一句话:实证评估 CodeQL 生产分析的复用潜力,并实现可随代码改动规模伸缩的增量求解器原型。
这篇论文研究 CodeQL 这类生产级静态分析能否通过增量计算加速。传统增量分析先完整分析一次代码库,再根据代码变更更新旧结果;但复杂分析常含过程间和上下文敏感特性,可能抵消增量收益。作者首先在真实代码库上测量可复用性,验证增量化的潜力;随后为 CodeQL 实现原型增量求解器,利用已有分析结果处理变更。实验表明,更新耗时可与代码变更规模成正比,但原型仍存在局限。该工作为在 GitHub Pull Request 上提供自动反馈的静态分析工具探索了增量部署路径。
Instead of repeatedly re-analyzing from scratch, an incremental static analysis only analyzes a codebase once completely, and then it updates the previous results based on the code changes. While this sounds promising to achieve speed-ups, the reality is that sophisticated static analyses typically employ features that can ruin incremental performance, such as inter-procedurality or context-sensitivity. In this study, we set out to explore whether incrementalization can help to achieve speed-ups for production CodeQL analyses that provide automated feedback on pull requests on GitHub. We first empirically validate the idea by measuring the potential for reuse on real-world codebases, and then we create a prototype incremental solver for CodeQL that exploits incrementality. We report on experimental results showing that we can indeed achieve update times proportional to the size of the code change, and we also discuss the limitations of our prototype.