import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
private IClass getLayoutClass(IClassHierarchy cha, String clazzName) {
	// This is due to the fault-tolerant xml parser
	if (clazzName.equals("view")) clazzName = "View";

	IClass iclazz = null;
	if (iclazz == null)
		iclazz = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application, Utils.convertToBrokenDexBytecodeNotation(clazzName)));
	if (iclazz == null && !packageName.isEmpty())
		iclazz = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application, Utils.convertToBrokenDexBytecodeNotation(packageName + "." + clazzName)));
	if (iclazz == null)
		iclazz = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application, Utils.convertToBrokenDexBytecodeNotation("android.widget." + clazzName)));
	if (iclazz == null)	
		iclazz = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application, Utils.convertToBrokenDexBytecodeNotation("android.webkit." + clazzName)));
	if (iclazz == null)
		iclazz = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application, Utils.convertToBrokenDexBytecodeNotation("android.view." + clazzName)));
	
	// PreferenceScreen, PreferenceCategory, (i)shape, item, selector, scale, corners, solid .. tags are no classes and thus there will be no corresponding layout class
	if (iclazz == null)	
		logger.trace(Utils.INDENT + "Could not find layout class " + clazzName);

	return iclazz;
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Adds a transfer site with every transfer which is not known to be safe. If all of the
 * transfers at a transfer site are known to be safe, then no transfer point is added.
 */
protected void foundTransferringSite(CGNode node, SSAAbstractInvokeInstruction invokeInstr)
{
    // Return static methods and dispatch methods with only the receiver argument.
    if (invokeInstr.isStatic() || invokeInstr.getNumberOfParameters() == 1)
        return;

    // Ignore any method which is not a procedure invocation on a remote capsule instance.
    IMethod targetMethod = cha.resolveMethod(invokeInstr.getDeclaredTarget());
    if (! isRemoteProcedure(targetMethod))
        return;
    
    MutableIntSet transfers = new BitVectorIntSet();
    
    for (int idx = 1; idx < targetMethod.getNumberOfParameters(); idx++)
    {
        TypeReference paramType = targetMethod.getParameterType(idx);
        if (! isKnownSafeTypeForTransfer(paramType)) {
            transfers.add(invokeInstr.getUse(idx));
        }
    }
    
    if (! transfers.isEmpty()) {
        addTransferringSite(node, new InvokeTransferSite(node, transfers, invokeInstr));
    }
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * @see makeArgument
 */
protected int makeReceiver(AbstractRootMethod root)
{
    constZeroValueNumber = root.addLocal();
    
    // Instantiate a capsule core instance to serve as this entrypoint's receiver object.
    // Note that every capsule core must (only) have the default constructor.
    TypeReference receiverType = method.getParameterType(0);
    SSANewInstruction receiverAllocation = root.addAllocation(receiverType);
    if (receiverAllocation == null)
        return -1;
    int receiverValueNumber = receiverAllocation.getDef();
    
    // Make a capsule mockup instance for each of the receiver's fields (i.e. all of its
    // `@Local`, `@Import`, and state fields).
    for (IField f : core.getAllFields()) {
        addCoreFieldInstance(root, f, receiverValueNumber);
    }
    
    // Initialize the newly created receiver object.
    // TODO: Debug and re-enable this.
    makeReceiverInitInvocation(root, receiverValueNumber);
    
    return receiverValueNumber;
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Adds an instance to the core field's. The behavior of this method will depend upon the
 * field's type and annotations. For example, if a the field is primitive or effectively
 * immutable, nothing is instantiated; if it is a capsule interface, it will delegate to
 * `addCapsuleMockup()`.
 * 
 * @param root  The fake root method to which the instantiation instructions are being added.
 * @param field A field on `core`.
 * @param receiverValueNumber Value number of the receiver instance whose field to which some
 *                            kind of object instance is being added.
 */
protected void addCoreFieldInstance(AbstractRootMethod root, IField field, int receiverValueNumber)
{
    TypeReference fieldTypeRef = field.getFieldTypeReference();
    
    if (fieldTypeRef.isArrayType()) {
        addCoreFieldArrayInstance(root, field, receiverValueNumber);
        return;
    }

    if (fieldTypeRef.isPrimitiveType() || isKnownToBeEffectivelyImmutable(fieldTypeRef)) {
        // No need to add instances for these types.
        return;
    }

    if (PaniniModel.isCapsuleInterface(getCha().lookupClass(fieldTypeRef))) {
        addCapsuleMockupInstance(root, field, receiverValueNumber);
        return;
    }

    // Otherwise, consider the field to be non-capsule state variable.
    addStateInstance(root, field, receiverValueNumber);
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
private boolean isTypeValue(int valueNumber, TypeReference type) {
   IR ir = node.getIR();
   if (ir.getSymbolTable().isNullConstant(valueNumber)) {
return false;
   }

   PointerKey pk = new LocalPointerKey(node, valueNumber);
   OrdinalSet<? extends InstanceKey> types = PA.getPointsToSet( pk );
   if (types.isEmpty()) {
     assert
       !types.isEmpty() :
       "no types for " + valueNumber + " of " + node;
   }
   boolean result = true;
   for(Iterator<? extends InstanceKey> ts = types.iterator(); ts.hasNext(); ) {
     InstanceKey t = ts.next();
     if (! t.getConcreteType().getReference().equals(type)) {
result = false;
     }
   }
   return result;
 }
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Returns an Options instance initialized with default values.
 * @effects 
 * this.isContextSensitive' = true and
 * this.loopUnrollDepth' = 3 and
 * this.openWorldScopeSize' = 4 and
 * this.numberOfIndexAtoms' =  10 and
 * this.recursionLimit' = 1 and
 * this.primordialConcreteTypes' = {int, String} and
 * this.kodkodOptions'.solver = SATFactory.MiniSAT and
 * this.kodkodOptions'.bitwidth = 8 and 
 * this.memoryModel' = RelaxedModelFactory and
 * this.assertsAreAssumptions = false
 */
public Options() {
	this.isContextSensitive = true;
	this.loopUnrollDepth = 3;
	this.openWorldScopeSize = 4;
	this.numberOfIndexAtoms = 10;
	this.recursionLimit = 1;
	this.primordialConcreteTypes = new HashSet<TypeReference>();
	primordialConcreteTypes.add(TypeReference.JavaLangInteger);
    primordialConcreteTypes.add(TypeReference.JavaLangString);
	this.undefinedType = null;
	this.kodkodOptions = new kodkod.engine.config.Options();
	kodkodOptions.setBitwidth(8);
	kodkodOptions.setSolver(SATFactory.MiniSat);
	this.memoryModel = null;
	this.assertsAreAssumptions = false;
	this.eclipseProjectName = null;
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Returns a method reference for the given method 
 * @return method reference for the given Method */
public static MethodReference method(Method jmethod) { 
	final TypeReference declaringClass = typeReference(jmethod.getDeclaringClass());

	final StringBuilder descriptor = new StringBuilder("(");
	for(Class<?> paramType : jmethod.getParameterTypes()) { 
		descriptor.append(bytecodeDescriptor(paramType));
	}
	descriptor.append(")");
	descriptor.append(bytecodeDescriptor(jmethod.getReturnType()));
	
	return MethodReference.findOrCreate(
			declaringClass,
			Atom.findOrCreateUnicodeAtom(jmethod.getName()), 
			Descriptor.findOrCreateUTF8(descriptor.toString()));
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Looks up an IClass for a given class name
 * @param cha  a {@link IClassHierarchy}
 * @param clazzName  in java notation, e.g. "de.infsec.MyActivity"
 * @return a {@link IClass} object
 * @throws ClassNotFoundException
 */
public static IClass lookupClass(IClassHierarchy cha, String clazzName) throws ClassNotFoundException {
	if (clazzName == null)
		throw new ClassNotFoundException(Utils.INDENT + "class name is NULL");
	
	String convertedClass = Utils.convertToBrokenDexBytecodeNotation(clazzName);
	IClass iclazz = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application, convertedClass));
	
	if (iclazz == null)
		throw new ClassNotFoundException(Utils.INDENT + "[lookupClass] Could'nt lookup IClass for " + clazzName);
	
	return iclazz;
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
private static Iterable<Entrypoint> makePublicEntrypoints(AnalysisScope scope, IClassHierarchy cha, String entryClass) {
  Collection<Entrypoint> result = new ArrayList<Entrypoint>();
  IClass klass = cha.lookupClass(TypeReference.findOrCreate(ClassLoaderReference.Application,
      StringStuff.deployment2CanonicalTypeString(entryClass)));
  for (IMethod m : klass.getDeclaredMethods()) {
    if (m.isPublic()) {
      result.add(new DefaultEntrypoint(m, cha));
    }
  }
  return result;
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * TODO: Is this method name an accurate description of what this bypass logic is doing?
 */
private static void setToSynthesizeNativeClasses(IClassHierarchy cha,
                                                 AnalysisOptions options,
                                                 XMLMethodSummaryReader natives)
{
    IClassLoader loader = cha.getLoader(cha.getScope().getSyntheticLoader());
    Set<TypeReference> allocatable = natives.getAllocatableClasses();
    ClassTargetSelector parent = options.getClassTargetSelector();

    ClassTargetSelector child = new BypassClassTargetSelector(parent, allocatable, cha, loader);
    options.setSelector(child);
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
   * @param cha
   * @param coreName The name of the core to be analyzed. Should be something of the form
   *                 `-Lorg/paninij/soter/FooCore`.
   */
  public static IClass loadCoreClass(String coreName, IClassHierarchy cha)
  {
      AnalysisScope scope = cha.getScope();
      ClassLoaderReference appLoaderRef = scope.getApplicationLoader();
TypeReference typeRef = TypeReference.findOrCreate(appLoaderRef, coreName);

      IClass coreClass = cha.lookupClass(typeRef);
      if (coreClass == null)
      {
          String msg = "Failed to load a core's `IClass`: " + coreName;
          throw new IllegalArgumentException(msg);
      }
      return coreClass;
  }
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
public static TypeReference getCapsuleMockupClassReference(TypeReference capsuleInterface)
{
    ClassLoaderReference loader = capsuleInterface.getClassLoader();

    TypeName interfaceName = capsuleInterface.getName();
    String pkg = interfaceName.getPackage().toString();
    String name = interfaceName.getClassName().toString() + CAPSULE_MOCKUP_SUFFIX;

    return TypeReference.findOrCreateClass(loader, pkg, name);
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * If appropriate, instantiate and add an array instance in the given fake root.
 */
protected void addCoreFieldArrayInstance(AbstractRootMethod root, IField field,
                                             int receiverValueNumber)
{
    // Currently, when an array is instantiated it is instantiated with size 1, and when
    // elements need to be instantiated only the 0th is instantiated.
    // TODO: Is this bad?
    final int DEFAULT_ARRAY_LENGTH = 1;

    TypeReference arrayTypeRef = field.getFieldTypeReference();
    int dimensionality = arrayTypeRef.getDimensionality();
    if (dimensionality > 1)
    {
        String msg = "TODO: Cannot yet add instances for array whose dimensionality is ";
        throw new UnsupportedOperationException(msg + dimensionality);
    }
    
    SSAInstruction newArrayInstr = root.add1DArrayAllocation(arrayTypeRef, DEFAULT_ARRAY_LENGTH);

    TypeReference elemTypeRef = arrayTypeRef.getArrayElementType();
    if (elemTypeRef.isPrimitiveType() || isKnownToBeEffectivelyImmutable(elemTypeRef))
    {
        // No need to add instances for the elements of these types of arrays.
        return;
    }

    // Add a single new mockup instance if the array's elements are capsule interfaces.
    if (PaniniModel.isCapsuleInterface(getCha().lookupClass(elemTypeRef)))
    {
        int mockupValueNumber = newCapsuleMockupInstance(root, elemTypeRef);
        root.addSetArrayField(elemTypeRef, newArrayInstr.getDef(), constZeroValueNumber,
                              mockupValueNumber);
        return;
    }
    
    // Otherwise, assume that the elements of the array should be initialized in source code.
    // TODO: Is this right.
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
public Iterator<Entrypoint> iterator() {

		return new Iterator<Entrypoint>() {
			private int index = 0;
			private final int subtypesBound = 10;

			public void remove() {
				Assertions.UNREACHABLE();
			}

			public boolean hasNext() {
				return index < methods.size();
			}

			public Entrypoint next() {
			  return
				new SubtypesEntrypoint(methods.get(index++), cha)
				{
					protected TypeReference[] makeParameterTypes(IMethod method, int i) 
					{
						TypeReference[] all = super.makeParameterTypes(method, i);
						if (all.length > subtypesBound) {
							TypeReference[] some = new TypeReference[ subtypesBound ];
							for(int j = 0; j < subtypesBound; j++) {
								some[j] = all[j];
							}

							return some;
						} else {
							return all;
						}
					}
				};
			}
		};
	}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Returns an expression that models the set of all instances of the given type.
 * @return an expression that models the set of all instances of the given type.
 */
public final Expression valueOf(TypeReference type) { 
	final List<Expression> parts = new ArrayList<Expression>();
	for(InstanceKey key : sets.keySet()) { 
		IClassHierarchy cha = key.getConcreteType().getClassHierarchy();
		if (cha.isSubclassOf(key.getConcreteType(), cha.lookupClass(type))) {
			parts.add(sets.get(key));
		}
	}
	return parts.isEmpty() ? Expression.NONE : Expression.union(parts);
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Returns an interpreter for the value read or written by the given inlined instruction.
 * @requires inst.action in NORMAL_READ + VOLATILE_READ + NORMAL_WRITE + VOLATILE_WRITE
 * @return an interpreter for the value read or written by the given inlined instruction.
 */
private final Interpreter<Object> valueInterpreter(InlinedInstruction inst) { 
	final ConstantFactory consts = translation.factory().constants();
	final TypeReference type;
	if (inst.instruction() instanceof SSAFieldAccessInstruction) { 
		type = ((SSAFieldAccessInstruction)inst.instruction()).getDeclaredFieldType();
	} else {
		type = ((SSAArrayReferenceInstruction)inst.instruction()).getElementType();
	}
	return consts.interpreter(IRType.convert(type));
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/**
 * Returns the type reference for the given class. 
 * @return type reference for the given class */
public static TypeReference typeReference(Class<?> jclass) { 
	return TypeReference.findOrCreate(
			JavaSourceAnalysisScope.SOURCE, 
			"L" + jclass.getName().replace('.','/'));
	
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
public static boolean isKnownToBeEffectivelyImmutable(TypeReference typeRef)
{
    return isKnownToBeEffectivelyImmutable(typeRef.getName().toString());
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
public static boolean isKnownSafeTypeForTransfer(TypeReference typeRef)
{
    // TODO: Add String and primitive box types (e.g. Integer).
    return typeRef.isPrimitiveType();
}
 

import com.ibm.wala.types.TypeReference; //导入依赖的package包/类
/** @return method reference corresponding to the given arguments */
private static MethodReference method(TypeReference type, String name, String descriptor) { 
	return MethodReference.findOrCreate(type, 
			Atom.findOrCreateUnicodeAtom(name), 
			Descriptor.findOrCreateUTF8(descriptor));
}