Email from Richard Halpert about this analysis:


We have an only-visited-once analysis, which can be used for cheap must-alias analysis: if a reference has reaching objects from only one allocation site, and the allocation site is run only once, then the reference must alias the one object that gets created.

Look inside src/soot/toolkits/mhp/. In the findobject folder, the AllocNodesFinder? class will get a list of all allocation nodes in your application classes, and a list of all allocation nodes that may be run more than once. UnsynchronizedMhpAnalysis? uses the AllocNodesFinder?... you can look there for an example.

If you want more raw run-once, run-many data, you can use MultiCalledMethods? (finds methods called from more than one place) and MultiRunStatementsFinder? (finds statements and method calls run in a loop inside a given method) together to get a list of every statement that may be run more than once. This is roughly what AllocNodesFinder? does (if you're looking for an example), but it throws out a lot of the data.

Let me know if you need any help with it. All of these classes are fairly well tested despite the big warning at the top of the files.