Analysis of Call Chains in Java Software

1
Analysis of Call Chains in Java Software

• Nasko Rountev
• (most slides from Scott Kagan- ISSTA04)

2
Call Chains

• Call graph a representation of calling
  relationships
• nodes represent methods
• directed edge from a to b shows that a may call b
• Call chain a sequence of call graph edges
• an abstraction of the runtime call stack

3
Types of Call Chain Analysis

• Static Analysis
• given a program, determine the set of call chains
  which may occur at runtime
• Dynamic Analysis
• given a program and input, determine the set of
  call chains which did occur at runtime
• This talk will focus on dynamic call chain
  analysis

4
Dynamic Call Chain Analysis

• Main goal
• identify the sequences of calls made during a
  runtime execution
• abstract away certain chains or portions of
  chains
• do not show chains which are not of interest to
  the user
• Main obstacles
• recursion
• class initialization
• exceptional behavior

5
Dynamic Call Chain Analysis

• Input
• an executable program with inputs
• a set of component classes
• classes of interest to the user
• only call chains involving objects of these
  classes will be tracked
• a set of entry methods
• the starting methods of the chains
• optional a maximum chain length
• What should be the format for output?

6
Calling Context Tree

• Data structure which represents a set of call
  chains
• Ammons et al., PLDI 1997
• Nodes correspond to methods
• Edges correspond to calling relationships
• Each node represents a chain
• Represents a component, not a program
• calling context forest
• Recursion is unrolled

7
Calling Context Tree Example
X.m()
c1,X
c2,X
X.o()
X.n()
c4,Y
c3,Y
Y.p()
X.n()
c3,Y
Y.p()
8
Static Analysis

• Perform a lightweight static analysis
• reports which call sites may exit the component
• Instrument the program
• only instrument component classes
• entered(m)
• exited(m)
• before(c,X)
• after(c,X)

9
Dynamic Analysis

• Create/traverse trees at runtime based upon
  events fired
• Six main analysis states
• start not yet entered component
• active currently traversing forest
• limited chain limit reached
• external left component, waiting to return
• active call, limited call a call currently
  occurring

10
State Machine for Dynamic Analysis
11
Analysis Example
Event entered(X.m) before(c2,X) entered(X.n) befor
e(c3,Y) entered(Y.p) before(c5,Z) after(c5,Z) exit
ed(X.p) after(c3,Y) exited(X.n) after(c2,X) exite
d(X.m)
State Start Active Active Call Active Limited
Call Limited External Limited Active Active Active
Active Start
X.m()
c2,X
c1,X
X.o()
X.n()
Counter 1 0
Edge Seen (c2,X)
12
Component Exit and Reentrance

• Transition to external when a call site is
  reached that leaves the component
• entered(m) freeze the traversal
• exited(m) resume traversal
• need to remember last state active or limited
• What if the component is reentered?
• need multiple traversals in a stack
• transition to external pushes new traversal
• transition out of external pops the top traversal

13
Some Further Details

• Constructors
• before(c) not before(c,X)
• stall the traversal, but collect events
• wait until after(c,X) is seen
• Class Initialization
• may appear that multiple threads are running
• however, not the general multi-threading case
• push a new traversal

14
Exceptions

• Exceptional behavior will cause certain events to
  go missing
• no after(c,X) because control does not return to
  the call site
• no exited(m) because control leaves the method
• Solution
• additional instrumentation
• caught(m,e) in all catch and finally blocks
• add artificial try-catch block
• caught(m,e) in the artificial catch
• exited(m) in the artificial catch

15
Exceptional Flow of Control in Java

• Assumption for every entered(m) there is a
  corresponding exit(m), and for every before(c,X)
  there is a corresponding after (c,X)
• Violated for programs in which exceptions are
  raised by a component method or any of its
  callers
• Exceptions in Java are instances of Throwable or
  any of its subclasses
• Synchronous raised explicitly with a throw
  statement, or implicitly as the result of an
  expression evaluation
• Asynchronous (occuring non-deterministically)
  occur as the result of an error in the virtual
  machine, or when the stop method of Thread is
  invoked

16
Exceptional Flow of Control in Java

• Synchronous exceptions may be checked or
  unchecked
• A method which raises a checked exception must
  contain either the proper exception handler or
  throws clause for that exception
• Methods that raise unchecked exceptions are not
  required to have handlers or throws clauses
• Unchecked exceptions are instances of
  RuntimeException, Error, or any of their
  subclasses
• A single method may raise both checked and
  unchecked exceptions

17
Example
public void echo(String file) throws IOException
1 InputStreamReader in 2 in new
BufferedReader(new FileReader(file)) 3 try
4 String line 5 while ((line in.readLine())
! null) 6 System.out.println(line) 7
System.out.flush() 8 catch
(IOException e) 9 logReadError(file, e)
10 finally 11 in.close()
throws clause
exception handler
18
Exceptional Flow of Control in Java

• If an IOException is raised during one of the
  invocations on line 2, that exception will be
  propagated to the caller of echo
• The propagation of an IOException encountered at
  line 2 will bypass the exited event
• An entered event will occur without a
  corresponding exited event
• IOException raised during the invocation on line
  5
• Control will transfer to line 9 without returning
  to line 5 a before event will occur without a
  corresponding after event

19
High-Level Idea

• Add event caught(m,e) at the entry of a catch
  block
• m is the surrounding method, e is the exception
• Things get ugly for finally blocks
• Add a try-catch around the entire method body
• Catches and rethrows all exceptions that would
  have been uncaught by the original method
• Whenever we see a caught event, we know that some
  after event may have been missed
• Whenever we see a method exit due to an uncaught
  exception, we know that some exited event may
  have been missed