Judge: identifying, understanding, and evaluating sources of unsoundness in call graphs

Reif, Michael; Kübler, Florian; Eichberg, Michael; Helm, Dominik; Mezini, Mira

doi:10.1145/3293882.3330555

Cited by 30 publications

(28 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In this section, we discuss initial results for the research question: RQ Does the approach improve in terms of soundness with respect to serialization features? To answer this question, we run Salsa with the Java Call Graph Test Suite (JCG) [13,29,30]. This test suite contains nine test cases (Ser1-9) with serialization or deserialization in it.…”

Section: Early Resultsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Dynamic features are heavily used in contemporary software systems [21,29] to link/load new class libraries, methods, and objects and extend the programs' functionalities. Therefore, ignoring such constructs leads to unsound callgraphs; they miss feasible runtime paths because they cannot infer the possible execution from the code [29,30,37]. To tackle this problem, previous literature explored certain classes of dynamic features, such as reflection features [6,24,25,34], and programs with Remote Method Invocation (RMI) [33].…”

Section: Introductionmentioning

confidence: 99%

“…To tackle this problem, previous literature explored certain classes of dynamic features, such as reflection features [6,24,25,34], and programs with Remote Method Invocation (RMI) [33]. However, as demonstrated by Reif et al [29,30], one programming construct that has been left out from the programming analysis techniques is the support for handling serialization (and deserialization) of objects.…”

Section: Introductionmentioning

confidence: 99%

“…Serialization-related features are used in many software systems [29]. It is one of the building blocks of Java RMI, Java Management Extensions (JMX), and other technologies.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Salsa: static analysis of serialization features

Santos

Jones

Mirakhorli

2020

Proceedings of the 22nd ACM SIGPLAN International Workshop on Formal Techniques for Java-Like Programs

View full text Add to dashboard Cite

Static analysis has the advantage of reasoning over multiple possible paths. Thus, it has been widely used for verification of program properties. Property verification often requires inter-procedural analysis, in which control and data flow are tracked across methods. At the core of interprocedural analyses is the call graph, which establishes relationships between caller and callee methods. However, it is challenging to perform static analysis and compute the call graph of programs with dynamic features. Dynamic features are widely used in software systems; not supporting them makes it difficult to reason over properties related to these features. Although state-of-the-art research had explored certain types of dynamic features, such as reflection and RMI-based programs, serialization-related features are still not very well supported, as demonstrated in a recent empirical study. Therefore, in this paper, we introduce Salsa (Static AnaLyzer for SeriAlization features), which aims to enhance existing points-to analysis with respect to serialization-related features. The goal is to enhance the resulting call graph's soundness, while not greatly affecting its precision. In this paper, we report our early effort in developing Salsa and its early evaluation using the Java Call Graph Test Suite (JCG). CCS Concepts: • Software and its engineering → Compilers; Automated static analysis; • Theory of computation → Program analysis.

show abstract

Section: Early Resultsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Serialization-related features are used in many software systems [29]. It is one of the building blocks of Java RMI, Java Management Extensions (JMX), and other technologies.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Salsa: static analysis of serialization features

Santos

Jones

Mirakhorli

2020

Proceedings of the 22nd ACM SIGPLAN International Workshop on Formal Techniques for Java-Like Programs

View full text Add to dashboard Cite

show abstract

Effects of Program Representation on Pointer Analyses — An Empirical Study

Prakash

Tiwari

Hammer

2021

Fundamental Approaches to Software Engineering

View full text Add to dashboard Cite

Static analysis frameworks, such as Soot and Wala, are used by researchers to prototype and compare program analyses. These frameworks vary on heap abstraction, modeling library classes, and underlying intermediate program representation (IR). Often, these variations pose a threat to the validity of the results as the implications of comparing the same analysis implementation in different frameworks are still unexplored. Earlier studies have focused on the precision, soundness, and recall of the algorithms implemented in these frameworks; however, little to no work has been done to evaluate the effects of program representation. In this work, we fill this gap and study the impact of program representation on pointer analysis. Unfortunately, existing metrics are insufficient for such a comparison due to their inability to isolate each aspect of the program representation. Therefore, we define two novel metrics that measure these analyses’ precision after isolating the influence of class-hierarchy and intermediate representation. Our results establish that the minor differences in the class hierarchy and IR do not impact program analysis significantly. Besides, they reveal the sources of unsoundness that aid researchers in developing program analysis.

show abstract

A Modular Soundness Theory for the Blackboard Analysis Architecture

Keidel,

Helm,

Roth

et al. 2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Sound static analyses are an important ingredient for compiler optimizations and program verification tools. However, mathematically proving that a static analysis is sound is a difficult task due to two problems. First, soundness proofs relate two complicated program semantics (the static and the dynamic semantics) which are hard to reason about. Second, the more the static and dynamic semantics differ, the more work a soundness proof needs to do to bridge the impedance mismatch. These problems increase the effort and complexity of soundness proofs. Existing soundness theories address these problems by deriving both the dynamic and static semantics from the same artifact, often called generic interpreter. A generic interpreter provides a common structure along which a soundness proof can be composed, which avoids having to reason about the analysis as a whole. However, a generic interpreter restricts which analyses can be derived, as all derived analyses must roughly follow the program execution order.To lift this restriction, we develop a soundness theory for the blackboard analysis architecture, which is capable of describing backward, demand-driven, and summary-based analyses. The architecture describes static analyses with small independent modules, which communicate via a central store. Soundness of a compound analysis follows from soundness of all of its modules. Furthermore, modules can be proven sound independently, even though modules depend on each other. We evaluate our theory by proving soundness of four analyses: a pointer and call-graph analysis, a reflection analysis, an immutability analysis, and a demand-driven reaching definitions analysis.

show abstract

Judge: identifying, understanding, and evaluating sources of unsoundness in call graphs

Cited by 30 publications

References 29 publications

Salsa: static analysis of serialization features

Salsa: static analysis of serialization features

Effects of Program Representation on Pointer Analyses — An Empirical Study

A Modular Soundness Theory for the Blackboard Analysis Architecture

Contact Info

Product

Resources

About