All Classes and Interfaces
Class
Description
Provides common functionality for
IBitSet implementations.Common functionality for
CallGraph implementations.All heap models should inherit this class, and we can define
some uniform behaviors of heap modeling here.
This map supports hybrid of two map implementations, where one is
efficient for small map and another one is efficient for large map.
This set supports hybrid of two set implementations, where one is
efficient for small set and another one is efficient for large set.
Provides common functionalities for
InterDataflowAnalysis implementations.Deprecated.
Deprecated.
Use
AnalysisModelPlugin instead.Map-based implementation for
ResultHolder.Common functionality for
WorldBuilder implementations.Exception that is thrown when a member (method or field) is accessed
through an ambiguous name.
Abstract base class for all analyses.
Configuration for an analysis.
Driver for performing a specific kind of data-flow analysis for a method.
Creates and executes analyses based on given analysis plan.
Provides common functionalities for implementing the plugins which
model the APIs by analyzing their semantics.
Wrapper class for analysis options.
Makes analysis plan based on given plan configs and analysis configs.
Records the elapsed time of pointer analysis.
Represents objects that can be attached annotations.
Represents annotations in the program.
Represents name-element entries in annotations.
Container of annotations.
Representation of arithmetic expression, e.g., a + b.
Representation of array access expression, e.g., a[i].
Represents array index pointers.
Representation of array length expression, e.g., arr.length.
Map implementation based on ArrayList.
Set implementation based on ArrayList.
In JVM Spec.
Implements a mechanism for checking pointer analysis assertions.
Representation of statement that assigns literals, e.g., a = 10.
Representation of assign statements.
Available expression analysis on local variables.
In
JVM Spec.
Representation of assign statement for binary expression, e.g., a = b + c.
Representation of binary expression.
Representation of binary operators.
Representation of bitwise expression, e.g., a | b.
This type means that the expression, e.g., a variable, is untyped (i.e., has no type).
The
IRBuilder is for keeping the IRs of all methods to
prevent cyclic references with too long a path which may make
the serialization fail or StackOverflowError.A
WorldBuilder that loads the cached world if it exists, or delegates to the
underlying WorldBuilder otherwise.The edge connecting a call site to method entry of the callee.
Representation of call graph.
Static utility methods about call graph.
Represents sources which generates taint objects at method calls.
The edge connecting a call site and its return site.
This class helps eliminate redundant equivalent elements.
Representation of cast statement, e.g., a = (T) b.
Representation of cast expression, e.g., (T) o.
Representation of catch exception, e.g., catch (e).
Intra-procedural catch analysis for computing the exceptions thrown by
each Stmt will be caught by which Stmts, or not caught at all.
Representation of a control-flow graph of a method.
Represents CFG edges.
Indexer for nodes in a CFG.
Abstract base class for all class analyses, or say, intra-class analyses.
Represents class constant elements.
In
JVM Spec.
Manages the classes and class-related resolution of the program being analyzed.
Triggers the analysis of class initializers.
Utility class for extracting names of all classes inside
given JAR files or directories.
Provides names of special classes.
In
JVM Spec.
Computes collection methods in the program.
Utility methods for
Collection.Representation of comparison expression, e.g., cmp.
Composite plugin which allows multiple independent plugins
to be used together.
Representation of condition expression, e.g., a == b.
This class represents the exceptions in configuration.
Manages a collection of
AnalysisConfig.Static utility methods for config system.
Objects that represent constants.
Implementation of constant propagation for int values.
This class is for debugging/testing purpose.
Representation of contexts in context-sensitive pointer analysis.
Factory of contexts, which provides convenient APIs to create contexts.
Represents context sensitivity variants.
Provides static factory methods for various context selectors.
Representation of copy statement, e.g., a = b.
Represents data facts of constant propagation, which maps variables
to their lattice values.
Represents context-sensitive call graph.
Represents context-sensitive call sites.
Context-sensitive elements.
Manages context-sensitive elements and pointers in pointer analysis.
Represents context-sensitive methods.
Represents context-sensitive objects.
Static utility methods for
CSObjs.Represents context-sensitive variables.
Template interface for defining data-flow analysis.
An object which manages the data-flow facts associated with nodes.
Detects dead code in an IR.
This
ParamProvider creates parameter objects of the declared types,
and the objects pointed to by fields of parameter objects,
as well as elements of array objects.Default implementation of call graph.
Default implementation of IR.
Representation of all definition statements, i.e., exp1 = exp2.
Represents the analysis result of
DefUseAnalysis, i.e.,
both def-use chain and use-def chain.Computes intra-procedural def-use and use-def chains
based on reaching definition analysis.
Descriptor for
MockObj.Finds dominators for the nodes in given
Graph.Represents dot attributes.
Configurable dot dumper.
Represents call edges in the call graph.
General interface for graph edges.
Represents elements attached on
Annotation.Builds empty IR for every native method.
This
ParamProvider ignored all parameters.Represents entry points in pointer analysis.
Initializes standard entry points for pointer analysis.
Evaluates expressions in constant propagation.
Representation of exception entries.
Representation of expressions in Tai-e IR.
Indicates that a feature is experimental.
Provides static utility methods for
Exp.Exp visitor which may return a result after the visit.
Expression wrapper, which tests equality and computes hashcode by Exp contents.
Representation of field access expressions.
Represents field references in IR.
Load/Store field statements.
Represents edges in flow graph.
Dumper for flow graph.
Bit set based implementation of
Set.Representation of goto statement, e.g., goto L.
Representation of a directed graph.
Utility methods for converting signatures.
Static utility methods for computing hash code.
Represents of heap models for heap objects.
Hybrid set that uses bit set for large set.
Hybrid map that uses hash map for large map.
Hybrid set that uses hash set for large set.
Hybrid set that uses indexable set for large set.
Hybrid set that uses linked hash set for large set.
Interface for different bit set implementations.
Action on set bits.
Represents an inter-procedural control-flow graph.
Abstract class for ICFG edges.
Representation of if statement, e.g., if a == b goto S;
The instances of the classes that implement this interface can provide
a unique non-negative index, so that they can be stored in efficient
data structures (e.g., bit set).
An efficient set implementation for
Indexable objects.An indexer assigns each object a unique index, so that the objects
can be stored in efficient data structures.
This implementation leverages
Indexer to take care of the mappings
between objects and indexes.Array-based implementation of the
Map interface.Represents instance field pointers.
Representation of instance field access expression, e.g., o.f.
Representation of instanceof statement, e.g., a = (b instanceof T).
Representation of instanceof expression, e.g., o instanceof T.
Implementation of interprocedural constant propagation for int values.
Template interface for defining inter-procedural data-flow analysis.
Marker annotation.
Representation of int literals.
Representation of invocation statement, e.g., r = o.m(...) or o.m(...).
Representation of invokedynamic instructions.
Representation of method invocation expression.
Annotation for conveniently marking Invoke handlers in API models.
Container annotation for
InvokeHandler.Representation of instance invocation (virtual, interface,
and special) expression.
Representation of invokeinterface expression, e.g., o.m(...).
Representation of invokespecial expression, e.g., super.m(...).
Representation of invokestatic expression, e.g., T.m(...).
Provides utility methods to conveniently handle
Invoke.Representation of invokevirtual expression, e.g., o.m(...).
Intermediate representation for method body of non-abstract methods.
Interface for builder of
IR.Helper for building IR for a method from scratch.
Dumps Tai-e IR for classes of input program.
Deprecated.
Use
IRModelPlugin instead.Provides common functionalities for implementing the plugins which
model the APIs by generating semantically-equivalent IR (Stmt).
Predicate for checking whether given string constants are
in application code.
Predicate for checking whether given string constants are
reflection-relevant, i.e., class names, method names, or field names.
Since Java 9, String concatenation is implemented via invokedynamic.
Represents classes in the program.
Each JClassBuilder builds one JClass.
Represents fields in the program.
Represents methods in the program.
Utility methods for
List.Representation of literals.
Implementation of live variable analysis.
Representation of load array statement, e.g., x = a[..].
Representation of following load field statements:
load instance field: x = o.f
load static field: x = T.f
Utility class for configuring the log4j2 logger.
Represents log items.
Representation of long literals.
Models java.lang.invoke.MethodHandles.Lookup.find*(...).
Marker interface for all left-hand-side value.
Manages data by maintaining the data and their context-sensitive
counterparts by maps.
Map entry.
Represents map-like data-flow facts.
Implements
TwoKeyMap as map of maps.Implements
TwoKeyMultiMap as map of multimaps.An implementation of
MultiMap that stores key-value pairs
as a map from key to the sets of its corresponding values.Represents references to class members in IR.
Represents a node in
MergedSCCGraph, where each node
corresponds to a SCC.Represents a set of merged objects.
Represents a merged graph of a directed graph G.
Abstract base class for all method analyses, or say, intra-procedural analyses.
In
JVM Spec.
Representation of java.lang.invoke.MethodHandle instances.
Provides names of special methods.
Represents method references in IR.
Representation of java.lang.invoke.MethodType instances.
Models invocations to MethodType.methodType(*);
Represents the objects whose allocation sites are not explicitly
written in the program.
Deprecated.
Use
AnalysisModelPlugin instead.Representation of monitorenter/monitorexit instruction.
A collection that maps keys to values, similar to
Map,
but in which each key may be associated with multiple values.A mutable int wrapper.
This class models some native calls by "inlining" their side effects
at the call sites to provide better precision for pointer analysis.
Representation of negation expression, e.g., -o;
Representation of following kinds of new statements:
new instance: o = new T
new array: o = new T[..]
new multi-array: o = new T[..][..]
Representation of new array expression, e.g., new T[..].
Representation of new expressions.
Representation of new instance expression, e.g., new T.
Representation of new multi-array expression, e.g., new T[..][..][..].
Objects that are created by new statements.
Nodes in object flow graph.
An interface for querying data-flow results.
Representation of nop statement which does nothing.
The edge connecting nodes in the same method.
Handles
AssignLiteral var = null.Handles
AssignLiteral where the RValue is of NumberLiteral.Provides utility methods for object allocation graph.
Represents of abstract objects in pointer analysis.
Option class for Tai-e.
Base class for call edges of
CallKind.OTHER.Base class for flow edges of
FlowKind.OTHER.Models other non-core reflection APIs.
The parameter object provider for this variable/parameters of the entry method.
Represents sanitizers which remove taint objects on method parameters.
Represents sources which generate taint objects on method parameters.
Contains information about analysis execution plan.
Configuration for an analysis to be executed.
Analysis plugin interface.
Represents all pointers (nodes) in context-sensitive
pointer analysis (pointer flow graph).
Represents results of pointer analysis.
Extended version
PointerAnalysisResult.Represents pointer flow graph in context-sensitive pointer analysis.
Representation of points-to sets that consist of
CSObj.Provides static factory methods for
PointsToSet.Profiler to help identify analysis hot spots in the analyzed program
and assist performance tuning for pointer analysis.
Abstract base class for all whole-program analyses.
Checks whether propagation of objects is allowed.
Computes reachability information for graph.
Models GC behavior that it assigns every reference to Reference.pending.
Literal of reference type.
In
JVM Spec.
Static utility methods for modeling the behaviors of reflection APIs.
Models reflective-action methods, currently supports
Class.newInstance()
Constructor.newInstance(Object[])
Method.invoke(Object,Object[])
Field.get(Object)
Field.set(Object,Object)
Array.newInstance(Class,int)
TODO: check accessibility
Regular bit set implementation.
The holder object of analysis results.
Special class for process the results of other analyses after they finish.
Dump points-to set to file or compare the analysis result with
the ones read from input file.
Representation of return statement, e.g., return; or return x.
The edge connecting a method exit to return site of the call site.
A reverse view of given graph.
A utility class for logging runtime information about the environment and the Tai-e application.
Marker interface for all right-hand-side value.
Represents a sanitizer in taint analysis.
Given a TST (Total Scalability Threshold), select the ST (Scalability Threshold),
then select context-sensitivity based on the selected ST value.
Finds strongly connected components in a directed graph using
Tarjan's algorithm.
This interface extends
Set to provide more useful APIs.Represents set-like data-flow facts.
A Queue implementation which contains no duplicate elements.
Static utility methods for
Set.Representation of shift expression, e.g., a >> b.
Represents result of side-effect analysis.
Provides functionality to match signatures by given patterns.
Provides signatures of special methods and fields.
A simple map-based implementation of
Graph.A simple map and list based implementation of
Indexer.Represents a sink in taint analysis.
Implementation of Solar, a powerful static reflection analysis.
Interface of data-flow analysis solver.
Base class for the objects that holds a
Solver.Represents a source in taint analysis.
Sparse bit set.
This
ParamProvider returns this/parameter objects specified via its builder.The
Serializable version of Supplier.Represents static field pointers.
Representation of static field access expression, e.g., T.f.
Representation of statements in Tai-e IR.
An interface for querying analysis results of Stmt.
Stmt visitor which may return a result after the visit.
Representation of store array statement, e.g., a[..] = x.
Representation of following store field statements:
store instance field: o.f = x
store static field: T.f = x
Static utility methods for
Stream.Utility class for compute string representations of various program
elements, such as class name, method descriptor, method signature, etc.
Static utility methods for
String.Method name and descriptor.
Representation of switch statement, e.g.,
switch (v) {
case 1: ...
Taint Analysis composites plugins
SourceHandler, TransferHandler
and SanitizerHandler to handle the logic associated with Source,
TaintTransfer, and Sanitizer respectively.Configuration for taint analysis.
Provides a configuration for taint analysis.
Each instance represents a taint flow from source to sink.
Represents taint transfer between argument/base/return variables
caused by invocation to specific method.
Models initialization of system thread group, main thread group,
main thread, and some Thread APIs.
Representation of throw exception statement, e.g., throw e.
Thrown by fixed-capacity collections to indicate that the number of
elements added to the collection exceeds its fixed capacity.
Topologically sorts a directed graph using DFS.
Transfer function on pointer flow edges.
Represents an operation that accepts three input arguments and returns no result.
An implementation of
Context, which organizes contexts as Trie.Represents a function that accepts three arguments and produces a result.
A collection that maps two-key pairs to values.
A map entry (key1-key2-value triple).
A collection that maps two-key pairs to values, similar to
TwoKeyMap,
but in which each two-key pair may be associated with multiple values.Transfer function that filters out the objects whose types are NOT
subtypes of specific type.
In
JVM Spec.
In
JVM Spec.
This class provides APIs for retrieving types in the analyzed program.
Representation of following kinds of unary assign statements:
negation: x = -y
array length: x = arr.length
Representation of unary expression.
Represents lattice values in constant propagation.
Representation of method/constructor parameters, lambda parameters,
exception parameters, and local variables.
Provides unmodifiable view collections.
In JVM Spec.
Manages the whole-program information of the program being analyzed.
Interface for
World builder.
IRModelPlugininstead.