# Qilin's code structure

Qilin's code structure
qilin.core
core
PAG

The pointer assignment graph.

MethodPAG
PAG Nodes

We have defined a set of PAG nodes with the same names, if possible, as those in "soot/jimple/spark/pag/".

Object Node
StringConstantNode.java
ClassConstantNode.java
AllocNode.java
ContextAllocNode.java
Pointer Node
GlobalVarNode.java
LocalVarNode.java
FieldValNode.java
ContextField.java
ContextVarNode.java
CallgraphBuilder

It provides an API for handling virtual call dispatch.

ExceptionHandler

It provides an API for exception dispatch along the exception-catch-links.

CorePTA.java

This defines an abstract pointer analysis. You can define a concrete pointer analysis (as a subclass) by defining Qilin's three context-sensitivity-controlling parameters.

PTA Solver

Qilin's incremental worklist-based constraint solver for supporting pointer analyses with fine-grained context-sensitivity. For more details, please refer to Section 3.3 and Algorithm 1 of our ECOOP'2022 paper.

incremental sets

These classes are modified from their corresponding ones in "soot/jimple/spark/sets".

Feature Handlers
native codes
reflections

We currently discover the reflective targets in a program by using TAMIFLEX before performing pointer analysis on the program. You can design your own reflection handlers here.

parameters

This package includes a set of built-in instantiations of Qilin's three context-sensitivity-controlling parameters.

Context Constructors

A context constructor describes how to construct a new context for a method.

CallsiteCtxConstructor.java

Equation (2) in our ECOOP'22 paper.

ObjCtxConstructor.java

Equation (3) in our ECOOP'22 paper.

TypeCtxConstructor.java

Equation (4) in our ECOOP'22 paper.

HybObjCtxConstructor.java

Equation (5) in our ECOOP'22 paper.

HybTypeCtxConstructor.java

Refer to Selective 2-type-sensitive with 1-context-sensitive heap hybrid (s-2type+H) in "Hybrid context-sensitivity for Points-to Analysis" (PLDI'13).

InsensCtxConstructor.java

Equation (1) in our ECOOP'22 paper.

Context Selector

Context selector selects some context elements from the context of a method to form a new context for a variable declared (or object allocated ) in the method.

UniformSelector.java

Equation (6) in our ECOOP'22 paper.

InsenSelector.java

This context selector is defined for context-insensitive pointer analysis. For all variables and objects, it returns an empty context.

HeuristicSelector.java

Equation (8) in our ECOOP'22 paper.

FullMethodLvSelector.java

This context selector is used in Data-driven pointer analysis (OOPSLA'2017). Every method can use contexts of different context lengths.

PartialMethodLvSelector.java

Equation (9) in our ECOOP'22 paper.

VarLvSelector.java

This context selector allows all variables and objects to have have their own context abstractions (with, e.g., different context lengths) in the most general case.

PartialVarSelector.java

Equation (10) in our ECOOP'22 paper.

DebloatingSelector.java

This context selector is designed for Mahjong and Context debloating technique introduced in ASE'21 paper.

BeanSelector.java

This context selector is specially designed for BEAN.

PipelineSelector.java

This context selector is defined in terms of two other context selectors. See the formal definition in Section 4.4 of our ECOOP'22 paper.

Heap Abstractor

A heap abstractor defines the heap abstraction for an object.

AllocSiteAbstractor.java

Equation (11) in our ECOOP'22 paper.

HeuristicAbstractor.java

Equation (12) in our ECOOP'22 paper.

MahjongAbstractor.java

Equation (13) in our ECOOP'22 paper.

PTA evaluator

Records many statistics of the pointer analysis for a given benchmark.

qilin.pta

If you want to create your own pointer analysis, please put your code under this sub-project.

driver
Main.java

Qilin's command line entry class.

PTAOption.java

Qilin command line options

PTAPattern.java

Pointer analysis patterns, which tell Qilin which PTA to invoke.

concrete PTAs

PTA implementations are stored under the "tools/" directory while their corresponding pre-analyses (if any) are stored under the "toolkits" directory.

Spark.java

This performs the standard context-insensitive pointer analysis. The PTA pattern is "insens".

ObjectSensPTA.java

k-OBJ, the PTA pattern is "ko", k = {1, 2, 3, ...}

CallSiteSensPTA.java

k-CFA, the PTA pattern is "kc", k = {1,2,3,...}

TypeSensPTA.java

k-Type, the PTA pattern is "kt", k = {1, 2, 3, ...}

HybridObjectSensPTA.java

Hybrid kOBJ. The PTA pattern is "kh", k = {1, 2, 3, ...}

DebloatedPTA.java

Context debloating for Object-sensitivity. The PTA pattern can be {ko, Z-ko, E-ko} + "-cd" respectively for debloating kOBJ, Zipper-guided kOBJ, and Eagle-guided kOBJ.

TurnerPTA.java

Turner-guided k-OBJ. The PTA pattern is "T-ko", k = {1, 2, 3, ...}

MahjongPTA.java

Mahjong-guided context-sensitive pointer analysis. The PTA pattern can be one of {M-kc, M-ko}, k = {1, 2, 3, ...}

EaglePTA.java

Eagle-guided kOBJ. The PTA pattern is "E-ko", k = {1, 2, 3, ...}

ZipperPTA.java
BeanPTA.java

Bean-guided 2-object-sensitive pointer analysis. The PTA pattern is "B-2o".

TunnelingPTA.java

Context tunneling guided pointer analysis. The PTA patterns can be one of {'t-1c', t-2t, t-2o, t-2h}.

DataDrivenPTA.java

Data-driven point.er analysis. The PTA patterns can be {D-2o, D-2c, D-2h, D-2ht}

qilin.microben

About 100 unit test cases for testing Qilin. If you want to add more unit test cases, please put your code here.

context sensitivity
k-CFA
k-OBJ
k-Hybrid
collections
flow sensitivity

not supported yet by Qilin.

general test cases
array
assign
call
clinit
exception
field
global
natives
reflog
artifact
qilin.py

The driver script of Qilin.

run.py

The driver script for using Qilin to analyse benchmarks.

Qilin-version-SNAPSHOT.jar

The Qilin package with dependencies. It is compiled by JDK16+ and thus requires a recent JDK to run.

benchmarks
JREs
jre1.6.0_45
jre1.8.0_312
dacapo2006

The old version of DaCaPo benchmarks from the artifact of Mahjong. It should be used together with jre1.6.0_45.

dacapo2018

The latest version of DaCapo (revision 6cf0380) compiled by us. This set of benchmarks should work together with jre1.8.0_312.

qilin.util

This subproject includes a set of utility classes.