Skip to content

Code Analysis Java Calls

Tu Shaokun edited this page Nov 6, 2026 · 2 revisions

Java method-call evidence

Status: experimental, Draft PR #1239, not merged or released. Published candidate: 110b8dec29333b97b2a9071b65df8b629ad8360a, based on the combined investigation Draft #1235. This Java slice is separate from Python #1236. Snapshot: 7 November 2026.

The feature provides a source-reading path: locate a Java method, enumerate its captured method invocations, and follow a limited class of static source candidates. For SLF4J, this exposes the path from performInitialization to bind and from bind to loadExplicitlySpecified, while provider-instance calls and reflection remain unresolved.

Fixed evaluation and results

The source-first oracle contains 86 invocation sites in eight method/revision units: SLF4J's pinned parent/head provider-selection change and Guava's pinned string helpers. These projects had been studied previously; the new callsite questions and target boundaries were fixed from source before this study's first analyzer run. This is a purposive sample, not a blind or project-wide accuracy estimate.

Evidence unit Baseline 7fa882747 Java candidate
Exact invocation spans captured 0/86 86/86
Correct expected targets 0/26 26/26
Wrong targets on supported units 0 0
Explicit unknown at unsupported sites 0/60 60/60
Omitted invocation sites 86 0
Unexpected invocation sites 0 0
Valid navigation for expected targets 0/26 26/26

The 26 targets are 26/86 of all selected invocations, not universal target coverage. An unknown is not counted as a recovered target. The baseline already had line-level method locations; its lack of exact hashed ranges must not be described as inability to locate every method.

Javac independently confirmed all 86 syntax sites. SLF4J's API sources were attributed with Temurin 17.0.21+9 and -proc:none: all 21 selected supported targets agreed with the compiler. Guava was parsed without attribution; its five target answers remain source-derived. The analyzer itself does not run javac or the target applications.

Full target declaration ranges were added as a source-only supplement after initial captures. Two grader errors were corrected and the original results retained locally: annotations may precede a method header, and serialized coordinate arrays need consistent comparison. The corrected grader compares complete invocation/caller/target ranges, declaration-slice hashes, identities and current navigation. See the benchmark and per-method results.

Capture coverage

Git-tracked Java files in the exact analysis roots were independently enumerated and compared with captured facts:

Root Tracked / captured Parsed Parse failures
SLF4J parent 259 / 259 258 slf4j-migrator/jcl/jclcontent.java
SLF4J head 260 / 260 259 same file
Guava guava/src 615 / 615 615 none

No tracked Java files within those roots were missing or unexpectedly captured. The rule evaluator separately excludes 106/107 SLF4J test-role files; that is not omission from the call-fact capture. Guava's Android variant and repository-wide test roots are outside this selected scope. All selected benchmark methods parsed successfully.

Reproduce through the CLI and ZIP

Follow the committed reproduction guide. It pins repository revisions, source hashes, the oracle and source/package commands. It requires Node 22.23.2, Python 3 for the harness, and JDK 17 for the independent oracle; the Java analyzer does not require a JDK.

The usual workflow is code-analysis check ROOT --language java --fail-on never --json --out CAPTURE, followed by code-analysis task CAPTURE --question ... --entry FILE --function SIGNATURE --root ROOT --format json. The benchmark runs these public entrypoints rather than internal extractor calls.

Candidate ZIP SHA-256: 0fe2c01d79544252a58011c2ab9b2363790442b52dc170ee16065c1aa77de49d. All 152 Code Analysis module files match source bytes; the standard package builder removes scripts and devDependencies from the top-level manifest. Source and extracted-package runs produced three byte-identical raw-facts files and the same score report. Eight saved questions matched after normalizing recorded workflow/facts paths. The archive runner verifies extracted members against the supplied ZIP before and after the run.

Supported boundary and remaining gaps

java-static-lexical-v1 inventories method-invocation expressions, including contained lambdas/nested bodies. Source containment does not mean each site executes directly when the selected method runs. Constructors and method references are not inventoried.

A source target is offered only for a bare invocation inside a top-level ordinary class with no explicit extends/implements, pointing to the unique explicitly static, body-bearing same-name method with matching fixed arity. Object method names, overloads, qualified/member calls and nested/local/anonymous owners remain unresolved. Argument type applicability and successful compilation are not proved; these are lexical candidates, not runtime dispatch edges. Historical Java captures without the explicit model remain unavailable rather than known zero. Stale source cannot provide trusted navigation.

The research comparison separates executed javac evidence from documentation-only research into JavaParser, SCIP and Tree-sitter. No additional compiler/indexer dependency was added.

The standalone change passed 22 affected tests and independent Java/shared checks. One full-run TypeScript temp-path failure reproduced on unchanged base and passed with a canonical temporary directory; it was not fixed by unrelated source edits. An isolated Python+Java source composition passed 325 module tests, but that does not prove the forthcoming paired-change composition or its package. Human review, final combined validation and remote CI status remain distinct from this bounded result.

Combined validation follow-up

The Java slice is now composed with Python calls and multi-language paired definitions in Draft #1244. The combined evidence report supersedes the earlier pending-composition note above: 338 module tests and normal source/ZIP replay of seven projects and five changes, with explicit partial coverage and unsupported targets.

Standalone CI run 42259764551 failed on the README showcase freshness assertion. That same failure reproduced on the unchanged Java base and head, with identical relevant files; module, ZIP freshness and package checks passed. This does not make the complete CI run green. Human review remains pending and neither Draft is merged.

Clone this wiki locally