [Pointer analysis] elapsed time: 23.21s -------------- Pointer analysis statistics: --------------

var pointers: 5,7955 (insens) / 5,7955 (sens)

objects: 6380 (insens) / 6380 (sens)

var points-to: 386,4368 (insens) / 386,4368 (sens)

static field points-to: 8396 (sens)

instance field points-to: 83,4823 (sens)

array points-to: 16,3107 (sens)

reachable methods: 8307 (insens) / 8307 (sens)

call graph edges: 4,5913 (insens) / 4,5913 (sens)

Zipper starts ... Building OAG starts ... Building OAG finishes, elapsed time: 0.82s Building PCE starts ... Building PCE finishes, elapsed time: 0.61s 68881 nodes in OFG 215102 edges in OFG Building and analyzing PFG starts ... Building and analyzing PFG finishes, elapsed time: 2.09s

types: 1092

avg. nodes in PFG: 439

avg. edges in PFG: 1248

precision-critical methods: 1522

Zipper finishes, elapsed time: 4.13s [Pointer analysis] elapsed time: 3.69s -------------- Pointer analysis statistics: --------------

var pointers: 5,7955 (insens) / 5,7955 (sens)

objects: 6380 (insens) / 6380 (sens)

var points-to: 386,4368 (insens) / 386,4368 (sens)

static field points-to: 8396 (sens)

instance field points-to: 83,4823 (sens)

array points-to: 16,3107 (sens)

reachable methods: 8307 (insens) / 8307 (sens)

call graph edges: 4,5913 (insens) / 4,5913 (sens)

pta finishes, elapsed time: 33.43s Tai-e finishes, elapsed time: 38.02s dump:true: command not found

Thank you for your assistance. Best regards, Koushik Reddy Kambham

Expected Behavior

In the output folder, we found .yml files instead of the expected .dot files. Could you please guide us on how to generate the .dot file using Tai-e?

Current Behavior

In the output folder, we found .yml files instead of the expected .dot files. Could you please guide us on how to generate the .dot file using Tai-e?

Tai-e Arguments

Click here to see Tai-e Options ```yaml {{The content of 'output/options.yml' file}} ```
Click here to see Tai-e Analysis Plan ```yaml {{The content of 'output/tai-e-plan.yml' file}} ```

We have been using Tai-e and tried running the command to generate a .dot file. Here is the original command we used: java -cp tai-e-all.jar pascal.taie.Main -cp foo.jar;bar.jar -m baz.Main -java 8 -a pta=cs:2-type;time-limit:60

For our project, we modified the command as follows: java -cp tai-e-all-0.2.2.jar pascal.taie.Main -cp Person1.jar -m Person -java 8 -a pta=advanced:zipper-e;dump:true

Tai-e Log

Click here to see Tai-e Log ``` {{The content of 'output/tai-e.log' file}} ```

We have been using Tai-e and tried running the command to generate a .dot file. Here is the original command we used: java -cp tai-e-all.jar pascal.taie.Main -cp foo.jar;bar.jar -m baz.Main -java 8 -a pta=cs:2-type;time-limit:60

For our project, we modified the command as follows: java -cp tai-e-all-0.2.2.jar pascal.taie.Main -cp Person1.jar -m Person -java 8 -a pta=advanced:zipper-e;dump:true

Additional Information

No response

zhangt2333 commented 2 weeks ago

Could you specify which details you would like to include in the .dot file? Tai-e currently supports the following graphs:

Additionally, we highly recommend using the latest version of Tai-e (v0.5.1-SNAPSHOT). A stable version will be available shortly.

koushik0329 commented 2 weeks ago

Call Graph and constraint graph

zhangt2333 commented 2 weeks ago

If you want to dump Call Graph to disk, please refer to this comment: https://github.com/pascal-lab/Tai-e/issues/112#issuecomment-2223076630.

Regarding the constraint graph, are you referring to constraints such as the statement x=y generating the constraint pts(y) ⊆ pts(x)?

koushik0329 commented 2 weeks ago

Yes that's the constraint graph

koushik0329 commented 2 weeks ago

And also can you help me on how to dump points-to set of all variables ?

zhangt2333 commented 2 weeks ago

Yes that's the constraint graph

Currently, Tai-e does not support dumping the PointerFlowGraph using the existing options. However, you can achieve this manually according to the following example:

public static void main(String[] args) throws Exception {
    pascal.taie.Main.main(
            "-pp",
            "-cp", "src/test/resources/pta/basic",
            "-m", "New",
            "-a", "pta=implicit-entries:false;only-app:true;dump:true;"
    );
    // access PointerFlowGraph through reflection as it is not publicly exposed now
    PointerAnalysisResult result = World.get().getResult(PointerAnalysis.ID);
    Field pfgField = Class.forName("pascal.taie.analysis.pta.PointerAnalysisResultImpl")
            .getDeclaredField("pfg");
    pfgField.setAccessible(true);
    PointerFlowGraph pfg = (PointerFlowGraph) pfgField.get(result);
    // dump the PointerFlowGraph
    new DotDumper().dump(pfg, new File(World.get().getOptions()
            .getOutputDir(), "pfg.dot"));
}

And also can you help me on how to dump points-to set of all variables ?

To do this, use the following option: "-a", "pta=dump:true;" (-a "pta=dump:true;")

For more details, refer to the Tai-e documentation on specific analysis options. The relevant pta analysis option can be found in https://github.com/pascal-lab/Tai-e/blob/af7ae19ac4b5fb5f495bcd3aebe584775d7bfb6d/src/main/resources/tai-e-analyses.yml#L23-L25

koushik0329 commented 1 week ago

Thank you very much for your patience. It helped me a lot.