-
Notifications
You must be signed in to change notification settings - Fork 30
User Guide
QilinPTA edited this page Mar 24, 2022
·
2 revisions
We have prepared a set of benchmarks from DaCapo 2006 in $QILIN_HOME/artifact and a ready-for-use script run.py. We take luindex as an example to introduce how to use Qilin as a command-line tool. Other available benchmarks are [antlr, bloat, chart, eclipse, fop, lusearch, pmd, xalan, JPC, checkstyle, findbugs].
cd $QILIN_HOME/artifact
python3 run.py luindex insens -printYou will obtain some statistics about this analysis on screen due to the option -print (by default, the statistics will be dumped to a file named luindex_insens.txt under $QILIN_HOME/artifact/output/):
#EntrySize:14
PTS relation:1059612
VAR CNT:50853
AVG PTS: 20.836764792637602
PTS relation (no native):1057455
VAR CNT (no native):50822
AVG PTS (no native): 20.8070323875487
#globals: 1159
#locals: 43348
#allocNodeNumberer: 9508
#fieldRefNodeNumberer: 14930
====== Memory Usage ======
Used Memory Before: 0 GB
Free Memory Before: 1 GB
Total Memory Before: 1 GB
Max Memory Before: 256 GB
Analysis: insensitive
Time (sec): 7.926
Used Memory After: 0 GB
Free Memory After: 2 GB
Total Memory After: 3 GB
Max Memory After: 256 GB
====== Call Graph ======
#Method (Static): 30029
#Reachable Method (CI): 7413
#Reachable-Static Method (CI): 1926
#Reachable Method (CS): 7413
#Reachable App Method (CI): 547
#Reachable-App-Static Method (CI): 82
#Reachable App Method (CS): 547
#Call Edge(CI): 39809
#Static-Static Call Edge(CI): 2418
#Static-Instance Call Edge(CI): 5979
#Instance-Static Call Edge(CI): 2718
#Instance-Instance Call Edge(CI): 28694
#Application-Application Call Edge(CI): 1557
#Application-Library Call Edge(CI): 1463
#Library-Application Call Edge(CI): 141
#Library-Library Call Edge(CI): 36651
#Call Edge(CS): 39809
#Static-Static Call Edge(CS): 2418
#Static-Instance Call Edge(CS): 5979
#Instance-Static Call Edge(CS): 2718
#Instance-Instance Call Edge(CS): 28694
#Application-Application Call Edge(CS): 1557
#Application-Library Call Edge(CS): 1463
#Library-Application Call Edge(CS): 141
#Library-Library Call Edge(CS): 36651
#receivers: 18616
#thisreceivers: 0
#avg p2s size for virtualcalls: 1.8625376020627418
====== Statements ======
#Cast (Total): 1394
#Cast (AppOnly): 88
#May Fail Cast (Total): 923
#May Fail Cast (AppOnly): 60
#Static Call Site(Total): 5057
#Virtual Call Site(Total): 25688
#Virtual Call Site(AppOnly): 2691
#Virtual Call Site(Polymorphic): 1294
#Virtual Call Site(Polymorphic AppOnly): 143
#Virtual Call Site(Unreachable): 770
#Avg Poly Call Targets: 8.297527047913446
====== Nodes ======
#Context: 7414
#Avg Context per Method: 1.0
#Method with Throw Pointer-to: 3933
#Alloc Node(CI): 4753
#Alloc Node(CS): 4754
#Global CS Pointer-to Relation: 2079
#Local CS Pointer-to Relation: 865411
#Field CS Pointer-to Relation: 124863
#Global Pointer (lib + app): 1159
#Global Avg Points-To Target(CI): 1.7937877480586712
#Global Avg Points-To Target(CS): 1.7937877480586712
#App Global Pointer: 81
#App Global Avg Points-To Target(CI): 1.6296296296296295
#App Global Avg Points-To Target(CS): 1.6296296296296295
#Avg Points-to Target(CI): 20.836764792637602
#Avg Points-to Target without Native Var(CI): 20.8070323875487
#Local Pointer (lib + app): 43347
#Local Avg Points-To Target(CI): 19.964726509331673
#Local Avg Points-To Target(CS): 19.964726509331673
#App Local Pointer: 3896
#App Local Avg Points-To Target(CI): 11.48947638603696
#App Local Avg Points-To Target(CS): 11.48947638603696
#Context Local Pointer (lib + app): 43325
#Context Local Avg Points-To Target(CI): 19.974864396999422
#Context Local Avg Points-To Target(CS): 19.974864396999422
#App Context Local Pointer: 3896
#App Context Local Avg Points-To Target(CI): 11.48947638603696
#App Context Local Avg Points-To Target(CS): 11.48947638603696
====== Assignments ======
#Alloc-pag-edge: 196221
#Simple-pag-edge: 145931
#Local-to-Local: 102531
#Field-to-Local: 31053
#Local-to-Field: 12347
#Store-pag-edge: 5306
#Load-pag-edge: 8334
====== Classes ======
#Class: 3325
#Appclass: 349
#Libclass: 2972
#Phantomclass: 4
#Class(reachable): 1157
#Appclass(reachable): 100
#Libclass(reachable): 1056
Main PTA (including pre-analysis) elapsed time: 17.03s
Main PTA consumed memory: 2846.53 MB
These outputs include the analysis time, consumed memory, some commonly used metrics for measuring the precision of a pointer analysis, such as #May Fail Cast, #Virtual Call Site(Polymorphic), #Reachable Method (CI), #Call Edge(CI), and #Avg Points-to Target without Native Var(CI), and some basic information on PAG (e.g., #Store-pag-edge) and the benchmark itself (e.g., #Class).
To produce the same results by running Qilin directly, you can use the following command:
java -Xms1g -Xmx256g -cp /home/hedj/Work/QilinOfficial/artifact/pta/config-files:
/home/hedj/Work/QilinOfficial/artifact/pta/Qilin-1.0-SNAPSHOT.jar driver.Main
-pae -pe -clinit=ONFLY -lcs -mh -pta=insens -apppath benchmarks/dacapo/luindex.jar
-libpath benchmarks/dacapo/luindex-deps.jar
-reflectionlog benchmarks/dacapo/luindex-refl.log
-mainclass dacapo.luindex.Main
-jre=/home/hedj/Work/QilinOfficial/artifact/pta/lib/jre/jre1.6.0_45
| Options | Meaning |
|---|---|
| -Xms | Specifies the initial memory allocation pool for JVM. |
| -Xmx | Specifies the maximum memory allocation pool for JVM. |
| -cp | Specifies the class path of Qilin for JVM. |
| driver.Main | Specifies the command-line entry class of Qilin. |
| -pae | Enables type filtering for the objects stored in an array based on the declared type of the array. By default, declared type is java.lang.Object as in Spark. |
| -pe | Enables propagating exception objects along exception-catch-links rather than to a global node as in Spark
|
| -clinit=ONFLY | Specifies the loading mode of <clinit> methods. Under the ``ONFLY'' option, the <clinit> methods for all the classes in the input program are loaded on the fly. The other options are `FULL` (all classes' clinit methods are considered to be reachable) and `APP` (all application classes' clinit methods are considered to be reachable). |
| -mh | Merges the objects of type StringBuffer, StringBuilder, or any subtype of Throwable per type. |
| -lcs | Analyses the objects of type StringBuffer, StringBuilder, or any subtype of Throwable context-insensitively. |
| -pta=insens | Specifies a particular pointer analysis to be performed. Here, insens is the default context-insensitivie pointer analysis. You can also use ko for kOBJ, kc for kCFA, etc. A full list of PTAs supported by QiLin can be found here. |
| -apppath <arg> | Specifies the Jar/Class files for the input program. |
| -libpath <arg> | Specifies the libraries used by the input program. |
| -reflectionlog <arg> | Specifies a reflection log (currently generated by Tamiflex) for representing the reflective targets found at the reflective calls in the input program. |
| -mainclass <arg> | Specifies the main class (or the class that contains main() method) for the input program. |
| -jre=<arg> | Specifies the JRE path for the input program. |
A full list of options/switches of Qilin can be found here.
You can also use Qilin to obtain the callgraph, points-to relations, and others for the program being analysed. Here is an example.