{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,11]],"date-time":"2026-04-11T02:12:30Z","timestamp":1775873550038,"version":"3.50.1"},"reference-count":41,"publisher":"Association for Computing Machinery (ACM)","issue":"OOPSLA1","license":[{"start":{"date-parts":[[2024,4,29]],"date-time":"2024-04-29T00:00:00Z","timestamp":1714348800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["Proc. ACM Program. Lang."],"published-print":{"date-parts":[[2024,4,29]]},"abstract":"<jats:p>Java decompilers are programs that perform the reverse process of Java compilers, i.e., they translate Java bytecode to Java source code. They are essential for reverse engineering purposes and have become more sophisticated and reliable over the years. However, it remains challenging for modern Java decompilers to reliably perform correct decompilation on real-world programs. To shed light on the key challenges of Java decompilation, this paper provides the first systematic study on the characteristics and causes of bugs in mature, widely-used Java decompilers. We conduct the study by investigating 333 unique bugs from three popular Java decompilers. Our key findings and observations include: (1) Although most of the reported bugs were found when decompiling large, real-world code, 40.2% of them have small test cases for bug reproduction; (2) Over 80% of the bugs manifest as exceptions, syntactic errors, or semantic errors, and bugs with source code artifacts are very likely semantic errors; (3) 57.7%, 39.0%, and 41.1% of the bugs respectively are attributed to three stages of decompilers\u2014loading structure entities from bytecode, optimizing these entities, and generating source code from these entities; (4) Bugs in decompilers\u2019 type inference are the most complex to fix; and (5) Region restoration for structures like loop, sugaring for special structures like switch, and type inference of variables of generic types or indistinguishable types are the three most significant challenges in Java decompilation, which to some extent explains our findings in (3) and (4).<\/jats:p>\n          <jats:p>\n            Based on these findings, we present JD-Tester, a differential testing framework for Java decompilers, and our experience of using it in testing the three popular Java decompilers. JD-Testerutilizes different Java program generators to construct\n            <jats:italic>executable<\/jats:italic>\n            Java tests and finds exceptions, syntactic, and semantic inconsistencies (i.e. bugs) between a generated test and its\n            <jats:italic>compiled-decompiled<\/jats:italic>\n            version (through compilation and execution). In total, we have found 62 bugs in the three decompilers, demonstrating both the effectiveness of JD-Tester, and the importance of testing and validating Java decompilers.\n          <\/jats:p>","DOI":"10.1145\/3649860","type":"journal-article","created":{"date-parts":[[2024,4,29]],"date-time":"2024-04-29T17:53:50Z","timestamp":1714413230000},"page":"1380-1406","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":6,"title":["Understanding and Finding Java Decompiler Bugs"],"prefix":"10.1145","volume":"8","author":[{"ORCID":"https:\/\/orcid.org\/0000-0003-4758-3285","authenticated-orcid":false,"given":"Yifei","family":"Lu","sequence":"first","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0009-0008-4271-0314","authenticated-orcid":false,"given":"Weidong","family":"Hou","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4011-5350","authenticated-orcid":false,"given":"Minxue","family":"Pan","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3090-9568","authenticated-orcid":false,"given":"Xuandong","family":"Li","sequence":"additional","affiliation":[{"name":"Nanjing University, Nanjing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-2970-1391","authenticated-orcid":false,"given":"Zhendong","family":"Su","sequence":"additional","affiliation":[{"name":"ETH Zurich, Zurich, Switzerland"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2024,4,29]]},"reference":[{"key":"e_1_2_1_1_1","first-page":"8887","article-title":"Unstructured data collection from APK files for malware detection","volume":"975","author":"Agrawal Prerna","year":"2020","unstructured":"Prerna Agrawal and Bhushan Trivedi. 2020. Unstructured data collection from APK files for malware detection. International Journal of Computer Applications, 975 (2020), 8887.","journal-title":"International Journal of Computer Applications"},{"key":"e_1_2_1_2_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPS-ISA48467.2019.00013"},{"key":"e_1_2_1_3_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2016.05.003"},{"key":"e_1_2_1_4_1","doi-asserted-by":"publisher","DOI":"10.1109\/QRS54544.2021.00069"},{"key":"e_1_2_1_5_1","volume-title":"22nd USENIX Security Symposium (USENIX Security 13)","author":"Brumley David","year":"2013","unstructured":"David Brumley, JongHyup Lee, Edward J Schwartz, and Maverick Woo. 2013. Native x86 decompilation using $semantics-preserving$ structural analysis and iterative $control-flow$ structuring. In 22nd USENIX Security Symposium (USENIX Security 13). 353\u2013368."},{"key":"e_1_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1145\/3519939.3523427"},{"key":"e_1_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00070"},{"key":"e_1_2_1_8_1","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3275523"},{"key":"e_1_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00127"},{"key":"e_1_2_1_10_1","doi-asserted-by":"publisher","DOI":"10.1145\/2980983.2908095"},{"key":"e_1_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3385412.3385964"},{"key":"e_1_2_1_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01701-9_10"},{"key":"e_1_2_1_13_1","unstructured":"William Enck Damien Octeau Patrick D McDaniel and Swarat Chaudhuri. 2011. A study of Android application security. In USENIX security symposium. 2."},{"key":"e_1_2_1_14_1","volume-title":"Elements of software science (operating and programming systems series)","author":"Halstead Maurice H","unstructured":"Maurice H Halstead. 1977. Elements of software science (operating and programming systems series). Elsevier Science Inc.."},{"key":"e_1_2_1_15_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2009.24"},{"key":"e_1_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM.2019.00019"},{"key":"e_1_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.jss.2020.110645"},{"key":"e_1_2_1_18_1","unstructured":"JetBrains. 2023. IntelliJ IDEA: The Capable & Ergonomic Java IDE by JetBrains. https:\/\/www.jetbrains.com\/idea\/ [online accessed 16-Feb-2023]"},{"key":"e_1_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115648"},{"key":"e_1_2_1_20_1","doi-asserted-by":"publisher","unstructured":"Jozef Kostelansk\u1ef3 and L\u2019ubom\u00edr Dedera. 2017. An evaluation of output from current Java bytecode decompilers: Is it Android which is responsible for such quality boost? In Communication and Information Technologies (KIT). 1\u20136. https:\/\/doi.org\/10.23919\/KIT.2017.8109451 10.23919\/KIT.2017.8109451","DOI":"10.23919\/KIT.2017.8109451"},{"key":"e_1_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2017.38"},{"key":"e_1_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/3395363.3397370"},{"key":"e_1_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1145\/3338906.3338980"},{"key":"e_1_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-10013-5"},{"key":"e_1_2_1_25_1","unstructured":"Marcono1234. 2019. Removal of default constructors when decompiling jar breaks method references. https:\/\/github.com\/leibnitz27\/cfr\/issues\/64 [online accessed 16-Feb-2023]"},{"key":"e_1_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00500-016-2283-y"},{"key":"e_1_2_1_27_1","doi-asserted-by":"publisher","DOI":"10.1109\/ASE.2017.8115639"},{"key":"e_1_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1109\/SANER50967.2021.00044"},{"key":"e_1_2_1_29_1","volume-title":"Android-art-intel: Java* Fuzzer for Android*. https:\/\/github.com\/android-art-intel\/Fuzzer [online, accessed 16-Feb-2023]","author":"Haghighat Andrey Yakovlev","year":"2016","unstructured":"Andrey Yakovlev Mohammad R. Haghighat, Dmitry Khukhro. 2016. Android-art-intel: Java* Fuzzer for Android*. https:\/\/github.com\/android-art-intel\/Fuzzer [online, accessed 16-Feb-2023]"},{"key":"e_1_2_1_30_1","unstructured":"Andrey Yakovlev Mohammad R. Haghighat Dmitry Khukhro. 2018. AzulSystems\/JavaFuzzer: Java* Fuzzer for Android*. https:\/\/github.com\/AzulSystems\/JavaFuzzer [online accessed 16-Feb-2023]"},{"key":"e_1_2_1_31_1","unstructured":"Andrey Yakovlev Mohammad R. Haghighat Dmitry Khukhro. 2022. 2022 State of the Java Ecosystem Report | New relic*. https:\/\/newrelic.com\/resources\/report\/2022-state-of-java-ecosystem [online accessed 16-Feb-2023]"},{"key":"e_1_2_1_32_1","unstructured":"Andrey Yakovlev Mohammad R. Haghighat Dmitry Khukhro. 2023. CodeIntelligenceTesting\/jazzer: Coverage-guided in-process fuzzing for the JVM. https:\/\/github.com\/CodeIntelligenceTesting\/jazzer [online accessed 16-Feb-2023]"},{"key":"e_1_2_1_33_1","doi-asserted-by":"publisher","DOI":"10.1109\/SCAM51674.2020.00017"},{"key":"e_1_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICPC.2007.27"},{"key":"e_1_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1145\/1831708.1831741"},{"key":"e_1_2_1_36_1","doi-asserted-by":"publisher","DOI":"10.1145\/3180155.3180236"},{"key":"e_1_2_1_37_1","doi-asserted-by":"publisher","DOI":"10.1137\/0201010"},{"key":"e_1_2_1_38_1","doi-asserted-by":"crossref","unstructured":"Khaled Yakdan Sebastian Eschweiler Elmar Gerhards-Padilla and Matthew Smith. 2015. No more gotos: Decompilation using pattern-independent control-flow structuring and semantic-preserving transformations. In NDSS.","DOI":"10.14722\/ndss.2015.23185"},{"key":"e_1_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/QSIC.2003.1319081"},{"key":"e_1_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556958"},{"key":"e_1_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1145\/3213846.3213866"}],"container-title":["Proceedings of the ACM on Programming Languages"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3649860","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3649860","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,18]],"date-time":"2025-06-18T22:54:07Z","timestamp":1750287247000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3649860"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,4,29]]},"references-count":41,"journal-issue":{"issue":"OOPSLA1","published-print":{"date-parts":[[2024,4,29]]}},"alternative-id":["10.1145\/3649860"],"URL":"https:\/\/doi.org\/10.1145\/3649860","relation":{},"ISSN":["2475-1421"],"issn-type":[{"value":"2475-1421","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,4,29]]},"assertion":[{"value":"2024-04-29","order":2,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}