Context-Sensitive Pointer Analysis for ArkTS

2025-11-16

International Conference on Automated Software Engineering

AI Summary

Existing call graph construction techniques for ArkTS suffer from imprecise pointer analysis, leading to inaccurate tracking of object references, fragmented call graphs, and insufficient analysis coverage. To address this, this work proposes APAK—the first context-sensitive pointer analysis framework tailored for ArkTS—which innovatively integrates a heap modeling mechanism aligned with ArkUI semantics and a modular plugin architecture to precisely resolve complex reference relationships arising from TypeScript closures and OpenHarmony API interactions. Evaluation on 1,663 real-world applications demonstrates that APAK significantly improves call graph precision over CHA and RTA, achieving a 34.2% increase in effective edge coverage compared to RTA and reducing the false positive rate from 20% to 2%. APAK has been integrated into the official ArkAnalyzer framework.

Technology Category

• Planning, Routing, and Scheduling: Activity and Plan Recognition
• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Cognitive Modeling & Cognitive Systems: Conceptual Inference and Reasoning

Application Category

• Graph Algorithms and Modeling for the Web: Efficient manipulation of static and dynamic Web-related graphs
• Responsible Web: Social and technical mechanisms of refusal for web technologies and applications
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization

Abstract

Current call graph generation methods for ArkTS, a new programming language for OpenHarmony, exhibit precision limitations when supporting advanced static analysis tasks such as data flow analysis and vulnerability pattern detection, while the workflow of traditional JavaScript(JS)/TypeScript(TS) analysis tools fails to interpret ArkUI component tree semantics. The core technical bottleneck originates from the closure mechanisms inherent in TypeScript’s dynamic language features and the interaction patterns involving OpenHarmony’s framework APIs. Existing static analysis tools for ArkTS struggle to achieve effective tracking and precise deduction of object reference relationships, leading to topological fractures in call graph reachability and diminished analysis coverage. This technical limitation fundamentally constrains the implementation of advanced program analysis techniques.Therefore, in this paper, we propose a tool named ArkAnalyzer Pointer Analysis Kit (APAK), the first context-sensitive pointer analysis framework specifically designed for ArkTS. APAK addresses these challenges through a unique ArkTS heap object model and a highly extensible plugin architecture, ensuring future adaptability to the evolving OpenHarmony ecosystem. In the evaluation, we construct a dataset from 1,663 real-world applications in the OpenHarmony ecosystem to evaluate APAK, demonstrating APAK’s superior performance over CHA/RTA approaches in critical metrics including valid edge coverage (e.g., a 7.1% reduction compared to CHA and a 34.2% increase over RTA). The improvement in edge coverage systematically reduces false positive rates from 20% to 2%, enabling future exploration of establishing more complex program analysis tools based on our framework. Our proposed APAK has been merged into the official static analysis framework ArkAnalyzer for OpenHarmony.

Problem

• pointer analysis
• call graph
• ArkTS
• static analysis
• object reference

Innovation

• context-sensitive pointer analysis
• ArkTS
• call graph generation
• heap object model
• OpenHarmony