Static analysis is a mature field with applications to bug detection, security analysis, and code optimization, etc. To facilitate these applications, static analysis frameworks play an essential role by providing a series of fundamental services such as program abstraction, control flow graph construction, and points-to/alias information computation, etc. However, despite impressive progress of static analysis, and this field has seen several popular frameworks in the last decades, it is still not clear how a static analysis framework should be designed in a way that analysis developers could benefit more: for example, what a good IR (for analysis) ought to look like? What functionalities should the module of fundamental analyses provide to ease client analyses? How to develop and integrate new analysis conveniently? How to manage multiple analyses? To answer these questions, in this work, we discuss the design trade-offs for the crucial components of a static analysis framework, and argue for the most appropriate design by following the HBDC (Harnessing the Best Designs of Classics) principle: for each crucial component, we compare the design choices made for it (possibly) by different classic frameworks such as Soot, WALA, SpotBugs and Doop, and choose arguably the best one, but if none is good enough, we then propose a better design. These selected or newly proposed designs finally constitute Tai-e, a new static analysis framework for Java. Specifically, Tai-e is novel in the designs of several aspects like IR, pointer analysis and development of new analyses, etc., leading to an easy-to-learn, easy-to-use and efficient system. To our knowledge, this is the first work that systematically explores the designs and implementations of various static analysis frameworks, and we believe it provides useful materials and viewpoints for building better static analysis infrastructures.
翻译:然而,尽管静态分析取得了令人印象深刻的进展,而且这个领域在过去几十年中已经看到若干受欢迎的框架,但仍不清楚如何设计静态分析框架,使开发者能够从分析中受益更多:例如,一个良好的静态分析(用于分析的)应该看起来像什么?基本分析模块应该提供哪些功能来方便客户分析?如何发展并方便地整合新的分析?如何管理多重分析?在这项工作中回答这些问题?我们讨论静态分析框架关键组成部分的设计取舍,并且通过遵循HBDC(优化经典的最佳设计)原则来论证最合适的设计:对于每一个关键组成部分,我们比较为它所作的设计选择(可能)是容易的吗?基本分析模块应该提供哪些功能来方便客户分析?如何方便地开发和整合新的分析?如何管理多重分析?在这项工作中,我们讨论静态分析框架的关键组成部分的设计取舍利,通过HBDC(为经典设计的最佳设计设计)原则,我们为每个关键组成部分,我们比较了它的设计选择的设计选择(可能)由不同的经典框架,例如 Soot、WALA、SOOB、DOOO和Dooptoto 这样的新设计分析,最后选择了我们所选的一些设计分析。