More Sound Static Handling of Java Reflection

Reflection is a highly dynamic language feature that poses grave problems for static analyses. In the Java setting, re-flection is ubiquitous in large programs. Any handling of re-flection will be approximate, and overestimating its reach in a large codebase can be catastrophic for precision and scala-bility. We present an approach for handling reflection with improved empirical soundness (as measured against prior approaches and dynamic information) in the context of a points-to analysis. Our approach is based on the combina-tion of string-flow and points-to analysis from past litera-ture augmented with (a) substring analysis and modeling of partial string flow through string builder classes; (b) new techniques for analyzing reflective entities based on infor-mation available at their use-sites. The resulting analysis is general, without any need for hand-tuning. In experimental comparisons with prior approaches, we demonstrate a com-bination of both improved soundness (recovering the major-ity of missing call-graph edges) and increased performance. 1