Understanding and analyzing Java reflection

Research output: Contribution to journal/Conference contribution in journal/Contribution to newspaperJournal articleResearchpeer-review

DOI

  • Yue Li, University of New South Wales
  • ,
  • Tian Tan, University of New South Wales
  • ,
  • Jingling Xue, University of New South Wales (UNSW) Australia

Java reflection has been widely used in a variety of applications and frameworks. It allows a software system to inspect and change the behaviour of its classes, interfaces, methods, and fields at runtime, enabling the software to adapt to dynamically changing runtime environments. However, this dynamic language feature imposes significant challenges to static analysis, because the behaviour of reflection-rich software is logically complex and statically hard to predict. As a result, existing static analysis tools either ignore reflection or handle it partially, resulting in missed, important behaviours, i.e., unsound results. Therefore, improving or even achieving soundness in static reflection analysis-an analysis that infers statically the behaviour of reflective code-will provide significant benefits to many analysis clients, such as bug detectors, security analyzers, and program verifiers. In this article, we provide a comprehensive understanding of Java reflection through examining its underlying concept, API, and real-world usage, and, building on this, we introduce a new static approach to resolving Java reflection effectively in practice. We have implemented our reflection analysis in an open-source tool, called Solar, and evaluated its effectiveness extensively with large Java programs and libraries. Our experimental results demonstrate that Solar is able to (1) resolve reflection more soundly than the state-of-the-art reflection analyses; (2) automatically and accurately identify the parts of the program where reflection is resolved unsoundly or imprecisely; and (3) guide users to iteratively refine the analysis results by using lightweight annotations until their specific requirements are satisfied.

Original languageEnglish
Article number7
JournalACM Transactions on Software Engineering and Methodology
Volume28
Issue2
ISSN1049-331X
DOIs
Publication statusPublished - 1 Feb 2019

    Research areas

  • Java reflection, Points-to analysis, Reflection analysis, Static analysis

See relations at Aarhus University Citationformats

ID: 164766412