Scalable Thread-Safety Analysis of Java Classes with CodeQL

• URL: http://arxiv.org/abs/2509.02022v1
• Date: Tue, 02 Sep 2025 07:11:18 GMT
• Title: Scalable Thread-Safety Analysis of Java Classes with CodeQL
• Abstract summary: This paper presents a highly scalable method to analyze thread-safety in Java classes.<n>We provide a definition of thread-safety for Java classes founded on the correctness principle of the Java memory model.<n>We encode these properties in the static analysis tool CodeQL to automatically analyze Java source code.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: In object-oriented languages software developers rely on thread-safe classes to implement concurrent applications. However, determining whether a class is thread-safe is a challenging task. This paper presents a highly scalable method to analyze thread-safety in Java classes. We provide a definition of thread-safety for Java classes founded on the correctness principle of the Java memory model, data race freedom. We devise a set of properties for Java classes that are proven to ensure thread-safety. We encode these properties in the static analysis tool CodeQL to automatically analyze Java source code. We perform an evaluation on the top 1000 GitHub repositories. The evaluation comprises 3632865 Java classes; with 1992 classes annotated as @ThreadSafe from 71 repositories. These repositories include highly popular software such as Apache Flink (24.6k stars), Facebook Fresco (17.1k stars), PrestoDB (16.2k starts), and gRPC (11.6k starts). Our queries detected thousands of thread-safety errors. The running time of our queries is below 2 minutes for repositories up to 200k lines of code, 20k methods, 6000 fields, and 1200 classes. We have submitted a selection of detected concurrency errors as PRs, and developers positively reacted to these PRs. We have submitted our CodeQL queries to the main CodeQL repository, and they are currently in the process of becoming available as part of GitHub actions. The results demonstrate the applicability and scalability of our method to analyze thread-safety in real-world code bases.

Related papers

• JEDI: Java Evaluation of Declarative and Imperative Queries [1.6042394978941517]
  There is a lack of benchmarks specifically targeting stream-based applications.<n>In this work we present JEDI, a benchmark suite that targets the Stream API.
  arXiv  Detail & Related papers  (2026-05-22T12:07:55Z)
• RealSec-bench: A Benchmark for Evaluating Secure Code Generation in Real-World Repositories [58.32028251925354]
  Large Language Models (LLMs) have demonstrated remarkable capabilities in code generation, but their proficiency in producing secure code remains a critical, under-explored area.<n>We introduce RealSec-bench, a new benchmark for secure code generation meticulously constructed from real-world, high-risk Java repositories.
  arXiv  Detail & Related papers  (2026-01-30T08:29:01Z)
• An Empirical Study of Java Code Improvements Based on Stack Overflow Answer Edits [0.22166578153935793]
  Suboptimal code is prevalent in software systems.<n>Developers often write low-quality code due to factors like technical knowledge gaps, insufficient experience, time pressure, management decisions, or personal factors.<n>We present an empirical study of SO Java answer edits and their application to improving code in open-source projects.
  arXiv  Detail & Related papers  (2025-11-08T03:01:55Z)
• SwingArena: Competitive Programming Arena for Long-context GitHub Issue Solving [90.32201622392137]
  We present SwingArena, a competitive evaluation framework for Large Language Models (LLMs)<n>Unlike traditional static benchmarks, SwingArena models the collaborative process of software by pairing LLMs as iterations, who generate patches, and reviewers, who create test cases and verify the patches through continuous integration (CI) pipelines.
  arXiv  Detail & Related papers  (2025-05-29T18:28:02Z)
• CLOVER: A Test Case Generation Benchmark with Coverage, Long-Context, and Verification [71.34070740261072]
  This paper presents a benchmark, CLOVER, to evaluate models' capabilities in generating and completing test cases.<n>The benchmark is containerized for code execution across tasks, and we will release the code, data, and construction methodologies.
  arXiv  Detail & Related papers  (2025-02-12T21:42:56Z)
• Evaluating the Dependency Between Cyclomatic Complexity and Response For Class [0.0]
  We analyzed 862,517 Java classes from 1,000 GitHub repositories. Our findings indicate a strong Pearson correlation of 0.79 between the cumulative McCabe's Cyclomatic Complexity (CC) of all class methods and the number of methods.
  arXiv  Detail & Related papers  (2024-10-08T23:00:48Z)
• JavaVFC: Java Vulnerability Fixing Commits from Open-source Software [5.351340307751831]
  We present a comprehensive dataset of Java vulnerability-fixing commits (VFCs) Our dataset, derived from thousands of open-source Java projects on GitHub, comprises two variants: JavaVFC and JavaVFC-extended.
  arXiv  Detail & Related papers  (2024-09-09T13:01:57Z)
• CodeRAG-Bench: Can Retrieval Augment Code Generation? [78.37076502395699]
  We conduct a systematic, large-scale analysis of code generation using retrieval-augmented generation.<n>We first curate a comprehensive evaluation benchmark, CodeRAG-Bench, encompassing three categories of code generation tasks.<n>We examine top-performing models on CodeRAG-Bench by providing contexts retrieved from one or multiple sources.
  arXiv  Detail & Related papers  (2024-06-20T16:59:52Z)
• Long Code Arena: a Set of Benchmarks for Long-Context Code Models [75.70507534322336]
  Long Code Arena is a suite of six benchmarks for code processing tasks that require project-wide context. These tasks cover different aspects of code processing: library-based code generation, CI builds repair, project-level code completion, commit message generation, bug localization, and module summarization. For each task, we provide a manually verified dataset for testing, an evaluation suite, and open-source baseline solutions.
  arXiv  Detail & Related papers  (2024-06-17T14:58:29Z)
• JavaBench: A Benchmark of Object-Oriented Code Generation for Evaluating Large Language Models [22.95865189208591]
  We propose JavaBench, a project-level Java benchmark that exercises OOP features. It comprises four Java projects with 389 methods in 106 Java classes. It is attested by 282 undergraduate students, reaching a 90.93/100 average score.
  arXiv  Detail & Related papers  (2024-06-10T06:43:25Z)
• A Language Model of Java Methods with Train/Test Deduplication [5.529795221640365]
  This tool demonstration presents a research toolkit for a language model of Java source code. The target audience includes researchers studying problems at the granularity level of subroutines, statements, or variables in Java.
  arXiv  Detail & Related papers  (2023-05-15T00:22:02Z)
• RepoCoder: Repository-Level Code Completion Through Iterative Retrieval and Generation [96.75695811963242]
  RepoCoder is a framework to streamline the repository-level code completion process. It incorporates a similarity-based retriever and a pre-trained code language model. It consistently outperforms the vanilla retrieval-augmented code completion approach.
  arXiv  Detail & Related papers  (2023-03-22T13:54:46Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.