Static program analyses and transformations for Java face many problems when analyzing programs that use reflection or custom class loaders: How can a static analysis know which reflective calls the program will execute? How can it get hold of classes that the program loads from remote locations or even generates on the fly? And if the analysis transforms classes, how can these classes be re-inserted into a program that uses custom class loaders?   In this paper, we present  TamiFlex , a tool chain that offers a partial but often effective solution to these problems. With  TamiFlex , programmers can use existing static-analysis tools to produce results that are sound at least with respect to a set of recorded program runs.  TamiFlex  inserts runtime checks into the program that warn the user in case the program executes reflective calls that the analysis did not take into account.  TamiFlex  further allows programmers to re-insert offline-transformed classes into a program.   We evaluate  TamiFlex  in two scenarios: benchmarking with the DaCapo benchmark suite and analysing large-scale interactive applications. For the latter,  TamiFlex  significantly improves code coverage of the static analyses, while for the former our approach even appears complete: the inserted runtime checks issue no warning. Hence, for the first time,  TamiFlex  enables sound static whole-program analyses on DaCapo. During this process,  TamiFlex  usually incurs less than 10% runtime overhead.
['Eric Bodden', 'Andreas Sewe', 'Jan Sinschek', 'Hela Oueslati', 'Mira Mezini']
Taming reflection: Aiding static analysis in the presence of reflection and custom class loaders