Static and Runtime Code Scanning to Detect Unused Java Methods

In modern agile development, keeping a clean and efficient codebase is crucial; as projects grow, dead or redundant code accumulates, increasing complexity and maintenance cost. This article introduces a component that automatically scans and identifies such unused code, covering both static and runtime approaches.

Design Idea : The system first loads project files, parses each Java source with an AST parser, caches class and method signatures, and then analyzes call relationships to pinpoint methods that are never invoked ("zombie" methods). For runtime analysis, JaCoCo is employed to collect execution coverage data.

2.1 Static Code Scanning Scheme

The static approach uses ASTParser to parse Java files, cache method blocks, and then query the cache to count invocations. Methods with zero calls are reported as dead code.

Basic steps:

Load the project from local disk.

Iterate over each Java file, parse method blocks with ASTParser , and store class+method signatures together with their code.

Perform a second pass to match method calls against the cache, excluding self‑calls, and count occurrences.

Methods with a call count of zero are considered zombie methods and are printed for review.

Required Maven dependencies:

<dependency>
    <groupId>org.jacoco</groupId>
    <artifactId>org.jacoco.ant</artifactId>
    <version>0.8.3</version>
</dependency>
<dependency>
    <groupId>org.apache.ant</groupId>
    <artifactId>ant</artifactId>
    <version>1.9.9</version>
</dependency>

2.2 Runtime Scanning Scheme

This scheme leverages JaCoCo, a Java code‑coverage tool that instruments bytecode with probes to record execution paths.

Key steps:

Add JaCoCo Ant dependency to the project’s pom.xml (as shown above).

Expose a REST endpoint that triggers a JaCoCo dump task, generating a .exec coverage file.

Configure the JVM to load the JaCoCo agent with appropriate parameters.

Run the application, invoke the dump endpoint, and collect the generated coverage file.

Open the .exec file in an IDE (e.g., IntelliJ IDEA) to view coverage, where green indicates executed (active) code and red indicates uncovered (dead) code.

Sample REST controller:

@RestController
@RequestMapping("/coverage")
public class CoverageController {

    @PostMapping("dump")
    @NoCheckMenuPermission
    public Result<Boolean> dumpCoverageFile() {
        DumpTask dumpTask = new DumpTask();
        // dump file location
        dumpTask.setDestfile(new File("/export/Data/coverage/code-cover.exec"));
        // append on multiple dumps
        dumpTask.setAppend(true);
        // use an available port
        dumpTask.setPort(8840);
        // bind to localhost
        dumpTask.setAddress("127.0.0.1");
        dumpTask.execute();
        return Result.succeed(true);
    }
}

JVM argument to load the agent:

-javaagent:$BASEDIR/bin/jacocoagent.jar=includes=com.jdwl.*,output=tcpserver,port=8840,address=127.0.0.1 -Xverify:none

Result Visualization

After dumping the coverage data, open the generated /export/Data/coverage/code-cover.exec file in the IDE. Green highlights represent actively executed code, while red highlights reveal dead (zombie) code. Screenshots (images) illustrate the color coding.

Implementation Steps for Users

Launch the scanning tool and select the project directory.

Click “Generate DB” to parse the code and store metadata in a database.

Click “Scan” to run the static and/or runtime analysis and obtain results.

Review the displayed report, which lists identified dead methods and coverage statistics.

References

JaCoCo Documentation

JavaAgent usage guide (rickiyang blog)

Practical JaCoCo coverage analysis (M104 blog)

Bytecode manipulation articles (ASM, Javassist)