{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,10,2]],"date-time":"2026-10-02T10:21:07Z","timestamp":1790936467488,"version":"4.1.0"},"reference-count":82,"publisher":"Association for Computing Machinery (ACM)","issue":"6","funder":[{"DOI":"10.13039\/501100012166","name":"National Key R&D Program of China","doi-asserted-by":"crossref","award":["2022YFB2901502"],"award-info":[{"award-number":["2022YFB2901502"]}],"id":[{"id":"10.13039\/501100012166","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100001809","name":"Natural Science Foundation of China","doi-asserted-by":"crossref","award":["62272400"],"award-info":[{"award-number":["62272400"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"crossref"}]},{"name":"Fujian Provincial Natural Science Foundation of China","award":["2025J010002"],"award-info":[{"award-number":["2025J010002"]}]},{"name":"Leading-edge Technology Program of Jiangsu Natural Science Foundation","award":["BK20202001"],"award-info":[{"award-number":["BK20202001"]}]}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":["ACM Trans. Softw. Eng. Methodol."],"published-print":{"date-parts":[[2026,6,30]]},"abstract":"\n Call graph reachability analysis is essential for vulnerability detection, dependency conflict analysis, and compatibility checks. However, modern software systems, particularly those developed within integrated development environments (IDEs), often rely on third-party libraries (TPLs), which significantly increase the analysis cost. This article introduces ReachCheck, a compositional library-aware analysis for method pair reachability in the IDEs. Specifically, ReachCheck summarizes TPL reachability via offline transitive closure and integrates the summaries with application code on-demand, eliminating redundant analysis. Additionally, we use matrix representations for call graphs and employ fast matrix multiplication for transitive closure, further improving efficiency. We have implemented our approach as a prototype and evaluated it upon real-world projects. Compared to online traversal, function summary approaches and three state-of-the-art graph reachability approaches (\n Ferrari<\/jats:sc>\n , BL and BFL), ReachCheck achieves 237.75\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n , 78.55\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n , 84.86\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n , 4,369.09\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n , and 80.91\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n speedup, respectively. For downstream clients like dependency conflict detection and CVE risk detection, ReachCheck completes analysis in 0.61 and 0.35\u2009s, yielding 537.59\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n and 519.03\n \n \\(\\times\\)<\/jats:tex-math>\n <\/jats:inline-formula>\n speedup over existing techniques.\n <\/jats:p>","DOI":"10.1145\/3767166","type":"journal-article","created":{"date-parts":[[2025,9,11]],"date-time":"2025-09-11T22:22:26Z","timestamp":1757629346000},"page":"1-30","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":2,"title":["ReachCheck: Compositional Library-Aware Call Graph Reachability Analysis in the IDEs"],"prefix":"10.1145","volume":"35","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-1672-915X","authenticated-orcid":false,"given":"Chao","family":"Wang","sequence":"first","affiliation":[{"name":"School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-9895-8360","authenticated-orcid":false,"given":"Li","family":"Lin","sequence":"additional","affiliation":[{"name":"School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0617-5322","authenticated-orcid":false,"given":"Chengpeng","family":"Wang","sequence":"additional","affiliation":[{"name":"Department of Computer Science, Purdue University, West Lafayette, Indiana, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0005-1961-8438","authenticated-orcid":false,"given":"Jiafeng","family":"Huang","sequence":"additional","affiliation":[{"name":"School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0009-0006-6768-797X","authenticated-orcid":false,"given":"Congxia","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4648-3795","authenticated-orcid":false,"given":"Rongxin","family":"Wu","sequence":"additional","affiliation":[{"name":"School of Informatics, Xiamen University, Xiamen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"320","published-online":{"date-parts":[[2026,5,13]]},"reference":[{"key":"e_1_3_3_2_2","unstructured":"ff4j. 2018. Issue309. Retrieved from https:\/\/github.com\/ff4j\/ff4j\/issues\/309"},{"key":"e_1_3_3_3_2","unstructured":"JetBrains. 2023. Dependency Analyzer. Retrieved from https:\/\/www.jetbrains.com\/guide\/java\/tutorials\/analyzing-dependencies\/dependency-analyzer\/"},{"key":"e_1_3_3_4_2","unstructured":"Snyk. 2023. Snyk. Retrieved from https:\/\/security.snyk.io\/"},{"key":"e_1_3_3_5_2","unstructured":"soot-oss. 2023. SootUp. Retrieved from https:\/\/github.com\/soot-oss\/SootUp"},{"key":"e_1_3_3_6_2","unstructured":"ReachCheck. 2024. CVE Reports. Retrieved from https:\/\/github.com\/ReachCheck\/ReachCheck\/blob\/main\/reportData\/CVE_reports.md"},{"key":"e_1_3_3_7_2","unstructured":"ReachCheck. 2024. DC Reports. Retrieved from https:\/\/github.com\/ReachCheck\/ReachCheck\/blob\/main\/reportData\/DC_reports.md"},{"key":"e_1_3_3_8_2","unstructured":"JetBrains. 2024. IDEA. Retrieved from https:\/\/www.jetbrains.com\/idea\/"},{"key":"e_1_3_3_9_2","unstructured":"JetBrains. 2024. Vulnerability Checker. Retrieved from https:\/\/www.jetbrains.com\/help\/idea\/package-analysis.html"},{"key":"e_1_3_3_10_2","unstructured":"Beam. 2025. BEAM-3690. Retrieved from https:\/\/issues.apache.org\/jira\/browse\/BEAM-3690"},{"key":"e_1_3_3_11_2","unstructured":"soot-oss. 2025. call-graph-construction. Retrieved from https:\/\/soot-oss.github.io\/SootUp\/v1.1.2\/call-graph-construction\/"},{"key":"e_1_3_3_12_2","unstructured":"ff4j. 2025. ff4j. Retrieved from https:\/\/github.com\/ff4j\/ff4j"},{"key":"e_1_3_3_13_2","unstructured":"Hadoop. 2025. HADOOP-15261. Retrieved from https:\/\/issues.apache.org\/jira\/browse\/HADOOP-15261"},{"key":"e_1_3_3_14_2","unstructured":"locationtech. 2025. Issue1371. Retrieved from https:\/\/github.com\/locationtech\/geowave\/issues\/1371"},{"key":"e_1_3_3_15_2","unstructured":"st-js. 2025. Issue146. Retrieved from https:\/\/github.com\/st-js\/st-js\/issues\/146"},{"key":"e_1_3_3_16_2","unstructured":"apache. 2025. Issue2134. Retrieved from https:\/\/github.com\/apache\/dubbo\/issues\/2134"},{"key":"e_1_3_3_17_2","unstructured":"ExpediaGroup. 2025. Issue227. Retrieved from https:\/\/github.com\/ExpediaGroup\/styx\/issues\/227"},{"key":"e_1_3_3_18_2","unstructured":"jvelo. 2025. Issue272. Retrieved from https:\/\/github.com\/jvelo\/mayocat-shop\/issues\/272"},{"key":"e_1_3_3_19_2","unstructured":"ff4j. 2025. Issue315. Retrieved from https:\/\/github.com\/ff4j\/ff4j\/issues\/315"},{"key":"e_1_3_3_20_2","unstructured":"Azure. 2025. Issue345. Retrieved from https:\/\/github.com\/Azure\/azure-storage-java\/issues\/345"},{"key":"e_1_3_3_21_2","unstructured":"subchen. 2025. Issue39. Retrieved from https:\/\/github.com\/subchen\/jetbrick-template-2x\/issues\/39"},{"key":"e_1_3_3_22_2","unstructured":"google. 2025. Issue473. Retrieved from https:\/\/github.com\/google\/truth\/issues\/473"},{"key":"e_1_3_3_23_2","unstructured":"vipshop. 2025. Issue477. Retrieved from https:\/\/github.com\/vipshop\/Saturn\/issues\/477"},{"key":"e_1_3_3_24_2","unstructured":"sarxos. 2025. Issue653. Retrieved from https:\/\/github.com\/sarxos\/webcam-capture\/issues\/653"},{"key":"e_1_3_3_25_2","unstructured":"ReachCheck. 2025. ReachBench. Retrieved from https:\/\/github.com\/ReachCheck\/ReachCheck\/blob\/main\/Data\/ReachBench.md"},{"key":"e_1_3_3_26_2","unstructured":"Storm. 2025. Storm-3171. Retrieved from https:\/\/issues.apache.org\/jira\/browse\/STORM-3171"},{"key":"e_1_3_3_27_2","doi-asserted-by":"publisher","DOI":"10.1145\/67544.66950"},{"key":"e_1_3_3_28_2","first-page":"725","volume-title":"Proceedings of the 2016 IEEE\/ACM 38th International Conference on Software Engineering (ICSE)","author":"Arzt Steven","year":"2016","unstructured":"Steven Arzt and Eric Bodden. 2016. StubDroid: Automatic inference of precise data-flow summaries for the android framework. In Proceedings of the 2016 IEEE\/ACM 38th International Conference on Software Engineering (ICSE). IEEE, 725\u2013735."},{"key":"e_1_3_3_29_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2009.117"},{"key":"e_1_3_3_30_2","doi-asserted-by":"publisher","DOI":"10.1145\/1871437.1871457"},{"key":"e_1_3_3_31_2","doi-asserted-by":"publisher","DOI":"10.5555\/1083592.1083651"},{"key":"e_1_3_3_32_2","doi-asserted-by":"publisher","DOI":"10.1145\/2463676.2465286"},{"key":"e_1_3_3_33_2","doi-asserted-by":"publisher","DOI":"10.1137\/S0097539702403098"},{"key":"e_1_3_3_34_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00031"},{"key":"e_1_3_3_35_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE-C.2017.20"},{"key":"e_1_3_3_36_2","doi-asserted-by":"publisher","DOI":"10.1145\/3660821"},{"key":"e_1_3_3_37_2","doi-asserted-by":"publisher","DOI":"10.1145\/3556540"},{"key":"e_1_3_3_38_2","doi-asserted-by":"publisher","DOI":"10.1007\/s10664-021-10071-9"},{"key":"e_1_3_3_39_2","first-page":"101","volume-title":"Proceedings of the 40th International Conference on Software Engineering: New Ideas and Emerging Results","author":"Hejderup Joseph","year":"2018","unstructured":"Joseph Hejderup, Arie Van Deursen, and Georgios Gousios. 2018. Software ecosystem call graph for dependency management. In Proceedings of the 40th International Conference on Software Engineering: New Ideas and Emerging Results, 101\u2013104."},{"key":"e_1_3_3_40_2","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-022-10131-8"},{"key":"e_1_3_3_41_2","doi-asserted-by":"publisher","DOI":"10.1145\/1929934.1929941"},{"key":"e_1_3_3_42_2","doi-asserted-by":"publisher","DOI":"10.14778\/2556549.2556578"},{"key":"e_1_3_3_43_2","doi-asserted-by":"publisher","DOI":"10.1145\/1559845.1559930"},{"key":"e_1_3_3_44_2","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-023-10388-7"},{"key":"e_1_3_3_45_2","doi-asserted-by":"publisher","DOI":"10.1109\/PADSW.2018.8644574"},{"key":"e_1_3_3_46_2","doi-asserted-by":"publisher","DOI":"10.1145\/3192366.3192390"},{"key":"e_1_3_3_47_2","doi-asserted-by":"publisher","DOI":"10.1007\/11575467_11"},{"key":"e_1_3_3_48_2","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-73197-7_52"},{"key":"e_1_3_3_49_2","doi-asserted-by":"publisher","DOI":"10.1109\/IPDPSW52791.2021.00049"},{"key":"e_1_3_3_50_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSME.2018.00054"},{"key":"e_1_3_3_51_2","doi-asserted-by":"publisher","DOI":"10.1007\/S10664-020-09830-X"},{"key":"e_1_3_3_52_2","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950312"},{"key":"e_1_3_3_53_2","doi-asserted-by":"publisher","DOI":"10.1145\/199448.199462"},{"key":"e_1_3_3_54_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2005.57"},{"key":"e_1_3_3_55_2","first-page":"2","volume-title":"Proceedings of the 35th European Conference on Object-Oriented Programming (ECOOP 2021)","author":"Dominik Schubert Philipp","year":"2021","unstructured":"Philipp Dominik Schubert, Ben Hermann, and Eric Bodden. 2021. Lossless, persisted summarization of static callgraph, points-to and data-flow analysis. In Proceedings of the 35th European Conference on Object-Oriented Programming (ECOOP 2021). Schloss Dagstuhl\u2013Leibniz-Zentrum f\u00fcr Informatik, 2\u20131."},{"key":"e_1_3_3_56_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2019.00049"},{"key":"e_1_3_3_57_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2013.6544893"},{"key":"e_1_3_3_58_2","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1007\/978-3-319-26529-2_26","volume-title":"Asian Symposium on Programming Languages and Systems","author":"Smaragdakis Yannis","year":"2015","unstructured":"Yannis Smaragdakis, George Balatsouras, George Kastrinis, and Martin Bravenboer. 2015. More sound static handling of java reflection. In Asian Symposium on Programming Languages and Systems. Springer, 485\u2013503."},{"key":"e_1_3_3_59_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639123"},{"key":"e_1_3_3_60_2","doi-asserted-by":"publisher","DOI":"10.1145\/3133923"},{"key":"e_1_3_3_61_2","doi-asserted-by":"publisher","DOI":"10.1109\/TKDE.2016.2631160"},{"key":"e_1_3_3_62_2","doi-asserted-by":"publisher","DOI":"10.1145\/3377811.3380441"},{"key":"e_1_3_3_63_2","doi-asserted-by":"publisher","DOI":"10.1145\/1247480.1247573"},{"key":"e_1_3_3_64_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3560437"},{"key":"e_1_3_3_65_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2006.53"},{"key":"e_1_3_3_66_2","doi-asserted-by":"publisher","DOI":"10.1145\/3611643.3616264"},{"key":"e_1_3_3_67_2","doi-asserted-by":"publisher","DOI":"10.1145\/3236024.3236056"},{"key":"e_1_3_3_68_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE.2019.00068"},{"key":"e_1_3_3_69_2","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2021.3057767"},{"key":"e_1_3_3_70_2","doi-asserted-by":"publisher","DOI":"10.14778\/2732977.2732992"},{"key":"e_1_3_3_71_2","doi-asserted-by":"publisher","DOI":"10.1007\/S00778-017-0468-3"},{"key":"e_1_3_3_72_2","doi-asserted-by":"publisher","DOI":"10.1145\/3597503.3639132"},{"key":"e_1_3_3_73_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00095"},{"key":"e_1_3_3_74_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556921"},{"key":"e_1_3_3_75_2","doi-asserted-by":"publisher","DOI":"10.1145\/2505515.2505724"},{"key":"e_1_3_3_76_2","doi-asserted-by":"publisher","DOI":"10.14778\/1920841.1920879"},{"key":"e_1_3_3_77_2","unstructured":"Hilmi Yildirim Vineet Chaoji and Mohammed J. Zaki. 2013. DAGGER: A scalable index for reachability queries in large dynamic graphs. arXiv:1301.0977. Retrieved from http:\/\/arxiv.org\/abs\/1301.0977"},{"key":"e_1_3_3_78_2","doi-asserted-by":"publisher","DOI":"10.1109\/TBDATA.2023.3327215"},{"key":"e_1_3_3_79_2","doi-asserted-by":"publisher","DOI":"10.1145\/2950290.2950332"},{"key":"e_1_3_3_80_2","doi-asserted-by":"publisher","DOI":"10.1145\/3555041.3589408"},{"key":"e_1_3_3_81_2","doi-asserted-by":"publisher","DOI":"10.1145\/3551349.3556956"},{"key":"e_1_3_3_82_2","doi-asserted-by":"publisher","DOI":"10.1109\/ICSE48619.2023.00212"},{"key":"e_1_3_3_83_2","doi-asserted-by":"publisher","DOI":"10.1145\/2588555.2612181"}],"container-title":["ACM Transactions on Software Engineering and Methodology"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3767166","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T02:33:07Z","timestamp":1778725987000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3767166"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,13]]},"references-count":82,"journal-issue":{"issue":"6","published-print":{"date-parts":[[2026,6,30]]}},"alternative-id":["10.1145\/3767166"],"URL":"https:\/\/doi.org\/10.1145\/3767166","relation":{},"ISSN":["1049-331X","1557-7392"],"issn-type":[{"value":"1049-331X","type":"print"},{"value":"1557-7392","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,5,13]]},"assertion":[{"value":"2025-02-24","order":0,"name":"received","label":"Received","group":{"name":"publication_history","label":"Publication History"}},{"value":"2025-09-03","order":2,"name":"accepted","label":"Accepted","group":{"name":"publication_history","label":"Publication History"}},{"value":"2026-05-13","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}