Re: Escape analysis

[Navindra Umanee <navindra@cs.mcgill.ca>]

Hi Archie,

Archie Cobbs <archie@dellroad.org> wrote:
> I'm looking for a basic, high level description of the most appropriate
> way to do this, e.g., which Soot tools to use, and maybe some example
> code to look at performing some similar task.

I'm not really an expert at this but I'll take a stab at it, and
hopefully someone will correct me if I'm wrong.

First, for better than the worst case conservative results, you'd have
to run Soot in whole-program mode.  From the command-line, something
like this should do:

soot.Main -w -p cg.spark on ...

Then, you probably want to retrieve the PointsToAnalysis with:

Scene.v().getPointsToAnalysis()

and maybe the SideEffectAnalysis with:

Scene.v().getSideEffectAnalysis()

Instead of SideEffectAnalysis, you might be better off with a
SideEffectTester:

new PASideEffectTester()

If you haven't seen it already, you might want to check Ondrej's
thesis at this point (it documents Spark, which is the framework you
want to use here):
http://www.sable.mcgill.ca/publications/thesis/#olhotakMastersThesis

although you can probably get by with just the API documentation:

http://www.sable.mcgill.ca/soot/doc/soot/PointsToAnalysis.html
http://www.sable.mcgill.ca/soot/doc/soot/jimple/toolkits/pointer/SideEffectAnalysis.html
http://www.sable.mcgill.ca/soot/doc/soot/SideEffectTester.html

> I'm interested in doing a simple analysis of Jimple bodies for escape
> analysis. Specifically, for each "new" statement in a method body,
> I'd like to determine if any of the following is true of the newly
> created object.

I'm not really sure that you can do this on an object by object basis
with the PointsToSets that you get from Spark.

What you could do is retrieve the PointsToSet for the local to which
the newly created object was assigned and use that for comparisons,
although this'll give you less precision.

Otherwise, I'm guessing it's a bit more involved.

>   - it can be assigned to any field (static or instance)
>   - it can be assigned to an element of an array
>   - it can be returned or thrown

Brute force, I think it's a matter of getting the various relevant
points-to sets from PointsToAnalsis and then checking for overlap.

>   - it can be passed as a parameter to any method

SideEffectTester on all parameters...

>   - the "new" statement is possibly within some execution loop (*)

Yeah, that's an interesting question.  You might want to take a look
at Jennifer's LoopFinder in Soot trunk for some ideas.

I'd be interested to know if you make good progress or have any
insights on any of this.

Cheers,
Navin.