一句话：提出用动态基线近似真值并结合覆盖引导模糊测试，评估真实 Java 程序上静态调用图的质量。
静态调用图是程序分析的基础构件，但调用图构造差异与语言特性会导致不可靠和不精确。由于真实程序的调用图真值通常无法获得，仅用精度和召回率评估十分困难。本文提出基于固定入口点和输入语料的动态基线方法，将动态基线的构造视为对真值的近似，并形式化为优化问题；同时利用人工扩展和覆盖引导模糊测试生成合适输入语料。作者在四个真实 Java 程序上，用这些动态基线研究了多种算法与实现的调用图质量，发现该方法能深入揭示调用图质量及其度量方式，为推进静态程序分析核心数据结构的研究提供了新方法论。
Static call graphs are a fundamental building block of program analysis. However, differences in call-graph construction and the use of specific language features can yield unsoundness and imprecision. Call-graph analyses are evaluated using measures of precision and recall, but this is hard when a ground truth for real-world programs is generally unobtainable. In this work, we propose to use carefully constructed dynamic baselines based on fixed entry points and input corpora. The creation of this dynamic baseline is posed as an approximation of the ground truth---an optimization problem. We use manual extension and coverage-guided fuzzing for creating suitable input corpora. With these dynamic baselines, we study call-graph quality of multiple algorithms and implementations using four real-world Java programs. We find that our methodology provides valuable insights into call-graph quality and how to measure it. With this work, we provide a novel methodology to advance the field of static program analysis as we assess the computation of one of its core data structures---the call graph.
@inproceedings{paperbot8572,
title = {Total Recall? How Good Are Static Call Graphs Really?},
author = {Dominik Helm and Sven Keidel and Anemone Kampkötter and Johannes Düsing and Tobias Roth and Ben Hermann and Mira Mezini},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652114}
}