Skip to content

An inconsistent behavior in Soot analysis #2067

Description

@tisble

Describe the bug
Hi, I found a code example which can help improving Soot. See the minimized code example below.

The inconsistency is the call graph edge from A.foo() to B.foo(). When the method A.bar() is commented out, this edge is not reported, however, when this method is uncommented, this edge will appear in the results.

Actually, the method A.bar() definitely should not affect this call edge. So, I think this is an inconsistency bug.
Input file

public class A extends B {
    protected String bar() {
        return "";
    }
    @Override
    public boolean foo() {
        return super.foo();
    }
}
abstract class B {
    public boolean foo() {
        return true;
    }
}

To reproduce
I use the following code to setup and generate the call graph via RTA algorithm:

Transform transform = new Transform("cg.spark", null);
PhaseOptions.v().setPhaseOption("cg.spark", "on");
PhaseOptions.v().setPhaseOption("cg.spark", "rta:true");
PhaseOptions.v().setPhaseOption("cg.spark", "types-for-sites:true");
PhaseOptions.v().setPhaseOption("cg.spark", "on-fly-cg:false");
Map<String, String> phaseOptions = PhaseOptions.v().getPhaseOptions(transform);
SparkTransformer.v().transform(transform.getPhaseName(), phaseOptions);
PackManager.v().runPacks();

My Soot version is 4.5.0.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions