一句话：提出Concerto，通过具体解释分析框架实现、抽象解释分析应用代码，提升框架程序静态分析精度。
现代框架广泛使用反射与元编程，使抽象解释难以既可靠又精确；手动建模虽精确但代价高。Concerto针对基于框架的应用，混合具体解释与抽象解释：利用分析时可得的具体配置，具体执行框架实现以精确解析反射等元编程惯用法；对路径无穷的应用代码则切换为抽象解释。该框架可与满足少量前置条件的任意抽象解释实例结合，且不绑定特定框架。作者形式化方法并证明可靠性、终止性等性质，并面向Java子集实现原型；结果显示混合解释显著提升了分析精度与性能。
Abstract interpretation promises sound but computable static summarization of program behavior. However, modern software engineering practices pose significant challenges to this vision, specifically the extensive use of frameworks and complex libraries. Frameworks heavily use reflection, metaprogramming, and multiple layers of abstraction, all of which confound even state-of-the-art abstract interpreters. Sound but conservative analysis of frameworks is impractically imprecise, and unsoundly ignoring reflection and metaprogramming is untenable given the prevalence of these features. Manually modeling framework behaviors offers excellent precision, at the cost of immense effort by the tool designer. To overcome the above difficulties, we present Concerto, a system for analyzing framework-based applications by soundly combining concrete and abstract interpretation. Concerto analyzes framework implementations using concrete interpretation, and application code using abstract interpretation. This technique is possible in practice as framework implementations typically follow a single path of execution when provided a concrete, application-specific configuration file which is often available at analysis time. Concerto exploits this configuration information to precisely resolve reflection and other metaprogramming idioms during concrete execution. In contrast, application code may have infinitely many paths of execution, so Concerto switches to abstract interpretation to analyze application code. Concerto is an analysis framework, and can be instantiated with any abstract interpretation that satisfies a small set of preconditions. In addition, unlike manual modeling, Concerto is not specialized to any specific framework implementation. We have formalized our approach and proved several important properties including soundness and termination. In addition, we have implemented an initial proof of concept prototype of Concerto for a subset of Java, and found that our combined interpretation significantly improves analysis precision and performance.
@article{paperbot691,
title = {Concerto: a framework for combined concrete and abstract interpretation},
author = {John Toman and Dan Grossman},
journal = {Proceedings of the ACM on Programming Languages},
volume = {3},
number = {POPL},
year = {2019},
doi = {10.1145/3290356}
}