Skip to content

Performance issues and bugs corrections - #26

Open
borisaraujo wants to merge 18 commits into
developfrom
issue/callgraph-traversal
Open

borisaraujo wants to merge 18 commits into
developfrom
issue/callgraph-traversal

Conversation

@borisaraujo

Copy link
Copy Markdown

The underlying graph library already tracks edge identity, and insertion into a set is idempotent: no need to manually check whether an edge already exists before adding it.

… graph library already tracks edge identity, and insertion into a set is idempotent: no need to manually check whether an edge already exists before adding it.
@borisaraujo
borisaraujo requested a review from rbonifacio August 17, 2026 19:14
@borisaraujo borisaraujo self-assigned this Aug 19, 2026
…imited the number of polymorphic procedures that could be visited.
…s() in findFieldStores; bump default sbt heap for the securibench runner. RTA (and VTA/SPARK) can still blow up memory building the call graph over the wide include-list, needs a follow-up fix.
…recompiling a regex Pattern for a literal single-character replacement.
…call instead of one per allocation site; validity checked via native set intersection, not string equality of a single sampled site.
…y set from Spark means 'no allocation site to offer', not 'provably empty' — fixes a SPARK precision regression.
…xpansion is sorted by a content-based key instead of JVM identity-hash Set iteration order.
…each had a 'return' that stopped after the first unvisited neighbor, silently skipping real paths through the rest.
… stack-based DFS instead of recursive, and scoped to nodes that can actually reach the target.
… a branch as soon as its running points-to intersection is empty, instead of validating a fully built candidate afterward.
…g at all, so a densely connected slice could otherwise run unbounded.
…ty set from Spark means no allocation-site info, not two objects provably being different — same reasoning as the getPointsToSet fix, applied to this alias check.
…ck box by definition; nothing inside whatever CHA resolved should refine that.
…d is always abstract for a polymorphic call site, so this was unconditionally discarding every such call's interprocedural flow.
…LowerCase/trim/replace/substring now use CopyFromMethodCallToLocal, letting value chains through them propagate taint.
…h larger call graphs than CHA and are prone to GC-thrashing/OOM on a small inherited heap.
…t from the previous commit overridable instead of hardcoded.
@borisaraujo borisaraujo changed the title Avoid rebuilding the edge set on every edge insertion Performance issues and bugs corrections Aug 26, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant