ReachCheck: Compositional Library-Aware Call Graph Reachability Analysis in the IDEs

Call graph reachability analysis is essential for vulnerability detection, dependency conflict analysis, and compatibility checks. However, modern software systems, particularly those developed within integrated development environments (IDEs), often rely on third-party libraries (TPLs), which significantly increase the analysis cost. This paper introduces ReachCheck, a compositional library-aware analysis for method pair reachability in the IDEs. Specifically, ReachCheck summarizes TPL reachability via offline transitive closure and integrates the summaries with application code on demand, eliminating redundant analysis. Additionally, we use matrix representations for call graphs and employ fast matrix multiplication for transitive closure, further improving efficiency. We have implemented our approach as a prototype and evaluated it upon real-world projects. Compared to online traversal, function summary approaches and three state-of-the-art graph reachability approaches (Ferrari, BL and BFL), ReachCheck achieves 237.75×, 78.55×, 84.86×, 4369.09× and 80.91× speedup respectively. For downstream clients like dependency conflict detection and CVE risk detection, ReachCheck completes analysis in 0.61 and 0.35 seconds, yielding 537.59× and 519.03× speedup over existing techniques.