soot-oss / soot

Soot - A Java optimization framework
GNU Lesser General Public License v2.1
2.87k stars 706 forks source link

Redundant cast statement(expression) in generated Jimple codes #2082

Open XYHyouKa opened 4 months ago

XYHyouKa commented 4 months ago

The constructor of the generated Jimple codes contain redundant type conversion statements. I have attempted multiple times to output the original class bytes processed by Soot and the generated Jimple code, with the following results:

... other contents ...

public class org.bouncycastle.jcajce.provider.digest.Keccak$Mappings extends org.bouncycastle.jcajce.provider.digest.DigestAlgorithmProvider

... other contents ...

  public org.bouncycastle.jcajce.provider.digest.Keccak$Mappings();
    descriptor: ()V
    flags: ACC_PUBLIC
    Code:
      stack=1, locals=1, args_size=1
         0: aload_0
         1: invokespecial #91                 // Method org/bouncycastle/jcajce/provider/digest/DigestAlgorithmProvider."<init>":()V
         4: return
public class org.bouncycastle.jcajce.provider.digest.Keccak$Mappings extends org.bouncycastle.jcajce.provider.digest.DigestAlgorithmProvider
{
... other contents ...

    public void <init>()
    {
        org.bouncycastle.jcajce.provider.digest.Keccak$Mappings l0;
        org.bouncycastle.jcajce.provider.digest.DigestAlgorithmProvider $r0;

        l0 := @this: org.bouncycastle.jcajce.provider.digest.Keccak$Mappings;

        $r0 = (org.bouncycastle.jcajce.provider.digest.DigestAlgorithmProvider) l0;

        specialinvoke $r0.<org.bouncycastle.jcajce.provider.digest.DigestAlgorithmProvider: void <init>()>();

        return;
    }

... other contents ...
}

Extra Local is used in the Jimple code for type conversion before invoking the constructor of the superclass. This step is unnecessary, and leads to the following error after transformed back to class:

java.lang.VerifyError: Bad type on operand stack
Exception Details:
  Location:
    org/bouncycastle/jcajce/provider/digest/Keccak$Mappings.<init>()V @6: checkcast
  Reason:
    Type uninitializedThis (current frame, stack[0]) is not assignable to 'java/lang/Object'
  Current Frame:
    bci: @6
    flags: { flagThisUninit }
    locals: { uninitializedThis }
    stack: { uninitializedThis }
  Bytecode:
    0x0000000: 1226 b800 132a c000 04b7 0028 b1

Corresponding class constructor:

  public org.bouncycastle.jcajce.provider.digest.Keccak$Mappings();
    descriptor: ()V
    flags: ACC_PUBLIC
    Code:
      stack=1, locals=1, args_size=1
         0: ldc           #38                 // String <org.bouncycastle.jcajce.provider.digest.Keccak$Mappings: void <init>()>
         2: invokestatic  #19                 // Method */**/***.procInvoke:(Ljava/lang/String;)V
         5: aload_0
         6: checkcast     #4                  // class org/bouncycastle/jcajce/provider/digest/DigestAlgorithmProvider
         9: invokespecial #40                 // Method org/bouncycastle/jcajce/provider/digest/DigestAlgorithmProvider."<init>":()V
        12: return

Since this issue occurs in a private environment that is difficult to debug, I tried invoking the class in another project using a similar approach (reflection). However, in this environment, the Jimple generated by Soot does not produce any exceptions, making it impossible to replicate the error.

I would like to know if there are any mechanisms or features in SootClassBuilder, MethodBuilder, AsmMethodSource or others causing modifications to constructors during Jimple code generation. It may help me solve this issue. Thank you!

Problematic dependencies and versions (currently unable to replicate):

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcpkix-jdk15on</artifactId>
    <version>1.64</version>
</dependency>
<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-jdk15on</artifactId>
    <version>1.64</version>
 </dependency>