Hybrid Analysis of Object Escapes
Object escapes keep data alive past its intended lifetime, creating performance, stability, and correctness risks across runtimes. This paper presents Graphene-HA, a fused-evidence escape-analysis workflow that unifies static analysis with heap-growth tracking across Python, Java, JavaScript, Go, and Rust under a single command and report format. The system combines a Python CLI, a Rust orchestration core, and language-specific bridges that directly measure heap allocation deltas during execution. Each bridge uses native runtime introspection (tracemalloc for Python, MemoryMXBean for Java, process.memoryUsage for Node.js, runtime.MemStats for Go, and custom GlobalAlloc for Rust) to capture heap growth as evidence of object escape. We evaluate the workflow on 1,421 labeled targets spanning five languages. Overall accuracy improves from 61.2% with static analysis to 83.7% with combined analysis, while dynamic heap tracking achieves 100.0% accuracy on this benchmark, with an F1 score of 1.0. The largest combined gains are observed in Python, where F1 rises from 20.2% to 92.0%, and in Java, where F1 rises from 31.5% to 100.0%. Go and Rust remain constrained by static false-positive patterns when evidence is combined. These results suggest that direct heap measurement is a reliable dynamic signal for object escape detection, and that a unified combined pipeline can substantially improve correctness compared to static analysis alone. Future work will extend Graphene-HA to additional languages and to stronger detection patterns for edge cases in Go and Rust.