PL4SA: Optimized Partial Library Selection for Efficient Static Analysis

Abstract

With the rapid advancements in modern software engineering practices, software applications have become increasingly dependent on external libraries, making the choice between whole-program and application-only analysis more critical: the former often leads to timeouts due to high computational overhead, while the latter risks missing library-induced bugs. Recent research has explored a compromise path, i.e., partial inclusion of libraries to balance analysis efficiency and recall. However, achieving a more precise relevance analysis that enables a more balanced and accurate library selection while minimizing the associated overhead remains a significant challenge. This paper proposes PL4SA, a novel partial library selection approach that establishes precise relevance between client analyses and library methods using fine-grained whole-program points-to information. The key point of PL4SA lies in integrating points-to analysis with the partial library selection process in a progressively expanding manner. During this process, pointers are ranked according to their relevance to the client analysis; in each iteration, the most relevant pointer as well as its corresponding library is selected, while pointers dependent on the selected pointer are further expanded to reveal their points-to information. To support this analysis, extended pointers, a pointer-based abstraction that summarizes additional information flows into/out of method invocations and array accesses, serve as anchors for the progressive expansion of points-to information. Furthermore, PL4SA organizes this analysis in three steps, leveraging summarization techniques to enable the reuse of time-critical intra-procedural points-to analysis results within libraries across different projects, due to the inherent stability of library code. Collectively, these design choices contribute to PL4SA’s high efficiency. Our experimental results demonstrate that by including only 12% and 17% library methods, PL4SA achieves 24.6x, 9.0x speedup, and 99.0% recall, and both 100% precision for variable-type analysis and null-pointer analysis compared to whole-program analysis, significantly outperforming existing baselines.