Type Members

1.  trait ArrayValues extends ReferenceValues

   Enables the tracking of the length of arrays in the most common cases.

   Enables the tracking of the length of arrays in the most common cases. Joins of arrays are only supported if both arrays have the same length.

   Note

   Mixin of MaxArrayLengthRefinement may still be useful.

2.  trait ClassValues extends StringValues with FieldAccessesDomain with DynamicLoadsDomain with MethodCallsDomain

   Enables the tracking of concrete Class values.

   Enables the tracking of concrete Class values.

   This class overrides invokestatic and only delegates to the default implementation if it cannot successfully handle the call. Hence, this trait needs to be mixed in after the trait that handles the default case but before all other traits that "just" analyze invokestatic calls.

   class MyDomain
    extends DefaultTypeLevelInvokeInstructions
    with ClassValues
    with <DOES ANAYLZE INVOKE CALLS>

3.  trait ConcreteArrayValues extends ArrayValues with PerInstructionPostProcessing with PostEvaluationMemoryManagement

   Enables the tracking of various properties related to arrays.

   Enables the tracking of various properties related to arrays.

   This domain in particular enables the tracking of an array's concrete content in some specific cases (e.g., the Strings stored in an array or some primitive values) or the tracking of information about an array's elements at a higher level. In both cases only arrays up to a specified size (cf. maxTrackedArraySize) are tracked. The content of arrays which track mutable data-structures cannot be tracked since the infrastructure to "update the array's content if the referenced value is changed" is not available!

   Note

   This domain does not require modeling the heap. This however, strictly limits the kind of arrays that can be tracked/the information about elements that can be tracked. Tracking the contents of arrays of mutable values is not possible; unless we only track abstract properties that do not depend on the concrete array element's value. For example, if we just want to know the upper type bounds of the values stored in the array, then it is perfectly possible. This property cannot change in an unsound fashion without directly accessing the array.

   ,

   This domain requires that the instantiated domain is only used to analyze one method.

4.  trait ConcretePrimitiveValuesConversions extends TypeLevelPrimitiveValuesConversions

   Default implementation of a domain that performs basic conversions between primitive values.

5.  trait ConstraintsBetweenIntegerValues extends CoreDomainFunctionality with IntegerRangeValues with TheCodeStructure

   Domain that traces the relationship between integer values; currently, the domain only works in an unbelievable small number of cases...

   Domain that traces the relationship between integer values; currently, the domain only works in an unbelievable small number of cases... it is basically useless at the moment.

6.  trait DefaultArrayValuesBinding extends DefaultReferenceValuesBinding with ArrayValues

7.  trait DefaultClassValuesBinding extends DefaultStringValuesBinding with ClassValues

8.  trait DefaultConcreteArrayValuesBinding extends DefaultArrayValuesBinding with ConcreteArrayValues

9.  class DefaultDomain[Source] extends CorrelationalDomain with TheProject with TheMethod with DefaultSpecialDomainValuesBinding with ThrowAllPotentialExceptionsConfiguration with IgnoreSynchronization with DefaultTypeLevelHandlingOfMethodResults with DefaultTypeLevelFloatValues with DefaultTypeLevelDoubleValues with TypeLevelFieldAccessInstructions with TypeLevelInvokeInstructions with TypeLevelDynamicLoads with SpecialMethodsHandling with DefaultClassValuesBinding with DefaultArrayValuesBinding with MaxArrayLengthRefinement with NullPropertyRefinement with DefaultIntegerRangeValues with DefaultLongValues with LongValuesShiftOperators with ConcretePrimitiveValuesConversions

   Default configuration of a domain that uses the most capable l1 domains

10.  class DefaultDomainWithCFG[Source] extends DefaultDomain[Source] with RecordCFG

    Configuration of a domain that uses the most capable l1 domains and which also records the abstract-interpretation time control flow graph.

11.  class DefaultDomainWithCFGAndDefUse[Source] extends DefaultDomainWithCFG[Source] with RefineDefUseUsingOrigins

    Configuration of a domain that uses the most capable l1 domains and which also records the abstract-interpretation time control flow graph and def/use information.

12.  trait DefaultIntegerRangeValues extends DefaultSpecialDomainValuesBinding with IntegerRangeValues

    This domain implements the tracking of integer values at the level of ranges.

13.  trait DefaultIntegerSetValues extends DefaultSpecialDomainValuesBinding with IntegerSetValues

    This domain implements the tracking of integer values using sets.

14.  trait DefaultIntegerValues extends DefaultSpecialDomainValuesBinding with IntegerValues

    This domain implements the tracking of simple integer values.

    This domain implements the tracking of simple integer values.

    Note

    This domain uses a single object to represent some integer. I.e., this domain does not support the identification of values that may be equal.

    See also

    IntegerValues for more details.

15.  class DefaultIntervalValuesDomain[Source] extends CorrelationalDomain with TheProject with TheMethod with DefaultSpecialDomainValuesBinding with ThrowAllPotentialExceptionsConfiguration with DefaultHandlingOfMethodResults with IgnoreSynchronization with DefaultTypeLevelFloatValues with DefaultTypeLevelDoubleValues with TypeLevelFieldAccessInstructions with TypeLevelInvokeInstructions with TypeLevelDynamicLoads with l0.DefaultReferenceValuesBinding with DefaultIntegerRangeValues with ConstraintsBetweenIntegerValues with DefaultLongValues with LongValuesShiftOperators with ConcretePrimitiveValuesConversions

    This domain uses the l1 level stable domains which handle primitive values using intervals/ranges.

16.  trait DefaultJavaObjectToDomainValueConversion extends AsDomainValue

    Default implementation of the AsDomainValue trait.

17.  trait DefaultLongSetValues extends DefaultSpecialDomainValuesBinding with CorrelationalDomain with LongSetValues

    This domain implements the tracking of long values at the level of sets.

18.  trait DefaultLongValues extends DefaultSpecialDomainValuesBinding with LongValues

    This domain is able to track constant long values and to perform mathematical operations related to constant long values.

19.  trait DefaultReferenceValuesBinding extends ReferenceValues with DefaultExceptionsFactory

20.  class DefaultReferenceValuesDomain[Source] extends CorrelationalDomain with TheProject with TheMethod with DefaultSpecialDomainValuesBinding with ThrowAllPotentialExceptionsConfiguration with DefaultHandlingOfMethodResults with IgnoreSynchronization with DefaultTypeLevelFloatValues with DefaultTypeLevelDoubleValues with TypeLevelFieldAccessInstructions with TypeLevelInvokeInstructions with TypeLevelDynamicLoads with DefaultReferenceValuesBinding with DefaultTypeLevelIntegerValues with DefaultTypeLevelLongValues with TypeLevelPrimitiveValuesConversions with TypeLevelLongValuesShiftOperators

    This domain uses (only) the l1 domain related to handling type information.

    This domain uses (only) the l1 domain related to handling type information. I.e., this is the most basic domain that supports the tracking of precise type information; however, neither Strings nor class values are tracked and also the nullness of values is not refined after (an implicit) NullPointerException.

21.  class DefaultReferenceValuesDomainWithCFGAndDefUse[Source] extends DefaultReferenceValuesDomain[Source] with RefineDefUseUsingOrigins
22.  class DefaultSetValuesDomain[Source] extends CorrelationalDomain with TheProject with TheMethod with DefaultSpecialDomainValuesBinding with ThrowAllPotentialExceptionsConfiguration with DefaultHandlingOfMethodResults with IgnoreSynchronization with DefaultTypeLevelFloatValues with DefaultTypeLevelDoubleValues with TypeLevelFieldAccessInstructions with TypeLevelInvokeInstructions with TypeLevelDynamicLoads with DefaultClassValuesBinding with NullPropertyRefinement with DefaultIntegerSetValues with DefaultLongSetValues with LongValuesShiftOperators with ConcretePrimitiveValuesConversions

    This domain uses the l1 level stable, partial domains that represent the values of variables using sets.

23.  class DefaultSingletonValuesDomain[Source] extends Domain with TypedValuesFactory with TheProject with TheMethod with DefaultSpecialDomainValuesBinding with ThrowAllPotentialExceptionsConfiguration with DefaultHandlingOfMethodResults with IgnoreSynchronization with DefaultTypeLevelFloatValues with DefaultTypeLevelDoubleValues with TypeLevelFieldAccessInstructions with TypeLevelInvokeInstructions with TypeLevelDynamicLoads with l0.DefaultReferenceValuesBinding with DefaultIntegerValues with DefaultLongValues with LongValuesShiftOperators with ConcretePrimitiveValuesConversions

    This domain uses the l1 level stable domains which can "only" represent single values (basically just performs constant propagation).

24.  trait DefaultStringValuesBinding extends DefaultReferenceValuesBinding with StringValues

25.  trait IntegerRangeValues extends IntegerValuesDomain with IntegerRangeValuesFactory with ConcreteIntegerValues

    This domain represents integer values using ranges.

    This domain represents integer values using ranges.

    The cardinality of the range can be configured to satisfy different needs with regard to the desired precision (maxCardinalityOfIntegerRanges). Often, a very small cardinality (e.g., between 2 and 8) may be completely sufficient and a large cardinality does not add the overall precision significantly and just increases the analysis time.

    Constraint Propagation

    This domain facilitates and performs constraint propagation (e.g., intEstablishValue, intEstablishIsLessThan,...). Two integer (range) values (ir1,ir2) are reference equal (eq in Scala) iff both represent the same runtime value.

    In other words, the implementation ensures that two int values that are known to have the same value – even though the precise value may not be known – are represented using the same object. Furthermore, two int values that are not known to represent the same value at runtime are always represented using different objects. For example, consider the following sequence:

    • pcA+0/t1: iadd (Stack: 1 :: AnIntegerValue :: ...; Registers: <ignored>)
    • pcA+1/t2: dup (Stack: v(pcA/t1) :: ...; Registers: <ignored>)
    • pcA+2/t3: iflt true:+10 (Stack: v(pcA/t1) :: v(pcA/t1) :: ...; Registers: <ignored>)
    • pcA+3/t4: ... (Stack: v(pcA/t1) >= 0 :: ...; Registers: <ignored>)
    • pcA+XYZ...
    • pcA+12/t5: ... (Stack: v(pcA/t1) < 0 :: ...; Registers: <ignored>)

    Here, the test (iflt) of the topmost stack value against the constant 0 constraints the second topmost stack value. Both (abstract) values are guaranteed to represent the same value at runtime even though the concrete value may be unknown. In this case, the value was even created at the same point in time.

    In case of this domain the reference of the Domain(Integer)Value is used to identify those values that were created at the same point in time and hence, have the same properties.

    E.g., consider the following fictitious sequence:

    • iconst2 ...
      • Stack: EMPTY
      • Locals: EMPTY
    • dup ...
      • Stack: IntegerRangeValue(2,2)@123456;
      • Locals: EMPTY
    • istore_0 ...
      • Stack: IntegerRangeValue(2,2)@123456 <- IntegerRangeValue(2,2)@123456;
      • Locals: EMPTY
    • iconst2 ...
      • Stack: IntegerRangeValue(2,2)@123456;
      • Locals: 0=IntegerRangeValue(2,2)@123456, 1=EMPTY
    • istore_1 ...
      • Stack: IntegerRangeValue(2,2)@654321 <- IntegerRangeValue(2,2)@123456;
      • Locals: 0=IntegerRangeValue(2,2)@123456, 1=EMPTY
    • ...
      • Stack: IntegerRangeValue(2,2)@123456;
      • Locals: 0=IntegerRangeValue(2,2)@123456, 1=IntegerRangeValue(2,2)@654321

    Additionally, if the sequence would be part of a loop, the next iteration would create new IntegerRangeValues.

    Implementation Requirements

    Subclasses are required to create new instances of IntegerRangeValues and AnIntegerValue whenever a computation is performed that may affect the runtime value. If this property is not satisfied the implemented constraint propagation mechanism will produce unpredictable results as it may constrain unrelated values! This is true for concrete ranges as well as AnIntegerValues.

26.  trait IntegerSetValues extends IntegerValuesDomain with ConcreteIntegerValues with IntegerRangeValuesFactory

    This domain enables the tracking of integer values using sets.

    This domain enables the tracking of integer values using sets. The cardinality of the set can be configured to facilitate different needs with regard to the desired precision. Often, a very small cardinality (e.g., between 2 or 8) may be completely sufficient and a large cardinality does not significantly add to the overall precision.

27.  trait IntegerValues extends IntegerValuesDomain with ConcreteIntegerValues

    This domain enables the tracking of an integer value (a constant); unknown integer values are represented using "AnIntegerValue".

    This domain enables the tracking of an integer value (a constant); unknown integer values are represented using "AnIntegerValue". It basically provides support for constant propagation and constant computations related to integer values.

    Given that it uses one instance to represent arbitrary integer values, constraint propagation is not relevant.

    This domain may be appropriate, e.g., if you want to determine if a field/local is always initialized to a specific value.

28.  trait LongSetValues extends LongValuesDomain with ConcreteLongValues

    This domain enables the tracking of long values using sets.

    This domain enables the tracking of long values using sets. The cardinality of the set can be configured to facilitate different needs with regard to the desired precision.

    This domain supports constraint propagation as every two values that are not guaranteed to have the same value at runtime are always represented using a unique instance of LongValue.

29.  trait LongSetValuesShiftOperators extends LongValuesDomain

    Implements the shift operators for long values.

    Implements the shift operators for long values.

    (The shift operators are put in their own module, because the shift value is always an IntegerValue.)

30.  trait LongValues extends LongValuesDomain with ConcreteLongValues

    Foundation for domains that trace specific long values.

    Foundation for domains that trace specific long values. This domain can directly be used to trace simple computations involving constant long values.

31.  trait LongValuesShiftOperators extends LongValuesDomain

    Implements the shift operators for long values.

32.  trait MaxArrayLengthRefinement extends TypeLevelReferenceValues

    In case that the arraylength is just an integer value, the value is refined to the range [0...Int.MaxValue].

33.  trait NullPropertyRefinement extends CoreDomainFunctionality

    Refines a reference's null property if the reference value may be null and this has resulted in a corresponding exception.

34.  trait RecordAllThrownExceptions extends RecordThrownExceptions

    Records all exception values thrown by a method.

    Records all exception values thrown by a method. I.e., for each instruction that throws an exception (or multiple exceptions) all exceptions are recorded.

35.  trait ReferenceValues extends DefaultTypeLevelReferenceValues with Origin

    This partial domain enables tracking of a reference value's null-ness and must-alias information.

36.  trait ReflectiveInvoker extends DefaultJavaObjectToDomainValueConversion with AsJavaObject

    Support the invocation of methods (using Java reflection) of Java objects that represent concrete domain values.

    Support the invocation of methods (using Java reflection) of Java objects that represent concrete domain values.

    This greatly facilitates the implementation of methods that need to simulate the logic of a specific object.

37.  trait StringBuilderValues extends StringValues

    Enables the tracing of StringBuilders.

    Enables the tracing of StringBuilders.

    TODO ==Implementation Details==

    Copy on Branch

    Given that StringBuilders are mutable, we have to create a copy whenever we have a branch. This enables us to make the domain value that represents the state of the StringBuilder independently mutable on each branch. E.g.,

    val sb : StringBuilder = ....
    if (condition) sb.append("X") else sb.append("Y")
    // here, the represented string either ends with "X" or with "Y", but not with "XY" or "YX"

    Ensure Termination

    To ensure termination in degenerated cases, such as:

    val b : StringBuilder = ...
    while((System.nanoTime % 33L) != 0){
        b.append((System.nanoTime % 33L).toString)
    }
    return b.toString

    We count the number of joins per PC and if that value exceeds the configured threshold, we completely abstract over the contents of the string builder.

38.  trait StringValues extends ReferenceValues with DefaultJavaObjectToDomainValueConversion with MethodCallsDomain with PostEvaluationMemoryManagement

    Enables the tracing of concrete string values and can, e.g., be used to resolve static "class.forName(...)" calls.