一句话：提出模式感知的三地址码翻译与剪枝式类型推断，构建高效且可靠的 Java 字节码前端。
在 Java 静态分析框架中，字节码前端负责将基于栈的复杂 Java 字节码转换为更易分析的、基于寄存器的带类型三地址码，其效率对大规模应用的整体分析性能影响重大，而 Soot、WALA 等主流框架的前端效率不足。本文针对前端两个关键阶段提出新方法：在三地址码翻译阶段，识别字节码中的常见模式以实现更高效的处理（模式感知翻译）；在类型推断阶段，发现传统算法存在冗余计算，据此提出剪枝式类型推断。二者共同构成新前端，并可额外生成 SSA IR，提升对各类静态分析技术的可用性。作者在 Tai-e 中实现该前端，并在多种 Java 应用上进行评估，结果显示其效率显著优于 Soot、WALA 和 SootUp，平均分别快 14.2 倍、14.5 倍和 75.2 倍；附加实验还表明其在处理字节码时比这些工具更可靠，为 Java 静态分析提供了更稳健的基础。
In static analysis frameworks for Java, the bytecode frontend serves as a critical component, transforming complex, stack-based Java bytecode into a more analyzable register-based, typed 3-address code representation. This transformation often significantly influences the overall performance of analysis frameworks, particularly when processing large-scale Java applications, rendering the efficiency of the bytecode frontend paramount for static analysis. However, the bytecode frontends of currently dominant Java static analysis frameworks, Soot and WALA, despite being time-tested and widely adopted, exhibit limitations in efficiency, hindering their ability to offer a better user experience. To tackle efficiency issues, we introduce a new bytecode frontend. Typically, bytecode frontends consist of two key stages: (1) translating Java bytecode to untyped 3-address code, and (2) performing type inference on this code. For 3-address code translation, we identified common patterns in bytecode that enable more efficient processing than traditional methods. For type inference, we found that traditional algorithms often include redundant computations that hinder performance. Leveraging these insights, we propose two novel approaches: pattern-aware 3-address code translation and pruning-based type inference, which together form our new frontend and lead to significant efficiency improvements. Besides, our approach can also generate SSA IR, enhancing its usability for various static analysis techniques. We implemented our new bytecode frontend in Tai-e, a recent state-of-the-art static analysis framework for Java, and evaluated its performance across a diverse set of Java applications. Experimental results demonstrate that our frontend significantly outperforms Soot, WALA, and SootUp (an overhaul of Soot)—in terms of efficiency, being on average 14.2×, 14.5×, and 75.2× faster than Soot, WALA, and SootUp, respectively. Moreover, additional experiments reveal that our frontend exhibits superior reliability in processing Java bytecode compared to these tools, thus providing a more robust foundation for Java static analysis.
@article{paperbot2894,
title = {Two Approaches to Fast Bytecode Frontend for Static Analysis},
author = {Chenxi Li and Haoran Lin and Tian Tan and Yue Li},
journal = {Proceedings of the ACM on Programming Languages},
volume = {9},
number = {OOPSLA2},
year = {2025},
doi = {10.1145/3763081}
}