Java中的别名分析
有人可以向我指出 Java 别名分析的框架或实现吗? 我查看了asm框架,但它只提供数据流分析和控制流分析。
更新:只是好奇,但有人知道 Findbugs 是否进行别名分析吗?
Can somebody point me to a framework or an implementation of alias analysis for Java.
I looked at the asm framework but it only provides data flow analysis and control flow analysis.
Update: Just curious but does anyone know if Findbugs does alias analysis?
如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱,如果其他用户或者作者回复了您的评论,将不能在第一时间通知您!
发布评论
评论(5)
我知道三个带有 Java 别名分析的开源程序分析框架:
请注意,这些框架中实际实现的是 指向分析,通过它可以确定可能的混叠。有关 WALA 指针分析的一些详细信息,请访问 http://wala.sourceforge.net/ wiki/index.php/UserGuide:指针分析。
I know of three open-source program analysis frameworks with an alias analysis for Java:
Note that what is actually implemented in these frameworks is a points-to analysis, with which one can determine possible aliasing. Some details on WALA's pointer analyses are available at http://wala.sourceforge.net/wiki/index.php/UserGuide:PointerAnalysis.
我认为这是一个非常重要的问题,因为指向分析/别名分析是大多数程序分析任务的基本部分。下面是我尝试列出的更完整的 Java 框架。有些比其他更完整,这是一个活跃的研究领域,所以我可能错过了一些。很难说哪种实现最好,但 DOOP 和 SPARK 似乎是学术界的热门选择。
用于处理第三方库的额外补充工具。
I think this is a pretty important question as points-to analysis/alias analysis is a fundamental piece of most program analysis tasks. So here is my attempt at a more complete listing of frameworks for Java. Some are more complete than others and this is an active research area so I may have missed a few. It's hard to say which implementation is the best, but DOOP and SPARK seem to popular choices among academics.
Bonus supplementary tools for dealing with third party libraries.
一种可能性是 Sawja,在 OCaml 中实现。它似乎还不包含别名分析,但它提供了构建模块。
关于您的更新,Bill Pugh 的 Google 演讲 听起来像是 Findbugs 会在没有解析指针的代码。当然,那是2006年的事了,谁知道之后发生了什么……时间过得很快。
One possibility is Sawja, implemented in OCaml. It doesn't seem to contain an alias analysis yet, but it offers building blocks to make one.
Regarding your update, Bill Pugh's Google talk makes it sound like Findbugs looks for specific patterns in the code without resolving pointers. Of course, that was in 2006, so who knows what has happened since... Time flies fast.
我在 OOPSLA 上看到了 doop ,但我不知道它处于什么状态。
我不知道其他实现,只知道大量论文。
There's doop which I saw at an OOPSLA, but I don't know what state it is in.
I know of no other implementations, just a ton of papers.
我们的 DMS 软件重组工具包 及其 Java Front End 可用于构建此内容。
DMS 提供通用解析、树/符号表构建和流分析(控制流、数据流、指向、调用图等)功能。通过将前端连接到该机器,人们可以实现特定于语言的分析,而无需从头开始构建大部分机器。这些已用于在大型 C 应用程序上进行全局指向分析和调用图构建,以及在 C++ 上进行控制流分析。
对于Java,我们实现了方法本地控制流和本地数据流的某些方面。为了进行良好的别名分析,您需要填写调用图构造。
Our DMS Software Reengineering Toolkit and its Java Front End could be used to build this.
DMS provide general purpose parsing, tree/symbol table building, and flow analysis (control flow, data flow, points-to, call graph, ...) capabilities. By connecting a front end to this machinery, one can implement langauge-specific analyses without having to build most of the machinery from scratch. These have been used to do global points-to analyses and call graph construction on very big C applications, and control flow analysis on C++.
For Java, we have method-local control flow implemented and some aspects of local data flow. To do good alias analysis, you'd need to fill out call graph construction.