Fix a soot runtime block while resolving assigned expression type

Calculate the ancestor types from androidx.fragment.app.FragmentActivity and com.ss.android.ugc.aweme.compliance.privacy.sdk.ui.BasePrivacySettingFragment(base/interface from androidx.fragment.app.Fragment) by soot.jimple.toolkits.typing.fast.BytecodeHierarchy.lcas_(Type a, Type b), it will find five count.

And here we have eight expressions like below as same as. // 'this' is the instance of com.ss.android.ugc.aweme.compliance.privacy.sdk.ui.BasePrivacySettingFragment，'activity' has the class type androidx.fragment.app.FragmentActivity .

ViewModelProvider(activity ?: this)

According to the process of TypeResolver, when there are two types of the same assignment object A, it will add a new branch for parsing. According to the above explanation, there will be (5 5 5 5 5 5 5 * 5 = 390625) branches at this time, resulting in program blocking.

              if (/* (eval.size() == 1 && lcas.size() == 1) || */isFirstType) {
                // The types agree, we have a type we can directly use
                tg_ = tg;
                wl_ = wl;
              } else {
                // The types do not agree, add all supertype candidates
                tg_ = typingStrategy.createTyping(tg);
                wl_ = (BitSet) wl.clone();
                WorklistElement e = new WorklistElement(tg_, wl_);

                sigma.add(e);
              }

How to fix

I record current selected type decision and apply it at the next time if there has the same subtypes.

But, I have the same issues refer to: https://github.com/soot-oss/soot/issues/1053 https://github.com/soot-oss/soot/issues/1906

soot-oss / soot

Fix a soot runtime block while resolving assigned expression type #2001

How to fix