一句话:提出从零实现的 Java 静态分析框架 Tai-e,系统比较经典框架的设计取舍并择优或重新设计,使之易学易用。
静态分析框架为缺陷检测、安全分析等应用提供中间表示、控制流图、指针分析等基础服务,但现有经典框架对依赖其开发分析的人来说并不易学易用;相比静态分析算法知识,框架设计与实现的知识积累明显不足。本文系统讨论 Java 静态分析框架关键组件的设计取舍,遵循 HGDC(Harnessing the Good Designs of Classics)原则:对每个关键组件比较 Soot、Wala、Doop、SpotBugs、Checker 等经典框架的设计选择,选取更合适者,若都不够好则提出新设计。这些设计最终构成从零实现的 Tai-e 框架,其在 IR、指针分析与新分析开发等方面具有新颖设计,形成易学易用(easy-to-learn and easy-to-use)的分析框架。据作者所知,这是首个系统探索 Java 静态分析框架设计与实现的工作,期望为构建更好的静态分析基础设施提供有益材料与视角。
Static analysis is a mature field with applications to bug detection, security analysis, program understanding, optimization, and more. To facilitate these applications, static analysis frameworks play an essential role by providing a series of fundamental services such as intermediate representation (IR) generation, control flow graph construction, points-to/alias information computation, and so on. However, although static analysis has made great strides and several well-known frameworks have emerged in this field over the past decades, these frameworks are not that easy to learn and use for developers who rely on them to create and implement analyses. In that sense, it is far from trivial to build a developer-friendly static analysis framework, because compared to the knowledge required for static analysis itself, we have significantly less knowledge designing and implementing static analysis frameworks. In this work, we take a step forward by discussing the design trade-offs for the crucial components of a static analysis framework for Java, and select the designs by following the HGDC (Harnessing the Good Designs of Classics) principle: for each crucial component of a static analysis framework, we compare the design choices made for it (possibly) by different classic frameworks such as Soot, Wala, Doop, SpotBugs and Checker, and choose arguably a more appropriate one; but if none is good enough, we then propose a better design. These selected or newly proposed designs finally constitute Tai-e, a new static analysis framework for Java, which has been implemented from scratch. Tai-e is novel in the designs of several aspects like IR, pointer analysis and development of new analyses, etc., leading to a developer-friendly (easy-to-learn and easy-to-use) analysis framework. To the best of our knowledge, this is the first work that systematically explores the designs and implementations of various static analysis frameworks for Java. We expect it to provide useful materials and viewpoints for building better static analysis infrastructures, and we hope that it could draw more attentions of the community to this challenging but tangible topic.