Skip to content

SYSTEM Cited by 1 source

ASM bytecode toolkit

ASM (asm.ow2.io) is the de-facto OSS JVM bytecode framework, hosted by the OW2 consortium. It provides both a low-level event-driven visitor API and a tree-based object model for inspecting and transforming Java class files. ASM is the bytecode-manipulation primitive used by virtually every major JVM-ecosystem tool: Spring, Hibernate, Guice, JaCoCo, PowerMock, Kotlin compiler, Cglib, ByteBuddy, and many others.

This page is a stub created for cross-referencing from sources/2026-05-08-netflix-scaling-archunit-with-nebula-archrules, where ASM is named as the bytecode framework ArchUnit "is built directly on top of" — which is the structural choice that makes ArchUnit language-agnostic across JVM languages and immune to syntactic-sugar transformations.

Why ASM matters for static analysis

When a static analyzer operates on bytecode (via ASM) rather than source (via parser/AST), three properties follow:

  1. JVM-language-agnostic. Java, Kotlin, Scala, Groovy, Clojure, JRuby — all compile to JVM bytecode. One ASM-based rule covers all of them.
  2. Sugar-immune. Kotlin extension functions, Scala implicits, Java records / var / lambdas / switch-expressions, lombok @Data, KSP-generated code, @AspectJ-woven code — all compile to bytecode the rule sees. "It also allows code which should be found to be hidden under syntactic sugar not anticipated by the rule author." (sources/2026-05-08-netflix-scaling-archunit-with-nebula-archrules)
  3. What runs is what's checked. "What is analyzed is the actual code that will be run." The build's actual emitted classes are the input.

See concepts/bytecode-vs-ast-static-analysis for the canonical wiki framing.

Class-graph construction

ArchUnit uses ASM to build a classpath graph — a graph where each node is a class/method/field and edges represent calls, references, inheritance, and annotation relationships. Once built, rules can navigate this graph imperatively or via the fluent DSL. The post:

"Because ArchUnit processes the entire classpath with ASM, it retains a graph of the class data, allowing rules to easily traverse class relationships and call sites. This allows rules to have much more context about the code it is evaluating." — sources/2026-05-08-netflix-scaling-archunit-with-nebula-archrules

This is structurally infeasible on per-file ASTs, which see one source file at a time and don't have the full class hierarchy or call graph in context.

Adjacent tools

  • Byte Buddy — higher-level JVM bytecode generation / manipulation, builds on top of ASM.
  • Javassist — older bytecode framework, simpler API but less performant and feature-complete than ASM.
  • JVM agents (java.lang.instrument) — runtime bytecode manipulation, often pairs with ASM.

Seen in

Last updated · 542 distilled / 1,571 read