JShrink: in-depth investigation into debloating modern Java applications

Abstract

Modern software is bloated. Demand for new functionality has led developers to include more and more features, many of which become unneeded or unused as software evolves. This phenomenon, known as software bloat, results in software consuming more resources than it otherwise needs to. How to effectively and automatically debloat software is a long-standing problem in software engineering. Various debloating techniques have been proposed since the late 1990s. However, many of these techniques are built upon pure static analysis and have yet to be extended and evaluated in the context of modern Java applications where dynamic language features are prevalent. To this end, we develop an end-to-end bytecode debloating framework called JShrink. It augments traditional static reachability analysis with dynamic profiling and type dependency analysis and renovates existing bytecode transformations to account for new language features in modern Java. We highlight several nuanced technical challenges that must be handled properly and examine behavior preservation of debloated software via regression testing. We find that (1) JShrink is able to debloat our real-world Java benchmark suite by up to 47% (14% on average); (2) accounting for dynamic language features is indeed crucial to ensure behavior preservationÐreducing 98% of test failures incurred by a purely static equivalent, Jax, and 84% for ProGuard; and (3) compared with purely dynamic approaches, integrating static analysis with dynamic profiling makes the debloated software more robust to unseen test executionsÐin 22 out of 26 projects, the debloated software ran successfully under new tests.

WebJShrink: a web service for debloating Java bytecode

“…Our technical research paper on JShrink [3] presents comprehensive comparative evaluation against existing debloating tools, JRed [6], Jax [10], and ProGuard [1]. Here, we summarize our evaluation results briely.…”

“…JShrink eliminates unused methods by extending Soot's bytecode transformation APIs [11] to erase methods entirely, their method bodies, or by replacing their method bodies with an exception throw to indicate the removal of a method. While JShrink support four kinds of debloating transformations ('method removal', 'method inlining', 'ield removal', and 'class hierarchy collapsing'), WebJShrink's visual interface focuses on 'method removal' as it is the most efective in terms of size reduction [3]. If 'checkpointing' is enabled in WebJShrink, testfailure inducing transformations are reversed to ensure debloating safety.…”

“…WebJShrink is designed to be easy to use for developers and run as a software-as-a-service via a web browser without needing any downloads or installations. WebJShrink builds upon JShrink [3] and extends it with an intuitive GUI to provide rich, interactive visualizations of debloating statistics and behavior preservation. Furthermore, while prior debloating work uses static reachability analysis, JShrink combines pure static analysis with dynamic proiling to account for dynamic language features.…”

“…Though JShrink currently supports four diferent kinds of debloating transformations [10], its empirical evaluation inds that unused method removal is the most efective, achieving the majority of size reduction with minimal impact on behavioral preservation. Other transformations such as class hierarchy collapsing only contribute marginal size reduction with high risks of breaking software functionality [3]. Therefore, WebJShrink focuses on visualizing and analyzing the result of removing unused methods in the web interface.…”

Logical bytecode reduction

“…This guarantees that the application preserves the behavior described by the test-suite. We leave to future work to compare such a debloater to tools such as the seminal Jax [27] and more recent debloaters such as JShrink [2], TamiFlex [1], ProGuard [7], JRed [10], and BlankIt [20].…”