TU Darmstadt / ULB / TUbiblio

Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders

Bodden, Eric and Sewe, Andreas and Sinschek, Jan and Oueslati, Hela and Mezini, Mira (2011):
Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders.
In: Proceedings of the 33rd International Conference on Software Engineering, New York, NY, USA, In: International Conference on Software Engineering, Waikiki, Honolulu, HI, USA, 21-28 May 2011, [Online-Edition: http://doi.acm.org/10.1145/1985793.1985827],
[Conference or Workshop Item]

Abstract

Static program analyses and transformations for Java face many problems when analyzing programs that use reflection or custom class loaders: How can a static analysis know which reflective calls the program will execute? How can it get hold of classes that the program loads from remote locations or even generates on the fly? And if the analysis transforms classes, how can these classes be re-inserted into a program that uses custom class loaders?

In this paper, we present TamiFlex, a tool chain that offers a partial but often effective solution to these problems. With TamiFlex, programmers can use existing static-analysis tools to produce results that are sound at least with respect to a set of recorded program runs. TamiFlex inserts runtime checks into the program that warn the user in case the program executes reflective calls that the analysis did not take into account. TamiFlex further allows programmers to re-insert offline-transformed classes into a program.

We evaluate TamiFlex in two scenarios: benchmarking with the DaCapo benchmark suite and analysing large-scale interactive applications. For the latter, TamiFlex significantly improves code coverage of the static analyses, while for the former our approach even appears complete: the inserted runtime checks issue no warning. Hence, for the first time, TamiFlex enables sound static whole-program analyses on DaCapo. During this process, TamiFlex usually incurs less than 10% runtime overhead.

Item Type: Conference or Workshop Item
Erschienen: 2011
Creators: Bodden, Eric and Sewe, Andreas and Sinschek, Jan and Oueslati, Hela and Mezini, Mira
Title: Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders
Language: English
Abstract:

Static program analyses and transformations for Java face many problems when analyzing programs that use reflection or custom class loaders: How can a static analysis know which reflective calls the program will execute? How can it get hold of classes that the program loads from remote locations or even generates on the fly? And if the analysis transforms classes, how can these classes be re-inserted into a program that uses custom class loaders?

In this paper, we present TamiFlex, a tool chain that offers a partial but often effective solution to these problems. With TamiFlex, programmers can use existing static-analysis tools to produce results that are sound at least with respect to a set of recorded program runs. TamiFlex inserts runtime checks into the program that warn the user in case the program executes reflective calls that the analysis did not take into account. TamiFlex further allows programmers to re-insert offline-transformed classes into a program.

We evaluate TamiFlex in two scenarios: benchmarking with the DaCapo benchmark suite and analysing large-scale interactive applications. For the latter, TamiFlex significantly improves code coverage of the static analyses, while for the former our approach even appears complete: the inserted runtime checks issue no warning. Hence, for the first time, TamiFlex enables sound static whole-program analyses on DaCapo. During this process, TamiFlex usually incurs less than 10% runtime overhead.

Title of Book: Proceedings of the 33rd International Conference on Software Engineering
Place of Publication: New York, NY, USA
Divisions: 20 Department of Computer Science
20 Department of Computer Science > Software Technology
Zentrale Einrichtungen
LOEWE > LOEWE-Zentren > CASED – Center for Advanced Security Research Darmstadt
20 Department of Computer Science > EC SPRIDE
20 Department of Computer Science > EC SPRIDE > Secure Software Engineering
LOEWE
LOEWE > LOEWE-Zentren
Event Title: International Conference on Software Engineering
Event Location: Waikiki, Honolulu, HI, USA
Event Dates: 21-28 May 2011
Date Deposited: 16 Jun 2011 09:40
Official URL: http://doi.acm.org/10.1145/1985793.1985827
Identification Number: doi:10.1145/1985793.1985827
Related URLs:
Alternative keywords:
Alternative keywordsLanguage
dynamic class loaders, dynamic class loading, native code, reflection, static analysis, tracingEnglish
Export:

Optionen (nur für Redakteure)

View Item View Item