paperbot · PL 论文追踪

全部论文 待读 收藏

P2 Tai-e: A Developer-Friendly Static Analysis Framework for Java by Harnessing the Good Designs of Classics

Tai-e:借力经典优良设计、面向开发者友好的 Java 静态分析框架
ISSTA Proceedings of the 32nd ACM SIGSOFT International Symposium on Software Testing and Analysis2023匹配度 4/10 · 该论文是 Java 静态分析框架的设计与实现,属于程序分析基础设施,可能为将静态分析用于 Java/Agentic 程序提供工具基础;但它不涉及 LLM/Agent、浮点程序分析或贝叶斯程序分析,与画像中的核心交叉方向只有间接关联。引用 50 inbox
Tian Tan, Yue Li
crossref: 2026-09-12dblp: 2026-09-12

AI 速览

一句话:提出从零实现的 Java 静态分析框架 Tai-e,系统比较经典框架的设计取舍并择优或重新设计,使之易学易用。

静态分析框架为缺陷检测、安全分析等应用提供中间表示、控制流图、指针分析等基础服务,但现有经典框架对依赖其开发分析的人来说并不易学易用;相比静态分析算法知识,框架设计与实现的知识积累明显不足。本文系统讨论 Java 静态分析框架关键组件的设计取舍,遵循 HGDC(Harnessing the Good Designs of Classics)原则:对每个关键组件比较 Soot、Wala、Doop、SpotBugs、Checker 等经典框架的设计选择,选取更合适者,若都不够好则提出新设计。这些设计最终构成从零实现的 Tai-e 框架,其在 IR、指针分析与新分析开发等方面具有新颖设计,形成易学易用(easy-to-learn and easy-to-use)的分析框架。据作者所知,这是首个系统探索 Java 静态分析框架设计与实现的工作,期望为构建更好的静态分析基础设施提供有益材料与视角。

问题
静态分析框架需提供 IR 生成、控制流图构建、指针/别名信息计算等基础服务,但已有经典框架对开发者而言学习与使用门槛较高,且社区关于框架本身如何设计与实现的知识远少于静态分析算法知识。
方法
针对静态分析框架的各个关键组件,对比 Soot、Wala、Doop、SpotBugs、Checker 等经典框架所做的设计选择,遵循 HGDC 原则选用更合适的设计,若均不够好则提出新设计,并据此从零实现 Java 框架 Tai-e。
评估
通过系统讨论与横向比较各经典框架在 IR、指针分析及新分析开发等组件上的设计取舍与实现,论证 Tai-e 的开发者友好性;据作者所知,这是首个系统探索 Java 静态分析框架设计与实现的工作,未报告定量实验评估。
原文摘要(Abstract)

Static analysis is a mature field with applications to bug detection, security analysis, program understanding, optimization, and more. To facilitate these applications, static analysis frameworks play an essential role by providing a series of fundamental services such as intermediate representation (IR) generation, control flow graph construction, points-to/alias information computation, and so on. However, although static analysis has made great strides and several well-known frameworks have emerged in this field over the past decades, these frameworks are not that easy to learn and use for developers who rely on them to create and implement analyses. In that sense, it is far from trivial to build a developer-friendly static analysis framework, because compared to the knowledge required for static analysis itself, we have significantly less knowledge designing and implementing static analysis frameworks. In this work, we take a step forward by discussing the design trade-offs for the crucial components of a static analysis framework for Java, and select the designs by following the HGDC (Harnessing the Good Designs of Classics) principle: for each crucial component of a static analysis framework, we compare the design choices made for it (possibly) by different classic frameworks such as Soot, Wala, Doop, SpotBugs and Checker, and choose arguably a more appropriate one; but if none is good enough, we then propose a better design. These selected or newly proposed designs finally constitute Tai-e, a new static analysis framework for Java, which has been implemented from scratch. Tai-e is novel in the designs of several aspects like IR, pointer analysis and development of new analyses, etc., leading to a developer-friendly (easy-to-learn and easy-to-use) analysis framework. To the best of our knowledge, this is the first work that systematically explores the designs and implementations of various static analysis frameworks for Java. We expect it to provide useful materials and viewpoints for building better static analysis infrastructures, and we hope that it could draw more attentions of the community to this challenging but tangible topic.

链接与引用

DOI 原文 · PDF(开放获取) · DBLP

BibTeX
@inproceedings{TanL23,
  title = {Tai-e: A Developer-Friendly Static Analysis Framework for Java by Harnessing the Good Designs of Classics},
  author = {Tian Tan and Yue Li},
  booktitle = {ISSTA},
  year = {2023},
  doi = {10.1145/3597926.3598120}
}