Merge pull request #803 from t1mlange/develop

Follow-up on type refinement on arrays

Author: StevenArzt

soot-infoflow-summaries/src/soot/jimple/infoflow/methodSummary/taintWrappers/SummaryTaintWrapper.java

@@ -1720,7 +1720,7 @@ protected Taint addSinkTaint(MethodFlow flow, Taint taint, GapDefinition gap, St
 		String sBaseType = sinkType == null ? null : "" + sinkType;
 		if (!flow.getIgnoreTypes()) {
 			// Compute the new base type
-			Type newBaseType = manager.getTypeUtils().getMorePreciseType(taintType, sinkType);
+			Type newBaseType = manager.getTypeUtils().getMorePreciseType(sinkType, taintType);
 			if (newBaseType == null)
 				newBaseType = sinkType;
 

soot-infoflow-summaries/summariesManual/java.util.Collection.xml

@@ -10,7 +10,7 @@
 					   ImplicitLocation="Next" />
 			</constraints>
 			<flows>
-				<flow isAlias="true" typeChecking="false" final="true">
+				<flow isAlias="withContext" typeChecking="false" final="true">
 					<from sourceSinkType="Parameter" ParameterIndex="0" />
 					<to sourceSinkType="Field"
 						AccessPath="[java.util.Collection: java.lang.Object[] innerArray]"

soot-infoflow/src/soot/jimple/infoflow/typing/TypeUtils.java

@@ -226,18 +226,18 @@ else if (fastHierarchy.canStoreType(declType, possibleRefinement))
 			// If one type is an array type and the other one is the base type,
 			// we still accept the cast
 			if (declType instanceof ArrayType && possibleRefinement instanceof ArrayType) {
-				ArrayType at1 = (ArrayType) declType;
-				ArrayType at2 = (ArrayType) possibleRefinement;
+				ArrayType at1 = (ArrayType) possibleRefinement;
+				ArrayType at2 = (ArrayType) declType;
 				if (at1.numDimensions != at2.numDimensions)
 					return null;
 				Type preciseType = getMorePreciseType(at1.getElementType(), at2.getElementType());
 				if (preciseType == null)
 					return null;
 
-				return ArrayType.v(preciseType, at1.numDimensions);
+				return ArrayType.v(preciseType, at2.numDimensions);
 			} else if (declType instanceof ArrayType) {
 				ArrayType at = (ArrayType) declType;
-				Type preciseType = getMorePreciseType(at.getElementType(), possibleRefinement);
+				Type preciseType = getMorePreciseType(possibleRefinement, at.getElementType());
 				if (preciseType == null)
 					return null;