WebJShrink: a web service for debloating Java bytecode

Macias, Konner; Mathur, Mihir; Bruce, Bobby R.; Zhang, Tianyi; Kim, Miryung

doi:10.1145/3368089.3417934

Cited by 9 publications

(3 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Instead of removing redundant bytecode in each artifact, we can notify developers to refactor when the usage of an artifact is relatively low. Additionally, the authors make use of this tool as a backend of WebJShrink, a visualization interface allowing developers to select removal options [15].…”

Section: A Dependency Analysis Toolsmentioning

confidence: 99%

Removing dependencies from large software projects: are you really sure?

Chuang

Cruz

Dalen

et al. 2022

2022 IEEE 22nd International Working Conference on Source Code Analysis and Manipulation (SCAM)

View full text Add to dashboard Cite

When developing and maintaining large software systems, a great deal of effort goes into dependency management. During the whole lifecycle of a software project, the set of dependencies keeps changing to accommodate the addition of new features or changes in the running environment. Package management tools are quite popular to automate this process, making it fairly easy to automate the addition of new dependencies and respective versions. However, over the years, a software project might evolve in a way that no longer needs a particular technology or dependency. But the choice of removing that dependency is far from trivial: one cannot be entirely sure that the dependency is not used in any part of the project. Hence, developers have a hard time confidently removing dependencies and trusting that it will not break the system in production. In this paper, we propose a decision framework to improve the detection of unused dependencies. Our approach builds on top of the existing dependency analysis tool DepClean. We start by improving the support of Java dynamic features in DepClean. We do so by augmenting the analysis with the state-of-the-art call graph generation tool OPAL. Then, we analyze the potentially unused dependencies detected by classifying their logical relationship with the other components to decide on follow-up steps, which we provide in the form of a decision diagram. Results show that developers can focus their efforts on maintaining bloated dependencies by following the recommendations of our decision framework. When applying our approach to a large industrial software project, we can reduce one-third of false positives when compared to the state-of-the-art. We also validate our approach by analyzing dependencies that were removed in the history of open-source projects. Results show consistency between our approach and the decisions taken by open-source developers.

show abstract

Section: A Dependency Analysis Toolsmentioning

confidence: 99%

Removing dependencies from large software projects: are you really sure?

Chuang

Cruz

Dalen

et al. 2022

2022 IEEE 22nd International Working Conference on Source Code Analysis and Manipulation (SCAM)

View full text Add to dashboard Cite

show abstract

“…Similarly, we observed that the number of bloated dependencies tends to grow over time, whether or not there is a need for it. In the last years, there is a recent resurgence of interest in debloating Java bytecode [5,14,20,28,29]. These tools remove Java bytecode using static and dynamic analysis.…”

Section: Related Workmentioning

confidence: 99%

A Longitudinal Analysis of Bloated Java Dependencies

Soto-Valero¹,

Durieux²,

Baudry³

2021

Preprint

View full text Add to dashboard Cite

We study the evolution and impact of bloated dependencies in a single software ecosystem: Java/Maven. Bloated dependencies are third-party libraries that are packaged in the application binary but are not needed to run the application. We analyze the history of 435 Java projects. This historical data includes 48,469 distinct dependencies, which we study across a total of 31,515 versions of Maven dependency trees. Bloated dependencies steadily increase over time, and 89.2 % of the direct dependencies that are bloated remain bloated in all subsequent versions of the studied projects. This empirical evidence suggests that developers can safely remove a bloated dependency. We further report novel insights regarding the unnecessary maintenance efforts induced by bloat. We find that 22 % of dependency updates performed by developers are made on bloated dependencies, and that Dependabot suggests a similar ratio of updates on bloated dependencies.

show abstract

“…We make publicly available the JShrink source code and additional resources necessary to replicate our results at https://doi.org/10.6084/m9.figshare.12435542. As a companion piece to this work, we have prototyped JShrink as an entirely online SaaS, which we call WebJShrink [41]. WebJShrink provides a rich graphical user interface for the functionality described in this paper.…”

Section: • We Demonstrate the Necessity Of Handling Dynamic Featuresmentioning

confidence: 99%

JShrink: in-depth investigation into debloating modern Java applications

Bruce

Zhang

Arora

et al. 2020

Proceedings of the 28th ACM Joint Meeting on European Software Engineering Conference and Symposium on the Foundations of Softw

Self Cite

View full text Add to dashboard Cite

Modern software is bloated. Demand for new functionality has led developers to include more and more features, many of which become unneeded or unused as software evolves. This phenomenon, known as software bloat, results in software consuming more resources than it otherwise needs to. How to effectively and automatically debloat software is a long-standing problem in software engineering. Various debloating techniques have been proposed since the late 1990s. However, many of these techniques are built upon pure static analysis and have yet to be extended and evaluated in the context of modern Java applications where dynamic language features are prevalent. To this end, we develop an end-to-end bytecode debloating framework called JShrink. It augments traditional static reachability analysis with dynamic profiling and type dependency analysis and renovates existing bytecode transformations to account for new language features in modern Java. We highlight several nuanced technical challenges that must be handled properly and examine behavior preservation of debloated software via regression testing. We find that (1) JShrink is able to debloat our real-world Java benchmark suite by up to 47% (14% on average); (2) accounting for dynamic language features is indeed crucial to ensure behavior preservationÐreducing 98% of test failures incurred by a purely static equivalent, Jax, and 84% for ProGuard; and (3) compared with purely dynamic approaches, integrating static analysis with dynamic profiling makes the debloated software more robust to unseen test executionsÐin 22 out of 26 projects, the debloated software ran successfully under new tests.

show abstract

WebJShrink: a web service for debloating Java bytecode

Cited by 9 publications

References 5 publications

Removing dependencies from large software projects: are you really sure?

Removing dependencies from large software projects: are you really sure?

A Longitudinal Analysis of Bloated Java Dependencies

JShrink: in-depth investigation into debloating modern Java applications

Contact Info

Product

Resources

About