Failed to construct the call graph with Tai-e

[brant-ruan]

📝 Overall Description

Hello, thanks for this awesome tool.

I am using tai-e-all-0.5.1.jar to build the call graph for tomcat-catalina-8.5.65.jar (https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-catalina/8.5.65/). However, the call graph result only contains methods and edges from Java standard libraries, and there is no methods and edges from the tomcat-catalina-8.5.65.jar (even no catalina keyword). I also use Soot and Soot can generate the expected call graph.

My options:

optionsFile: null
printHelp: false
classPath: []
appClassPath: 
- test/tomcat-catalina-8.5.65.jar
inputClasses:
- org.apache.catalina.AccessLog
- org.apache.catalina.AsyncDispatcher
- org.apache.catalina.Authenticator
- org.apache.catalina.Cluster
- org.apache.catalina.Contained
- org.apache.catalina.Container
- org.apache.catalina.ContainerEvent
- org.apache.catalina.ContainerListener
- org.apache.catalina.ContainerServlet
- org.apache.catalina.Context
- org.apache.catalina.CredentialHandler
- org.apache.catalina.DistributedManager
- org.apache.catalina.Engine
- org.apache.catalina.Executor
- org.apache.catalina.GSSRealm
- org.apache.catalina.Globals
- org.apache.catalina.Group
- org.apache.catalina.Host
- org.apache.catalina.JmxEnabled
- org.apache.catalina.Lifecycle
- ...
javaVersion: 8
prependJVM: false
allowPhantom: true
worldBuilderClass: pascal.taie.frontend.soot.SootWorldBuilder
outputDir: output
preBuildIR: false
worldCacheMode: false
scope: APP
nativeModel: true
planFile: null
analyses:
  pta: cs:ci;handle-invokedynamic:true;implicit-entries:true;distinguish-string-constants:reflection;reflection-inference:solar;dump-ci:true;
  cg: algorithm:pta;dump:true;dump-methods:true;dump-call-edges:true;
onlyGenPlan: false
keepResult:
- $KEEP-ALL

Command:

java -jar ./tai-e-all-0.5.1.jar --options-file my_options.yml

BTW, I also want to ask whether and how I can generate the call graph with reflection-related edges with the pta analysis (reflection-reference: solar)?

Thank you very much!

🎯 Expected Behavior

Generate the expected call graph for the target jar file.

🐛 Current Behavior

No methods from the jar file appear in the final call graph results.

🔄 Reproducible Example

No response

⚙️ Tai-e Arguments

🔍 Click here to see Tai-e Options

optionsFile: null
printHelp: false
classPath: []
appClassPath:
- test/tomcat-catalina-8.5.65.jar
mainClass: null
inputClasses:
- org.apache.catalina.AccessLog
- org.apache.catalina.AsyncDispatcher
- org.apache.catalina.Authenticator
- org.apache.catalina.Cluster
- org.apache.catalina.Contained
- org.apache.catalina.Container
- org.apache.catalina.ContainerEvent
- org.apache.catalina.ContainerListener
- org.apache.catalina.ContainerServlet
- org.apache.catalina.Context
- org.apache.catalina.CredentialHandler
- org.apache.catalina.DistributedManager
- org.apache.catalina.Engine
- org.apache.catalina.Executor
- org.apache.catalina.GSSRealm
- org.apache.catalina.Globals
- org.apache.catalina.Group
- org.apache.catalina.Host
- org.apache.catalina.JmxEnabled
- org.apache.catalina.Lifecycle
javaVersion: 8
prependJVM: false
allowPhantom: true
worldBuilderClass: pascal.taie.frontend.soot.SootWorldBuilder
outputDir: output
preBuildIR: false
worldCacheMode: false
scope: APP
nativeModel: true
planFile: null
analyses:
pta: cs:ci;handle-invokedynamic:true;implicit-entries:true;distinguish-string-constants:reflection;reflection-inference:solar;dump-ci:true;
cg: algorithm:pta;dump:true;dump-methods:true;dump-call-edges:true;
onlyGenPlan: false
keepResult:
- $KEEP-ALL

🔍 Click here to see Tai-e Analysis Plan

- id: pta
options:
  cs: ci
  only-app: false
  implicit-entries: true
  distinguish-string-constants: reflection
  merge-string-objects: true
  merge-string-builders: true
  merge-exception-objects: true
  handle-invokedynamic: true
  propagate-types:
  - reference
  advanced: null
  dump: false
  dump-ci: true
  dump-yaml: false
  expected-file: null
  reflection-inference: solar
  reflection-log: null
  taint-config: null
  taint-config-providers: []
  taint-interactive-mode: false
  plugins: []
  time-limit: -1
- id: cg
options:
  algorithm: pta
  dump: true
  dump-methods: true
  dump-call-edges: true

📜 Tai-e Log

🔍 Click here to see Tai-e Log

Tai-e starts ...
Output directory: /home/pjts/Tai-e/output
Writing options to /home/pjts/Tai-e/output/options.yml
Writing log to /home/pjts/Tai-e/output/tai-e.log
java.version: 17.0.14
java.version.date: 2025-01-21
java.runtime.version: 17.0.14+7-Ubuntu-124.04
java.vendor: Ubuntu
java.vendor.version: null
os.name: Linux
os.version: 6.11.0-21-generic
os.arch: amd64
Tai-e Version: 0.5.1
Tai-e Commit: a086cc6200102f74b303a2cb800dad4e1b8b3af5
Writing analysis plan to /home/pjts/Tai-e/output/tai-e-plan.yml
WorldBuilder starts ...
Scanning /home/pjts/Tai-e/test/tomcat-catalina-8.5.65.jar ... 732 classes
Warning: main class was not given!
8496 classes with 79384 methods in the world
WorldBuilder finishes, elapsed time: 3.29s
pta starts ...
[Pointer analysis] elapsed time: 3.27s
-------------- Pointer analysis statistics: --------------
#var pointers:                5,6018 (insens) / 5,6018 (sens)
#objects:                     6063 (insens) / 6063 (sens)
#var points-to:               377,3596 (insens) / 377,3596 (sens)
#static field points-to:      8427 (sens)
#instance field points-to:    82,6245 (sens)
#array points-to:             16,4077 (sens)
#reachable methods:           8087 (insens) / 8087 (sens)
#call graph edges:            4,3856 (insens) / 4,3857 (sens)
----------------------------------------
Dumping points-to set (without contexts) to /home/pjts/Tai-e/output/pta-ci-results.txt
pta finishes, elapsed time: 9.78s
cg starts ...
Call graph has 8087 reachable methods and 43856 edges
Dumping call graph to /home/pjts/Tai-e/output/call-graph.dot
Dumping reachable methods to /home/pjts/Tai-e/output/reachable-methods.txt
Dumping call edges to /home/pjts/Tai-e/output/call-edges.txt
cg finishes, elapsed time: 0.34s
Tai-e finishes, elapsed time: 13.49s

ℹ️ Additional Information

No response

[zhangt2333]

there is no methods and edges from the tomcat-catalina-8.5.65.jar (even no catalina keyword)

The input Java program does not contain a main class, which is essential for static analysis. Since static analysis requires an entry point, such as a public static void main(String[]) method, Tai-e is unable to analyze this program with the current setup.

the call graph result only contains methods and edges from Java standard libraries

Regarding the call graph, it currently only shows methods and edges from Java standard libraries. This is likely due to the PTA option implicit-entries:true being enabled, which activates Java implicit entry points like <java.lang.Thread: void start()>. Disabling this option will likely result in zero statistics, indicating that the current configuration is incorrect.

---

Helpful links:

• Customize multiple entry methods #112 (comment)
• https://github.com/Tai-e/Tai-e-Examples

[brant-ruan]

Thanks for your prompt response! I will try.

For the second question, if I enable the reflection inference in pta, will the result automatically appear in the constructed cg, or do I need to manually augment the call graph with the reflection inference results from pta?

[zhangt2333]

For the second question, if I enable the reflection inference in pta, will the result automatically appear in the constructed cg, or do I need to manually augment the call graph with the reflection inference results from pta?

No. Just switch on solar and it'll handle the analysis automatically.

related testcase:

• https://github.com/pascal-lab/Tai-e/blob/e3eadc9/src/test/java/pascal/taie/analysis/pta/ReflectionTest.java
• https://github.com/pascal-lab/Tai-e/blob/e3eadc9/src/test/resources/pta/reflection/

[brant-ruan]

Thanks for the kind help!