一句话：通过31个真实Java程序的执行预言机，实证测量多种静态调用图算法的召回率，并定位导致漏报的语言特性。
静态分析在保持可接受精度的同时，难以健全地建模动态语言特性；该问题理论上已知，但缺乏真实程序中的影响证据。本文针对调用图构建，选取31个真实Java程序，从内置测试与合成的高覆盖率测试执行中记录实际程序行为作为预言机，以度量各类静态分析算法及其配置的召回率，并分析哪些语言特性会导致静态分析假阴性（漏报）。结果揭示了实践中的召回率状况，并识别出造成漏报的特性，为改进静态调用图构建提供实证依据。
Static analyses have problems modelling dynamic language features soundly while retaining acceptable precision. The problem is well-understood in theory, but there is little evidence on how this impacts the analysis of real-world programs. We have studied this issue for call graph construction on a set of 31 real-world Java programs using an oracle of actual program behaviour recorded from executions of built-in and synthesised test cases with high coverage, have measured the recall that is being achieved by various static analysis algorithms and configurations, and investigated which language features lead to static analysis false negatives.
DOI 原文 ·
@inproceedings{paperbot5619,
title = {On the recall of static call graph construction in practice},
author = {Li Sui and Jens Dietrich and Amjed Tahir and George Fourtounis},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380441}
}