An Empirical Study of CGO Usage in Go Projects -- Distribution, Purposes, Patterns and Critical Issues

TL;DR

This study empirically analyzes CGO usage in 920 Go projects, revealing its distribution, purposes, common issues, and proposing solutions to improve safety and toolchain support.

Contribution

It provides the first comprehensive empirical analysis of CGO in Go, identifying key usage patterns, critical issues, and proposing improvements to the Go toolchain.

Findings

11.3% of projects use CGO, concentrated in a subset

Four primary purposes of CGO identified

19 types of CGO-related issues, including critical pointer check problems

Abstract

Multilingual software development integrates multiple languages into a single application, with the Foreign Function Interface (FFI) enabling seamless interaction. While FFI boosts efficiency and extensibility, it also introduces risks. Existing studies focus on FFIs in languages like Python and Java, neglecting CGO, the emerging FFI in Go, which poses unique risks. To address these concerns, we conduct an empirical study of CGO usage across 920 open-source Go projects. Our study aims to reveal the distribution, patterns, purposes, and critical issues associated with CGO, offering insights for developers and the Go team. We develop CGOAnalyzer, a tool to efficiently identify and quantify CGO-related features. Our findings reveal that: (1) 11.3% of analyzed Go projects utilize CGO, with usage concentrated in a subset of projects; (2) CGO serves 4 primary purposes, including system-level interactions and performance optimizations, with 15 distinct usage patterns observed; (3) 19 types of CGO-related issues exist, including one critical issue involving unnecessary pointer checks that pose risks of runtime crashes due to limitations in the current Go compilation toolchain; (4) a temporary solution reduces unnecessary pointer checks, mitigating crash risks, and (5) we submitted a proposal to improve the Go toolchain for a permanent fix, which has been grouped within an accepted proposal for future resolution. Our findings provide valuable insights for developers and the Go team, enhancing development efficiency and reliability while improving the robustness of the Go toolchain.