class hierarchy complementation: soundly completing a
TRANSCRIPT
![Page 1: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/1.jpg)
Class Hierarchy Complementation:Soundly Completing a Partial Type
Graph
George BalatsourasYannis Smaragdakis
University of AthensOOPSLA 2013
![Page 2: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/2.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 2G. Balatsouras
Motivation: Static Analysis● Static Analysis using the Doop framework
– Analyzes Java programs– Uses Soot to analyze bytecode– Whole-program analysis– External dependencies– Missing libraries / class defs
PHANTOM CLASSESLIB AINPUT LIB B
usesuses
![Page 3: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/3.jpg)
3Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Motivation: Static Analysis
How do I modify the code in order to enable soot to continue loading a class even if it doesn’t find some of it[s] references? Can I create a dummy soot class so it can continue with the load? How?
Soot FAQ
![Page 4: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/4.jpg)
4Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Motivation: Static Analysis
How do I modify the code in order to enable soot to continue loading a class even if it doesn’t find some of it[s] references? Can I create a dummy soot class so it can continue with the load? How?
Soot FAQ
“You can try -use-phantom-refs but often that does not work because not all analyses can cope with such references.„
![Page 5: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/5.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 5G. Balatsouras
Complementation Problem
Partial Program
Complete Program●Valid Java bytecode●JVM Standard●Verifiable
???
+Phantom Classes
![Page 6: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/6.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 7G. Balatsouras
Complementation Problem
Partial Program
Complete Program●Valid Java bytecode●JVM Standard●VerifiableJPhantom
+Phantom Classes
![Page 7: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/7.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 8G. Balatsouras
JPhantom: Approach
1. Detect every phantom reference
2. Generate minimal classes (empty method bodies) that respect the:
i. referenced member signaturesii. implied type hierarchy
![Page 8: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/8.jpg)
9Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Motivating Example
public void foo(X, Y) : aload_2 // load 2nd arg (Y) into stack aload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
X, Y, Z phantom classes
![Page 9: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/9.jpg)
10Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 1
public void foo(X, Y) : aload_2 // load 2nd arg (Y) into stack aload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
![Page 10: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/10.jpg)
11Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 2
public void foo(X, Y) : Yaload_2 // load 2nd arg (Y) into stack aload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
![Page 11: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/11.jpg)
12Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 3
public void foo(X, Y) : Xaload_2 // load 2nd arg (Y) into stack Yaload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
![Page 12: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/12.jpg)
13Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 3
public void foo(X, Y) : Xaload_2 // load 2nd arg (Y) into stack Yaload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
Constraints● X has to be a class (and not an interface).● X has to provide a method: Z bar(A)● Y has to be a subtype of A
Method bar:● expects an argument of type A● receives an argument of type Y
upcast
![Page 13: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/13.jpg)
14Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 4
public void foo(X, Y) : Zaload_2 // load 2nd arg (Y) into stack aload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
ConstraintsX has to be a class (and not an interface).X has to provide a method: Z bar(A)Y has to be a subtype of A
![Page 14: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/14.jpg)
15Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 4
public void foo(X, Y) : Zaload_2 // load 2nd arg (Y) into stack aload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
Constraints● X has to be a class (and not an interface).● X has to provide a method: Z bar(A)● Y has to be a subtype of A● Z has to be a subtype of B
Method baz:● declares a receiver of type B● is called by an object of type Z
![Page 15: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/15.jpg)
16Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Symbolic Execution: Step 5
public void foo(X, Y) : aload_2 // load 2nd arg (Y) into stack aload_1 // load 1st arg (X) into stack
invokevirtual `Z X.bar(A)`
invokevirtual `void B.baz()`...
StackX, Y, Z phantom classes
Constraints● X has to be a class (and not an interface).● X has to provide a method: Z bar(A)● Y has to be a subtype of A● Z has to be a subtype of B
![Page 16: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/16.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 17G. Balatsouras
Hierarchy Complementation
Partial Type Graph
Complete Hierarchy
JPhantom
+subtyping constraints
E.g., <A> has to be a (transitive) subtype of <B>
![Page 17: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/17.jpg)
Multiple Inheritance
![Page 18: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/18.jpg)
Multiple InheritanceWait a minute. Aren't we talking about Java?
![Page 19: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/19.jpg)
Multiple InheritanceWait a minute. Aren't we talking about Java?
Interfaces
![Page 20: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/20.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 21G. Balatsouras
Multiple Inheritance Problem
Known Class
Phantom Class
Direct Edge
Path Edge
Input Output
DAGConstraint Graph
Cannot alter outgoing edges of known nodes
![Page 21: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/21.jpg)
22Class Hierarchy Complementation: Soundly Completing a Partial Type GraphG. Balatsouras
Projection Sets
●The phantom projection set of A is {B,C,D}.
●In order to satisfy path-edge (A,E) we can either add an edge (B,E), (C,E), or (D,E).
Known Class
Phantom Class
Direct Edge
Path Edge
![Page 22: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/22.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 23G. Balatsouras
Multiple Inheritance
● Stratification exists for any solution
● Edges facing upwards property
– No cycles
Key Idea
Solution
strata
![Page 23: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/23.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 24G. Balatsouras
Multiple Inheritance
● Construct valid stratification iteratively
– Keep nodes at minimum height– Keep edges facing upwards– Advance node only to satisfy constraint– Fixpoint
● Add upward edges to satisfy path constraints
Algorithm
![Page 24: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/24.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 25G. Balatsouras
Multiple Inheritance Example
Step 1 Known Class
Phantom Class
Direct Edge
Path Edge
![Page 25: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/25.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 26G. Balatsouras
Multiple Inheritance Example
Step 1 Known Class
Phantom Class
Direct Edge
Path Edge
Random?
![Page 26: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/26.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 27G. Balatsouras
Multiple Inheritance Example
Step 1 Known Class
Phantom Class
Direct Edge
Path Edge
Random?
Not really.Happens to be topologically sorted.
![Page 27: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/27.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 28G. Balatsouras
Multiple Inheritance Example
Step 1 Known Class
Phantom Class
Direct Edge
Path EdgeIsn't that enough?
Happens to be topologically sorted.
![Page 28: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/28.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 29G. Balatsouras
Multiple Inheritance Example
Step 1 Known Class
Phantom Class
Direct Edge
Path EdgeIsn't that enough?
Happens to be topologically sorted.
Path-edge (A,B) cannot be satisfied since both C and E are after B.
![Page 29: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/29.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 30G. Balatsouras
Multiple Inheritance Example
Step 1 Known Class
Phantom Class
Direct Edge
Path EdgeIsn't that enough?
Happens to be topologically sorted.
Path-edge (A,B) cannot be satisfied since both C and E are after B.
NO!!
![Page 30: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/30.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 31G. Balatsouras
Multiple Inheritance Example
Step 1✗ All nodes except A, and D have incoming
(horizontal) egdes
Known Class
Phantom Class
Direct Edge
Path Edge
![Page 31: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/31.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 32G. Balatsouras
Multiple Inheritance Example
A
B
D
FE C
Step 2 Known Class
Phantom Class
Direct Edge
Path Edge
![Page 32: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/32.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 33G. Balatsouras
Multiple Inheritance Example
A
B
D
FE C
Step 2✗ Nodes C, F have incoming (horizontal) egdes✗ Node B is not yet higher than neither C nor E
Known Class
Phantom Class
Direct Edge
Path Edge
![Page 33: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/33.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 34G. Balatsouras
Multiple Inheritance Example
A
B
D
F
E
C
Step 3 Known Class
Phantom Class
Direct Edge
Path Edge
![Page 34: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/34.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 35G. Balatsouras
Multiple Inheritance Example
A
B
D
F
E
C
Step 3✗ Nodes C, F have
incoming (horizontal) egdes
Known Class
Phantom Class
Direct Edge
Path Edge
![Page 35: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/35.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 36G. Balatsouras
Multiple Inheritance Example
A
B
D
F
E
CStep 4 Known Class
Phantom Class
Direct Edge
Path Edge
![Page 36: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/36.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 37G. Balatsouras
Multiple Inheritance Example
A
B
D
F
E
CStep 4✔ Final stratification
Known Class
Phantom Class
Direct Edge
Path Edge
![Page 37: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/37.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 38G. Balatsouras
Multiple Inheritance Example
A
B
D
F
E
CKnown Class
Phantom Class
Direct Edge
Path Edge
Solution✔ Path-edge (A,B)
satisfied through path (A,E,B)
![Page 38: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/38.jpg)
Single Inheritance
Classes
![Page 39: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/39.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 40G. Balatsouras
Multiple vs Single Inheritance
Just one additional constraint on the output...which now has to form a
Multiple Inheritance Single Inheritance
DAG Tree
![Page 40: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/40.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 41G. Balatsouras
Single Inheritance: Examples
Cannot be subtype-related*
Must be subtype-related*
Known Class
Phantom Class
Direct Edge
Path Edge
* X, Y subtype-related if X subtype or supertype of Y
![Page 41: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/41.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 43G. Balatsouras
JPhantom: Algorithms
●Single inheritance– Polynomial if no direct-edges to phantom-nodes– Worst-case exponential (backtracking)– Quite effective in practice
●Multiple inheritance– Polynomial
●Single inheritance, multiple subtyping (e.g., Java)– Decompose into a single and a multiple inheritance subproblems
Solvers
![Page 42: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/42.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 47G. Balatsouras
JPhantom: Overview
About JPhantom
● Solves the hierarchy complementation problem for all 3 settings
● Uses the ASM framework to operate on bytecode● Constraint Extraction Step
– Detects type constraints and missing member references
● Code Generation Step
– Generates dummy classes, yet consistent with our input
![Page 43: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/43.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 48G. Balatsouras
JPhantom: Performance
About JPhantom
● Highly Scalable
– runs in mere seconds even for large applications and complex constraints
– 148 phantom classes and 212 constraints, where execution time < 2sec, for logback-classic
–Maximum execution time of 14s for JRuby ●19MB binary
![Page 44: Class Hierarchy Complementation: Soundly Completing a](https://reader031.vdocument.in/reader031/viewer/2022013005/61ccadedfbb04e7a28676ea8/html5/thumbnails/44.jpg)
Class Hierarchy Complementation: Soundly Completing a Partial Type Graph 49G. Balatsouras
Summary
In summary, we:
● Introduce the class hierarchy complementation problem
● Provide algorithms for:
i. single inheritance
ii. multiple inheritance, and
iii. single inheritance multiple subtyping ● Implement our algorithms in JPhantom, a practical tool for
program complementation
● highly scalable● meets Java bytecode requirements