Supporting Java programming in the Svace static analyzer
The paper is devoted to the works performed within the Svace static analysis tool to support Java language. First, the approach to intercept compilation process for transparently building the analyzer internal representation should be extended to cover usage of the Java compiler API that is popular...
| Main Authors: | , , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ivannikov Institute for System Programming of the Russian Academy of Sciences
2018-10-01
|
| Series: | Труды Института системного программирования РАН |
| Subjects: | |
| Online Access: | https://ispranproceedings.elpub.ru/jour/article/view/278 |
| _version_ | 1818553256264073216 |
|---|---|
| author | A. P. Merkulov S. A. Polyakov A. A. Belevantsev |
| author_facet | A. P. Merkulov S. A. Polyakov A. A. Belevantsev |
| author_sort | A. P. Merkulov |
| collection | DOAJ |
| description | The paper is devoted to the works performed within the Svace static analysis tool to support Java language. First, the approach to intercept compilation process for transparently building the analyzer internal representation should be extended to cover usage of the Java compiler API that is popular in Ant and Maven tools. We achieve this goal with implementing our custom Java agent that instruments all calls to the compiler API and notifies the analyzer with the actual compilation parameters. Second, the modified Javac compiler builds the analyzer IR. The changes we made to the compiler include avoiding unnecessary bytecode duplication for easier mapping of bytecode instructions to source code and properly marking the code added by the compiler itself. Third, we discuss the process of bytecode translation to the Svace IR proper (which is a low-level 3-address IR akin to the LLVM IR). It is a straightforward code generation algorithm with further code cleanups that treats stack locations as local variables made possible by the fact that we know the maximum stack size consumed by the method. Finally, we discuss the devirtualization heuristics that assume we know the full class hierarchy and specific Java checkers including synchronization issue checkers. Experimental results obtained on Android 5 source code show that the checkers have high quality (more than 80% true positives). It can be seen that the general infrastructure for analysis and checkers implemented in Svace works well for the Java programming language with the adaptations described in the paper. |
| first_indexed | 2024-12-12T09:23:32Z |
| format | Article |
| id | doaj.art-e8c69b0283e84a8881c71dbce3abc95a |
| institution | Directory Open Access Journal |
| issn | 2079-8156 2220-6426 |
| language | English |
| last_indexed | 2024-12-12T09:23:32Z |
| publishDate | 2018-10-01 |
| publisher | Ivannikov Institute for System Programming of the Russian Academy of Sciences |
| record_format | Article |
| series | Труды Института системного программирования РАН |
| spelling | doaj.art-e8c69b0283e84a8881c71dbce3abc95a2022-12-22T00:29:08ZengIvannikov Institute for System Programming of the Russian Academy of SciencesТруды Института системного программирования РАН2079-81562220-64262018-10-01293577410.15514/ISPRAS-2017-29(3)-5278Supporting Java programming in the Svace static analyzerA. P. Merkulov0S. A. Polyakov1A. A. Belevantsev2Институт системного программирования РАНИнститут системного программирования РАНИнститут системного программирования РАН; Московский государственный университет имени М.В. ЛомоносоваThe paper is devoted to the works performed within the Svace static analysis tool to support Java language. First, the approach to intercept compilation process for transparently building the analyzer internal representation should be extended to cover usage of the Java compiler API that is popular in Ant and Maven tools. We achieve this goal with implementing our custom Java agent that instruments all calls to the compiler API and notifies the analyzer with the actual compilation parameters. Second, the modified Javac compiler builds the analyzer IR. The changes we made to the compiler include avoiding unnecessary bytecode duplication for easier mapping of bytecode instructions to source code and properly marking the code added by the compiler itself. Third, we discuss the process of bytecode translation to the Svace IR proper (which is a low-level 3-address IR akin to the LLVM IR). It is a straightforward code generation algorithm with further code cleanups that treats stack locations as local variables made possible by the fact that we know the maximum stack size consumed by the method. Finally, we discuss the devirtualization heuristics that assume we know the full class hierarchy and specific Java checkers including synchronization issue checkers. Experimental results obtained on Android 5 source code show that the checkers have high quality (more than 80% true positives). It can be seen that the general infrastructure for analysis and checkers implemented in Svace works well for the Java programming language with the adaptations described in the paper.https://ispranproceedings.elpub.ru/jour/article/view/278статический анализjavaдевиртуализациябайткод |
| spellingShingle | A. P. Merkulov S. A. Polyakov A. A. Belevantsev Supporting Java programming in the Svace static analyzer Труды Института системного программирования РАН статический анализ java девиртуализация байткод |
| title | Supporting Java programming in the Svace static analyzer |
| title_full | Supporting Java programming in the Svace static analyzer |
| title_fullStr | Supporting Java programming in the Svace static analyzer |
| title_full_unstemmed | Supporting Java programming in the Svace static analyzer |
| title_short | Supporting Java programming in the Svace static analyzer |
| title_sort | supporting java programming in the svace static analyzer |
| topic | статический анализ java девиртуализация байткод |
| url | https://ispranproceedings.elpub.ru/jour/article/view/278 |
| work_keys_str_mv | AT apmerkulov supportingjavaprogramminginthesvacestaticanalyzer AT sapolyakov supportingjavaprogramminginthesvacestaticanalyzer AT aabelevantsev supportingjavaprogramminginthesvacestaticanalyzer |