A class with the same name (in fact, it's the exact same class copied) in two different files results in an imprecise pointer analysis for self

[khatchad]

What I am seeing with Python is that there is a class with the same name (in fact, it's the exact same class copied) in two different files:

• https://github.com/kyzhouhzau/NLPGNN/blob/b9ecec2c6df1b3e40a54511366dcb6085cf90c34/tests/TG/EN/generation.py#L31-L41
• https://github.com/kyzhouhzau/NLPGNN/blob/b9ecec2c6df1b3e40a54511366dcb6085cf90c34/tests/TG/EN/interactive.py#L28-L38

During the execution of my overridden getCalleeTarget(), I use the PA to look up the receiver of a method in one of the (duplicate) classes that reside in different files. I get back instances of both classes, although self can never refer to an instance of the other (duplicate) class.

This situation sounds like a bug to me more so than imprecision, and I am surprised to see it because we have added the full path to the CGNode names, for example:

Add constraints from node Node: synthetic < PythonLoader, L$script tests/TG/EN/generation.py/GenGPT2/predict, trampoline3()LRoot; > Context: CallStringContext: [ script nlpgnn.sample.samples.py.sample_sequence.step.do()LRoot;@2 ]
synthetic < PythonLoader, L$script tests/TG/EN/generation.py/GenGPT2/predict, trampoline3()LRoot; >
CFG:
BB0[0..0]
    -> BB1
    -> BB5
BB1[1..1]
    -> BB2
    -> BB5
BB2[2..2]
    -> BB3
    -> BB5
BB3[3..3]
    -> BB4
    -> BB5
BB4[4..4]
    -> BB5
BB5[-1..-2]
Instructions:
BB0
0   v4 = getfield < PythonLoader, LRoot, $function, <PythonLoader,LRoot> > v1
BB1
1   v5 = checkcast <PythonLoader,Lscript tests/TG/EN/generation.py/GenGPT2/predict>v4
BB2
2   v6 = getfield < PythonLoader, LRoot, $self, <PythonLoader,LRoot> > v1
BB3
3   v7 = invokeFunction < PythonLoader, LCodeBody, do()LRoot; > v5,v6,v2,v3 @2 exception:v8
BB4
4   return v7                                
BB5

The only thing I could think about was that perhap the call stack was too long. Every call gets its own node with a call string context of seemingly length 1. But, I failed to come up with a reproducible simple test cases that exercises this behavior, even after lengthening the call stack. This case is pretty complicated with a fair amount of lexical scoping if you look at the callers of the method.

In the end, I wind up with a set of two instances for the pointer key for self, one of which represents a class in a different file.

Originally posted by @khatchad in #1417 (reply in thread)

[khatchad]

Oh that's weird. I told GitHub to make this issue in http://github.com/wala/ML, but it made it here instead. Can it be transfered?

[msridhar]

I don't know how to transfer the issue. Maybe close and reopen?