Package boomerang.results

Class NullPointerDereference

    • Method Detail

      • getVariable

        public Val getVariable()
        The variable that contains "null" and which provokes at the statement a NullPointerException.
        Specified by:
        getVariable in interface AffectedLocation
        Returns:
        the variable that contains a null pointer

      • getStatement

        public ControlFlowGraph.Edge getStatement()
        The statement at which a null pointer occurred.

        A null pointer can occur at three different types of statements: y = x.toString(); or y = lengthof(x); or y = x.f;

        Specified by:
        getStatement in interface AffectedLocation
        Returns:
        the statement where the respective getVariable is null

      • getSourceStatement

        public ControlFlowGraph.Edge getSourceStatement()
        The source statement of the data-flow, i.e., the statement that assigns null to a variable.

        Examples are: x = null or x = System.getProperty(...).

        Returns:
        The source statement of the data-flow/null pointer.

      • getSourceVariable

        public Val getSourceVariable()
        The source variable at the source statement. At a statement x = null or x = System.getProperty, this will be the variable x.
        Returns:
        The source variable of the data-flow propagation

      • getMethod

        public Method getMethod()
        Returns the method of the statement at which the null pointer occurs.
        Returns:
        The SootMethod of the null pointer statement

      • getOpeningContext

        public wpds.impl.PAutomaton<Statement,​sync.pds.solver.nodes.INode<Val>> getOpeningContext()
        The opening context of a NullPointer provides the call stack under which the null pointer occurs. 
         main(){
        Object x = null;
        foo(x); //call site context "c1"
        Object y = new Object();
        foo(y); //call site context "c2"
 }
 foo(Object z){
        z.toString() //<- Variable z is null here under context c1, but *not* under c2)
 }
        In the example above, z is null under the calling context of call site c1.

        In the case of branching, there can be multiple call site contexts leading to a null pointer. Therefore, the opening context is represented as an automaton (or graph). The edges of the automaton are labeled by the call sites, the nodes are labeled by variables or by variables at a context. For the example above, the automaton contains a transition with label foo(x)

        Returns:
        The automaton representation of the opening context.

      • getClosingContext

        public wpds.impl.PAutomaton<Statement,​sync.pds.solver.nodes.INode<Val>> getClosingContext()
        The closing context of a NullPointer provides the call stack via which a variable containing null returns to a caller. 
         main(){
        Object x;
  if(...){
                x = returnNull(); //b1
  } else {
        x = returnNotNull(); //b2
  }
        x.toString() //<- Variable x is null here when the program executes along branch b1
 }
 Object returnNull(){
        Object y = null;
  return y;
 }
        In the case above, a null pointer exception occurs when the program executes along branch b1.

        There can be multiple contexts leading to a null pointer. Therefore, the closing context is represented as an automaton (or graph). The edges of the automaton are labeled by the call sites, the nodes are labeled by variables or by variables at a context. For the example above, the automaton contains a transition with label returnNull(). This indicates, that the null pointer only occurs along branch b1 but not b2.

        Returns:
        The automaton representation of the closing context.

      • getQuery

        public Query getQuery()

      • isNullPointerNode

        public static boolean isNullPointerNode​(sync.pds.solver.nodes.Node<ControlFlowGraph.Edge,​Val> nullPointerNode)