Skip to main content
SpringerLink
Log in

Lifting On-Demand Analysis to Higher-Order Languages

  • Conference paper
  • First Online:
Static Analysis (SAS 2023)

Part of the book series: Lecture Notes in Computer Science ((LNCS,volume 14284))

Included in the following conference series:

  • 283 Accesses

Abstract

In this paper, we present an approach to lift on-demand analysis to higher-order languages. Specifically, our approach bootstraps an on-demand call graph construction by leveraging a pair of on-demand data flow analyses. Static analysis is increasingly applied to find subtle bugs or prove deep properties in large, industrial code bases. To effectively do this at scale, analyzers need to both resolve function calls in a precise manner (i.e., construct a precise call graph) and examine only the relevant portion of the program (i.e., be on-demand). A strawman strategy to this problem is to use fast, approximate, whole-program call graph construction algorithms. However, this strategy is generally not adequate for modern languages like JavaScript that rely heavily on higher-order features, such as callbacks and closures, where scalable approximations often introduce unacceptable imprecision. This strategy also limits increasingly sophisticated on-demand analyses, which scale by analyzing only parts of a program as needed: the scalability advantages of an on-demand analysis may be thwarted by the need to construct a whole-program call graph. The key insight of this paper is that existing on-demand data flow analyses can themselves be applied in a black-box manner to construct call graphs on demand. We propose a soundness condition for the existing on-demand analyses with respect to partial call graphs, formalize our algorithm as an abstract domain combinator, and prove it sound in Isabelle/HOL. Furthermore, we evaluate a prototype implementation of the resulting on-demand call graph construction algorithm for a subset of JavaScript (using the Synchronized Push-Down Systems framework as the underlying data flow analysis) on benchmarks making heavy use of higher-order functions.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 69.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 89.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. Babel: Babel. https://babeljs.io/. Accessed 01 Apr 2023

  2. Bacon, D.F., Sweeney, P.F.: Fast static analysis of C++ virtual function calls. In: Anderson, L., Coplien, J. (eds.) Proceedings of the 1996 ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages & Applications (OOPSLA 1996), San Jose, California, USA, 6–10 October 1996, pp. 324–341. ACM (1996)

    Google Scholar 

  3. Bouajjani, A., Esparza, J., Maler, O.: Reachability analysis of pushdown automata: application to model-checking. In: Mazurkiewicz, A., Winkowski, J. (eds.) CONCUR 1997. LNCS, vol. 1243, pp. 135–150. Springer, Heidelberg (1997). https://doi.org/10.1007/3-540-63141-0_10

    Chapter  Google Scholar 

  4. Calcagno, C., Distefano, D.: Infer: an automatic program verifier for memory safety of C programs. In: Bobaru, M., Havelund, K., Holzmann, G.J., Joshi, R. (eds.) NFM 2011. LNCS, vol. 6617, pp. 459–465. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-20398-5_33

    Chapter  Google Scholar 

  5. Claessen, K., Hughes, J.: Quickcheck: a lightweight tool for random testing of Haskell programs. In: Odersky, M., Wadler, P. (eds.) Proceedings of the Fifth ACM SIGPLAN International Conference on Functional Programming (ICFP 2000), Montreal, Canada, 18–21 September 2000, pp. 268–279. ACM (2000)

    Google Scholar 

  6. CodeShield: de.fraunhofer.iem.SPDS. https://github.com/codeshield-security/spds. Accessed 30 Jan 2022

  7. Dean, J., Grove, D., Chambers, C.: Optimization of object-oriented programs using static class hierarchy analysis. In: Tokoro, M., Pareschi, R. (eds.) ECOOP 1995. LNCS, vol. 952, pp. 77–101. Springer, Heidelberg (1995). https://doi.org/10.1007/3-540-49538-X_5

    Chapter  Google Scholar 

  8. Dillig, I., Dillig, T., Aiken, A.: Sound, complete and scalable path-sensitive analysis. In: Gupta, R., Amarasinghe, S.P. (eds.) Proceedings of the ACM SIGPLAN 2008 Conference on Programming Language Design and Implementation, Tucson, AZ, USA, 7–13 June 2008, pp. 270–280. ACM (2008)

    Google Scholar 

  9. Distefano, D., Fähndrich, M., Logozzo, F., O’Hearn, P.W.: Scaling static analyses at Facebook. Commun. ACM 62(8), 62–70 (2019). https://doi.org/10.1145/3338112

    Article  Google Scholar 

  10. Diwan, A., McKinley, K.S., Moss, J.E.B.: Type-based alias analysis. In: Davidson, J.W., Cooper, K.D., Berman, A.M. (eds.) Proceedings of the ACM SIGPLAN 1998 Conference on Programming Language Design and Implementation (PLDI), Montreal, Canada, 17–19 June 1998, pp. 106–117. ACM (1998)

    Google Scholar 

  11. ECMA International: ECMAScript language specification, 5th edition (2011). https://www.ecma-international.org/ecma-262/5.1/

  12. Elliott, C., Hudak, P.: Functional reactive animation. In: Jones, S.L.P., Tofte, M., Berman, A.M. (eds.) Proceedings of the 1997 ACM SIGPLAN International Conference on Functional Programming (ICFP 1997), Amsterdam, The Netherlands, 9–11 June 1997, pp. 263–273. ACM (1997)

    Google Scholar 

  13. Esparza, J., Hansel, D., Rossmanith, P., Schwoon, S.: Efficient algorithms for model checking pushdown systems. In: Emerson, E.A., Sistla, A.P. (eds.) CAV 2000. LNCS, vol. 1855, pp. 232–247. Springer, Heidelberg (2000). https://doi.org/10.1007/10722167_20

    Chapter  Google Scholar 

  14. Feldthaus, A., Schäfer, M., Sridharan, M., Dolby, J., Tip, F.: Efficient construction of approximate call graphs for JavaScript IDE services. In: Notkin, D., Cheng, B.H.C., Pohl, K. (eds.) 35th International Conference on Software Engineering, ICSE 2013, San Francisco, CA, USA, 18–26 May 2013, pp. 752–761. IEEE Computer Society (2013)

    Google Scholar 

  15. Germane, K., McCarthy, J., Adams, M.D., Might, M.: Demand control-flow analysis. In: Enea, C., Piskac, R. (eds.) VMCAI 2019. LNCS, vol. 11388, pp. 226–246. Springer, Cham (2019). https://doi.org/10.1007/978-3-030-11245-5_11

    Chapter  Google Scholar 

  16. GitHub: CodeQL. https://codeql.github.com/. Accessed 29 Jan 2022

  17. Jensen, S.H., Møller, A., Thiemann, P.: Type analysis for Javascript. In: Palsberg, J., Su, Z. (eds.) SAS 2009. LNCS, vol. 5673, pp. 238–255. Springer, Heidelberg (2009). https://doi.org/10.1007/978-3-642-03237-0_17

    Chapter  Google Scholar 

  18. Landman, D., Serebrenik, A., Vinju, J.J.: Challenges for static analysis of Java reflection: literature review and empirical study. In: Uchitel, S., Orso, A., Robillard, M.P. (eds.) Proceedings of the 39th International Conference on Software Engineering, ICSE 2017, Buenos Aires, Argentina, 20–28 May 2017, pp. 507–518. IEEE/ACM (2017)

    Google Scholar 

  19. Lhoták, O., Hendren, L.: Context-sensitive points-to analysis: is it worth it? In: Mycroft, A., Zeller, A. (eds.) CC 2006. LNCS, vol. 3923, pp. 47–64. Springer, Heidelberg (2006). https://doi.org/10.1007/11688839_5

    Chapter  Google Scholar 

  20. Li, Y., Tan, T., Xue, J.: Understanding and analyzing Java reflection. ACM Trans. Softw. Eng. Methodol. 28(2), 7:1-7:50 (2019)

    Article  Google Scholar 

  21. Meta: React. https://reactjs.org/. Accessed 06 Feb 2022

  22. Nielsen, B.B., Torp, M.T., Møller, A.: Modular call graph construction for security scanning of Node.js applications. In: Cadar, C., Zhang, X. (eds.) 30th ACM SIGSOFT International Symposium on Software Testing and Analysis, ISSTA 2021, Virtual Event, Denmark, 11–17 July 2021, pp. 29–41. ACM (2021)

    Google Scholar 

  23. Nipkow, T., Wenzel, M., Paulson, L.C.: 5. the rules of the game. In: Nipkow, T., Wenzel, M., Paulson, L.C. (eds.) Isabelle/HOL. LNCS, vol. 2283, pp. 67–104. Springer, Heidelberg (2002). https://doi.org/10.1007/3-540-45949-9_5

    Chapter  Google Scholar 

  24. Oracle: Java streams. https://docs.oracle.com/javase/8/docs/api/java/util/stream/package-summary.html. Accessed 02 Feb 2022

  25. Oracle: Lambda expressions for the Java programming language (2014). https://jcp.org/aboutJava/communityprocess/final/jsr335/index.html

  26. Sadowski, C., Aftandilian, E., Eagle, A., Miller-Cushon, L., Jaspan, C.: Lessons from building static analysis tools at google. Commun. ACM 61(4), 58–66 (2018). https://doi.org/10.1145/3188720

    Article  Google Scholar 

  27. Schoepe, D.: Lifting on-demand analysis to higher-order languages (artifact). Static Anal. Symp. (2023). https://doi.org/10.5281/zenodo.8189312

    Article  MathSciNet  Google Scholar 

  28. Smaragdakis, Y., Balatsouras, G., Kastrinis, G., Bravenboer, M.: More sound static handling of Java reflection. In: Feng, X., Park, S. (eds.) APLAS 2015. LNCS, vol. 9458, pp. 485–503. Springer, Cham (2015). https://doi.org/10.1007/978-3-319-26529-2_26

    Chapter  Google Scholar 

  29. Smaragdakis, Y., Bravenboer, M.: Using datalog for fast and easy program analysis. In: de Moor, O., Gottlob, G., Furche, T., Sellers, A. (eds.) Datalog 2.0 2010. LNCS, vol. 6702, pp. 245–251. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-24206-9_14

    Chapter  Google Scholar 

  30. Späth, J., Ali, K., Bodden, E.: Context-, flow-, and field-sensitive data-flow analysis using synchronized pushdown systems. Proc. ACM Program. Lang. 3(POPL), 48:1–48:29 (2019)

    Google Scholar 

  31. Späth, J., Do, L.N.Q., Ali, K., Bodden, E.: Boomerang: demand-driven flow- and context-sensitive pointer analysis for Java. In: Krishnamurthi, S., Lerner, B.S. (eds.) 30th European Conference on Object-Oriented Programming, ECOOP 2016, 18–22 July 2016, Rome, Italy. LIPIcs, vol. 56, pp. 22:1–22:26. Schloss Dagstuhl - Leibniz-Zentrum für Informatik (2016)

    Google Scholar 

  32. Stein, B., Chang, B.E., Sridharan, M.: Demanded abstract interpretation. In: Freund, S.N., Yahav, E. (eds.) 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation, PLDI 2021, Virtual Event, Canada, 20–25 June 2021, pp. 282–295. ACM (2021)

    Google Scholar 

  33. Sundaresan, V., et al.: Practical virtual method call resolution for Java. In: Rosson, M.B., Lea, D. (eds.) Proceedings of the 2000 ACM SIGPLAN Conference on Object-Oriented Programming Systems, Languages & Applications, OOPSLA 2000, Minneapolis, Minnesota, USA, 15–19 October 2000, pp. 264–280. ACM (2000)

    Google Scholar 

Download references

Acknowledgments

This paper describes work performed in part while David Seekatz was an Applied Scientist Intern at Amazon. Franco Raimondi holds concurrent appointments at Middlesex University and as an Amazon Scholar. Bor-Yuh Evan Chang holds concurrent appointments at the University of Colorado Boulder and as an Amazon Scholar. This paper describes work performed at Amazon and is not associated with Middlesex University nor the University of Colorado Boulder.

We are particularly grateful to Fangyi Zhou and Martin Schaef for their discussions and feedback on several drafts of this paper. We thank the anonymous reviewers for their helpful comments and feedback. This research was conducted in the Prime Video Automated Reasoning team and we are grateful to the entire team for their support.

Author information

Authors and Affiliations

  1. Amazon, London, UK

    Daniel Schoepe, Ilina Stoilkovska, Pauline Bolignano & Franco Raimondi

  2. Calgary, Canada

    David Seekatz

  3. Middlesex University, London, UK

    Franco Raimondi

  4. University of Colorado Boulder, Boulder, USA

    Bor-Yuh Evan Chang

  5. Amazon, Gothenburg, Sweden

    Sandro Stucki

  6. Amazon, Seattle, USA

    Daniel Tattersall

  7. Amazon, Boulder, USA

    Bor-Yuh Evan Chang

Authors
  1. Daniel Schoepe
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. David Seekatz
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Ilina Stoilkovska
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Sandro Stucki
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Daniel Tattersall
    View author publications

    You can also search for this author in PubMed Google Scholar

  6. Pauline Bolignano
    View author publications

    You can also search for this author in PubMed Google Scholar

  7. Franco Raimondi
    View author publications

    You can also search for this author in PubMed Google Scholar

  8. Bor-Yuh Evan Chang
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Daniel Schoepe .

Editor information

Editors and Affiliations

  1. U. Politécnica de Madrid (UPM) and IMDEA Software Institute, Pozuelo de Alarcón, Madrid, Spain

    Manuel V. Hermenegildo

  2. U. Politécnica de Madrid (UPM) and IMDEA Software Institute, Pozuelo de Alarcon, Spain

    José F. Morales

A Single-Threaded Performance Results

A Single-Threaded Performance Results

Figure 10 shows the benchmark results when run on a single core, demonstrating that the faster whole-program results are caused by better CPU utilization.

Fig. 10.
figure 10

Single-threaded performance results

Full size image

Rights and permissions

Reprints and permissions

Copyright information

© 2023 The Author(s), under exclusive license to Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Schoepe, D. et al. (2023). Lifting On-Demand Analysis to Higher-Order Languages. In: Hermenegildo, M.V., Morales, J.F. (eds) Static Analysis. SAS 2023. Lecture Notes in Computer Science, vol 14284. Springer, Cham. https://doi.org/10.1007/978-3-031-44245-2_20

Download citation

  • DOI: https://doi.org/10.1007/978-3-031-44245-2_20

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-031-44244-5

  • Online ISBN: 978-3-031-44245-2

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation