Effective Soundness-Guided Reflection Analysis

  • Yue Li
  • Tian Tan
  • Jingling Xue
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9291)


We introduce Solar, the first reflection analysis that allows its soundness to be reasoned about when some assumptions are met and produces significantly improved under-approximations otherwise. In both settings, Solar has three novel aspects: (1) lazy heap modeling for reflective allocation sites, (2) collective inference for improving the inferences on related reflective calls, and (3) automatic identification of “problematic” reflective calls that may threaten its soundness, precision and scalability, thereby enabling their improvement via lightweight annotations. We evaluate Solar against two state-of-the-art solutions, Doop and Elf, with the three treated as under-approximate reflection analyses, using 11 large Java benchmarks and applications. Solar is significantly more sound while achieving nearly the same precision and running only several-fold more slowly, subject to only 7 annotations in 3 programs.


Input String Cast Operation Target Method Call Site Reflection Analysis 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.



The authors wish to thank the POPL 2015 and SAS 2015 reviewers for their comments, the Doop team for making Doop available, and LogicBlox Inc. for providing us its Datalog engine. This work is supported by ARC grants, DP130101970 and DP150102109.


  1. 1.
    Lhoták, O., Hendren, L.: Scaling java points-to analysis using SPARK. In: Hedin, G. (ed.) CC 2003. LNCS, vol. 2622, pp. 153–169. Springer, Heidelberg (2003) CrossRefGoogle Scholar
  2. 2.
    Whaley, J., Lam, M.S.: Cloning-based context-sensitive pointer alias analysis using binary decision diagrams. PLDI 39(6), 131–144 (2004)Google Scholar
  3. 3.
    Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to analysis for Java. ACM Trans. Softw. Eng. Methodol. 14(1), 1–41 (2005)CrossRefGoogle Scholar
  4. 4.
    Sridharan, M., Bodík, R.: Refinement-based context-sensitive points-to analysis for Java. PLDI 41(6), 387–400 (2006)Google Scholar
  5. 5.
    Bravenboer, M., Smaragdakis, Y.: Strictly declarative specification of sophisticated points-to analyses. OOPSLA 44(10), 243–262 (2009)Google Scholar
  6. 6.
    Shang, L., Xie, X., Xue, J.: On-demand dynamic summary-based points-to analysis. In: CGO (2012)Google Scholar
  7. 7.
    Lu, Y., Shang, L., Xie, X., Xue, J.: An incremental points-to analysis with CFL-reachability. In: Jhala, R., De Bosschere, K. (eds.) CC 2013. LNCS, vol. 7791, pp. 61–81. Springer, Heidelberg (2013) CrossRefGoogle Scholar
  8. 8.
    Smaragdakis, Y., Bravenboer, M., Lhoták, O.: Pick your contexts well: understanding object-sensitivity. POPL 46(1), 17–30 (2011)Google Scholar
  9. 9.
    Kastrinis, G., Smaragdakis, Y.: Hybrid context-sensitivity for points-to analysis. PLDI 48(6), 423–434 (2013)Google Scholar
  10. 10.
    Smaragdakis, Y., Kastrinis, G., Balatsouras, G.: Introspective analysis: context-sensitivity, across the board. PLDI 49(6), 485–495 (2014)Google Scholar
  11. 11.
    Hirzel, M., Dincklage, D.V., Diwan, A., Hind, M.: Fast online pointer analysis. ACM Trans. Program. Lang. Syst. 29(2) (2007)Google Scholar
  12. 12.
    Sridharan, M., Artzi, S., Pistoia, M., Guarnieri, S., Tripp, O., Berg, R.: F4F: taint analysis of framework-based web applications. OOPSLA 46(10), 1053–1068 (2011)Google Scholar
  13. 13.
    Zhang, X., Mangal, R., Grigore, R., Naik, M., Yang, H.: On abstraction refinement for program analyses in datalog. PLDI 49(6), 239–248 (2014)Google Scholar
  14. 14.
    Arzt, S., Rasthofer, S., Fritz, C., Bodden, E., Bartel, A., Klein, J., Le Traon, Y., Octeau, D., McDaniel, P.: Flowdroid: precise context, flow, field, object-sensitive and lifecycle-aware taint analysis for android apps. PLDI 49(6), 259–269 (2014)Google Scholar
  15. 15.
    Nguyen, P.H., Xue, J.: Interprocedural side-effect analysis and optimisation in the presence of dynamic class loading. In: ACSC (2005)Google Scholar
  16. 16.
    Xue, J., Nguyen, P.H.: Completeness analysis for incomplete object-oriented programs. In: Bodik, R. (ed.) CC 2005. LNCS, vol. 3443, pp. 271–286. Springer, Heidelberg (2005) CrossRefGoogle Scholar
  17. 17.
    WALA.: T.J. Watson libraries for analysis.
  18. 18.
  19. 19.
    Vallée-Rai, R., Co, P., Gagnon, E., Hendren, L., Lam, P., Sundaresan, V.: Soot - a Java bytecode optimization framework. In: CASCON (1999)Google Scholar
  20. 20.
    Livshits, B., Whaley, J., Lam, M.S.: Reflection analysis for Java. In: Yi, K. (ed.) APLAS 2005. LNCS, vol. 3780, pp. 139–160. Springer, Heidelberg (2005) CrossRefGoogle Scholar
  21. 21.
    Li, Y., Tan, T., Sui, Y., Xue, J.: Self-inferencing reflection resolution for Java. In: Jones, R. (ed.) ECOOP 2014. LNCS, vol. 8586, pp. 27–53. Springer, Heidelberg (2014) Google Scholar
  22. 22.
    Bodden, E., Sewe, A., Sinschek, J., Oueslati, H., Mezini, M.: Taming reflection: aiding static analysis in the presence of reflection and custom class loaders. In: ICSE (2011)Google Scholar
  23. 23.
    Livshits, B., Sridharan, M., Smaragdakis, Y., Lhotk, O., Amaral, J.N., Chang, B.-Y.E., Guyer, S.Z., Khedker, U.P., Mller, A., Vardoulakis, D.: In defense of soundiness: a manifesto. Commun. ACM 58(2), 44–46 (2015)CrossRefGoogle Scholar
  24. 24.
    Sridharan, M., Chandra, S., Dolby, J., Fink, S.J., Yahav, E.: Alias analysis for object-oriented programs. In: Clarke, D., Noble, J., Wrigstad, T. (eds.) Aliasing in Object-Oriented Programming. LNCS, vol. 7850, pp. 196–232. Springer, Heidelberg (2013) Google Scholar
  25. 25.
    Sawin, J., Rountev, A.: Improving static resolution of dynamic class loading in java using dynamically gathered environment information. Autom. Softw. Eng. 16(2), 357–381 (2009)CrossRefGoogle Scholar
  26. 26.
    Javassist.: A Java bytecode manipulation framework.
  27. 27.
    Ali, K., Lhoták, O.: Averroes: whole-program analysis without the whole program. In: Castagna, G. (ed.) ECOOP 2013. LNCS, vol. 7920, pp. 378–400. Springer, Heidelberg (2013) CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2015

Authors and Affiliations

  1. 1.Programming Languages and Compilers GroupSchool of Computer Science and Engineering, UNSWSydneyAustralia

Personalised recommendations