paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Judge: identifying, understanding, and evaluating sources of unsoundness in call graphs

Judge:识别、理解与评估调用图中不健全性的来源
ISSTA Proceedings of the 28th ACM SIGSOFT International Symposium on Software Testing and Analysis2019匹配度 4/10 · 该论文研究 Java 字节码调用图的不健全性来源与评估,属于静态程序分析/调用图基础工作,与用户关注的静态分析主题有间接关联;但它不涉及 LLM/Agent、ML 系统、浮点程序分析或贝叶斯程序分析,也未讨论 AI 与 PL 的交叉,因此只与更广义的静态分析背景部分匹配。引用 39 inbox
Michael Reif, Florian Kübler, Michael Eichberg, Dominik Helm, Mira Mezini
crossref: 2026-09-12

AI 速览

一句话:提出 Judge 工具链,识别并评估调用图不健全性的来源,刻画 Soot/WALA/DOOP/OPAL 的健全性能力。

调用图广泛用于控制流与数据流分析,但对其不健全性来源、普遍程度及现有算法的支持能力缺乏系统认识。本文提出 Judge 工具链,帮助理解不健全性来源并提升调用图健全性。基于针对不健全性来源的测试集,作者为 Soot、WALA、DOOP、OPAL 的调用图实现计算能力画像,统计现代 Java 字节码中影响健全性的语言特性与 API 的出现频率,比较四个框架调用图的实现差异,并评估达到项目特定合理健全调用图所需的工作量。结果显示:影响健全性的特性/API 被频繁使用,各框架的支持程度差异极大,甚至同一基础算法(如 RTA)在不同框架下的调用图也无法直接比较;Judge 能帮助用户以合理代价建立调用图的健全性。

问题
调用图的不健全性来源、其在实际代码中的普遍性,以及现有调用图算法与框架对这些来源的支持能力,缺乏系统的理解与评估手段。
方法
提出 Judge 工具链及一组针对不健全性来源的测试集,据此为调用图实现计算能力画像、统计影响健全性的语言特性与 API 的使用频率、跨框架比较调用图,并度量达到健全性所需的工作量。
评估
对 Soot、WALA、DOOP、OPAL 四个框架的调用图实现进行能力画像与交叉比较,并在现代 Java 字节码上测量影响健全性的特性/API 出现频率及建立项目特定合理健全调用图的成本。
原文摘要(Abstract)

Call graphs are widely used; in particular for advanced control- and data-flow analyses. Even though many call graph algorithms with different precision and scalability properties have been proposed, a comprehensive understanding of sources of unsoundness, their relevance, and the capabilities of existing call graph algorithms in this respect is missing. To address this problem, we propose Judge, a toolchain that helps with understanding sources of unsoundness and improving the soundness of call graphs. In several experiments, we use Judge and an extensive test suite related to sources of unsoundness to (a) compute capability profiles for call graph implementations of Soot, WALA, DOOP, and OPAL, (b) to determine the prevalence of language features and APIs that affect soundness in modern Java Bytecode, (c) to compare the call graphs of Soot, WALA, DOOP, and OPAL – highlighting important differences in their implementations, and (d) to evaluate the necessary effort to achieve project-specific reasonable sound call graphs. We show that soundness-relevant features/APIs are frequently used and that support for them differs vastly, up to the point where comparing call graphs computed by the same base algorithms (e.g., RTA) but different frameworks is bogus. We also show that Judge can support users in establishing the soundness of call graphs with reasonable effort.

链接与引用

DOI 原文 ·

BibTeX
@inproceedings{paperbot5384,
  title = {Judge: identifying, understanding, and evaluating sources of unsoundness in call graphs},
  author = {Michael Reif and Florian Kübler and Michael Eichberg and Dominik Helm and Mira Mezini},
  booktitle = {ISSTA},
  year = {2019},
  doi = {10.1145/3293882.3330555}
}