GoCPG vs Joern: Comparative Analysis¶

Date: 2026-02-25 Joern Version: 4.0.426 (flatgraph) GoCPG Version: 0.1.0 (DuckDB) Codebases: GoCPG (Go, 215 files), CodeGraph (Python, 1183 files)

Executive Summary¶

GoCPG is 3.9x faster than Joern at CPG generation while producing richer graphs with more edge types (DDG, PDG, eval_type, binds_to). Joern generates 2.6x more CDG edges due to modeling function calls as branch-points (exception paths). Both use identical core algorithms (Cooper-Harvey-Kennedy dominators, Ferrante-Ottenstein-Warren CDG). The key architectural difference: GoCPG is a native Go binary writing directly to DuckDB, while Joern is a JVM/Scala system using in-memory flatgraph.

1. Performance Comparison¶

Parse + Full Analysis Pipeline¶

Pass-Level Timing (Go Codebase)¶

GoCPG advantage: DAG-based parallel pipeline runs all 30 passes with dependency resolution. Joern runs passes sequentially.

Memory & Storage¶

2. Node Count Comparison¶

Go Codebase (GoCPG source, 215 files)¶

GoCPG-exclusive node types (not in Joern): - finding (1,199) — pattern/quality findings - binding (6,253) — type-method bindings - field_identifier (19,876) — struct field access - modifier (670) — visibility modifiers - import (1,097) — import declarations - method_parameter_out (8,900) — output parameters - type_ref (2,137) — type references

Python Codebase (CodeGraph source, 1183 files)¶

3. Edge Count Comparison¶

Go Codebase¶

Python Codebase¶

Note: Joern’s 15.9M call edges for Python comes from NaiveCallLinker which aggressively links all calls by name — this is a known over-approximation.

4. CDG Root Cause Analysis: 59K vs 153K¶

The Key Finding¶

Despite nearly identical CFG edge counts (270K vs 268K), Joern produces 14.2x more branching nodes:

Why Joern Has More Branches¶

Joern models every function call as a potential branch point — calls can either return normally or throw an exception (two paths). With Go’s explicit error returns (no exceptions), this creates 13,031 spurious branches that don’t exist in the actual control flow.

Impact Chain¶

More branching nodes → Different post-dominator trees →
Larger post-dominator frontiers → More CDG edges

GoCPG:    970 branching →  59K CDG
Joern: 13,734 branching → 153K CDG

Algorithm Comparison¶

Both use identical algorithms:

Correctness for Go¶

For Go specifically, GoCPG’s CDG is more precise because Go uses explicit error returns (if err != nil), not try/catch exceptions. Joern’s exception-path modeling creates spurious control dependencies that don’t exist in Go.

5. Architectural Comparison¶

Pipeline Design¶

Pass Pipeline¶

Unique GoCPG Features (Not in Joern)¶

1. DDG — explicit data dependency edges
2. PDG — combined CDG + data dependency
3. AliasAnalysisPass — intraprocedural points-to analysis (p = &x → pts[p]={x}, pointer copy, indirect field resolution p->field → obj.field)
4. InterproceduralReachingDef — cross-function data flow with stdlib semantics + global side-effect propagation
5. Ternary indirect calls — (cond ? f1 : f2)(args) emits separate CallNodes per branch (C/C++)
6. PatternMatchPass — structural pattern search integrated into pipeline
7. FindingGenerationPass — quality/security findings as CPG nodes
8. DomainAnnotationPass — domain-specific tagging (PostgreSQL, Django, etc.)
9. VCSTagPass — git author, change-frequency, last-modified tags
10. Incremental updates — git diff-based with branch tracking and merge support
11. Watch mode — file system watcher with live CPG updates
12. DuckDB output — SQL-queryable without JVM

Unique Joern Features (Not in GoCPG)¶

1. Interactive REPL — Scala console for ad-hoc graph queries
2. 13 language frontends (vs GoCPG’s 11) — Ruby, Swift
3. GHIDRA frontend — binary analysis support
4. NaiveCallLinker — aggressive name-based call resolution
5. PythonTypeRecovery — iterative type inference (2-pass)

6. Data Flow Comparison¶

Reaching Definitions¶

Call Graph¶

7. Python Parity Analysis (Deduplication-Corrected)¶

File Path Duplication Bug¶

GoCPG has a file path normalization bug that inflates Python codebase numbers: each source file is stored with both absolute (D:\work\codegraph\src\...) and relative (..\src\...) paths, creating ~2x FILE nodes and duplicating all contained nodes/edges.

Root cause: orchestrator.go:280 appends absolute paths from filepath.WalkDir(). A separate import/type resolution mechanism in the Python frontend creates entries with relative paths. The CPGGraph.filesByName uses raw paths as keys, so both coexist. Method full_names embed the file path (filepath:ClassName.method), preventing deduplication.

Deduped Node Comparison¶

Using absolute-path-only counts as the true deduplicated values:

Deduped Edge Comparison (estimated /2)¶

Note: Joern’s 15.9M call edges come from NaiveCallLinker — ~18x over-approximation by aggressively linking all calls by name.

Python Parity Verdict¶

Core parity achieved after correcting for the file duplication bug: - Internal methods: -10% — minor gap from synthetic method generation differences - CFG: +10%, Reaching defs: -3%, AST: +9% — all near parity - CDG: +34% — expected: GoCPG properly models Python exception branching - Call graph: GoCPG 18x more precise than Joern’s NaiveCallLinker - Exclusive: DDG, PDG, eval_type, binds_to, capture, inherits_from — only in GoCPG

8. Language Coverage¶

9. Summary Scorecard¶

Generated: 2026-02-25 | GoCPG v0.1.0 vs Joern v4.0.426