secure-software-engineering
Another reason for the unstable propagation of the faster IFDS solver
Another unstable reason is due to the invocation order of isCallSiteActivatingTaint (contains the read of activationUnitsToCallSites) and registerActivationCallSite (contains the write of activationUnitsToCallSites).
For a given activation unit, the difference invocation order to isCallSiteActivatingTaint and registerActivationCallSite results in different sizes of propagated path edges.
registerActivationCallSite is only invoked in the backward solver. However, isCallSiteActivatingTaint is invoked in both backward and forward solvers.
It's not easy to solve this issue. One possible solution is to separate the processing of the forward solver and the backward solver. For example, if there exists a backward path edge for processing, we always process the backward path edge first. But this only determines the order between solvers. As mentioned earlier, the backward solver invokes both isCallSiteActivatingTaint and registerActivationCallSite. Probably, we should also comment on the usage of isCallSiteActivatingTaint in the backward solver.
