Novel Approaches to Systematically Evaluating and Constructing Call Graphs for Java Software

Michael Reif
2021
Whether applications or libraries, today's software heavily reuses existing code to build more gigantic software faster. To ensure a smooth user experience for an application's end-user and a reliable software library for the developer, the shipped piece of software should be as bug-free as possible. Besides manual or automatic software testing, static program analysis is one possible way to find unintended behavior. While static analysis tools can detect simple problems using pattern matching,
more » ... advanced problems often require complex interprocedural control- and data-flow analyses, which, in turn, presume call graphs. For example, call graphs enable static analyses to track inputs over method boundaries to find SQL-injections or null pointer dereferences. The research community proposed many different call-graph algorithms with different precision and scalability properties. However, the following three aspects are often neglected. First, a comprehensive understanding of unsoundness sources, their relevance, and the capabilities of existing call-graph algorithms in this respect is missing. These sources of unsoundness can originate from programming language features and core APIs that impact call-graph construction, e.g., reflection, but are not (entirely) modeled by the call-graph algorithm. Without understanding the sources of unsoundness' relevance and the frequency in which they occur, it is impossible to estimate their immediate effect on either the call graph or the analysis relying on it. Second, most call-graph research examines how to build call graphs for applications, neglecting to investigate the peculiarities of building call graphs for libraries. However, the use of libraries is ubiquitous in software development. Consequently, disregarding call-graph construction for libraries is unfortunate for both library users and developers, as it is crucial to ensure that their library behaves as intended regardless of its usage. Third call-graph algorithms, are traditionally organized in an imperative monoli [...]
doi:10.26083/tuprints-00019286 fatcat:xlw3luhytrgajoo525ianpedwe