Static program analysis often encounters problems in analyzing library code. Most real-world programs use library functions intensively, and library functions are usually written in different languages. For example, static analysis of JavaScript programs requires analysis of the standard built-in library implemented in host environments. A common approach to analyze such opaque code is for analysis developers to build models that provide the semantics of the code. Models can be built either manually, which is time consuming and error prone, or automatically, which may limit application to different languages or analyzers. In this paper, we present a novel mechanism to support automatic modeling of opaque code, which is applicable to various languages and analyzers. For a given static analysis, our approach automatically computes analysis results of opaque code via dynamic testing during static analysis. By using testing techniques, the mechanism does not guarantee sound over-approximation of program behaviors in general. However, it is fully automatic, is scalable in terms of the size of opaque code, and provides more precise results than conventional over-approximation approaches. Our evaluation shows that although not all functionalities in opaque code can (or should) be modeled automatically using our technique, a large number of JavaScript built-in functions are approximated soundly yet more precisely than existing manual models.

JavaScript web applications (apps) are prevalent these days, and quality assurance of web apps gets even more important. Even though researchers have studied various analysis techniques and software industries have developed code analyzers for their own code repositories, statically analyzing web apps in a sound and scalable manner is challenging. On top of dynamic features of JavaScript, abundant execution flows triggered by user events make a sound static analysis difficult. In this paper, we propose a novel EventHandler (EH)-based static analysis for web apps using dynamically collected state information. Unlike traditional whole-program analyses, the EH-based analysis intentionally analyzes partial execution flows using concrete user events. Such analyses surely miss execution flows in the entire program, but they analyze less infeasible flows reporting less false positives. Moreover, they can finish analyzing partial flows of web apps that whole-program analyses often fail to finish analyzing, and produce partial bug reports. Our experimental results show that the EH-based analysis improves the precision dramatically compared with a state-of-the-art JavaScript whole-program analyzer, and it can finish analysis of partial execution flows in web apps that the whole-program analyzer fails to analyze within a timeout.

Just-in-time (JIT) intervention aims to proactively detect a user's problematic behaviors and deliver interventions at an opportune moment to facilitate target behaviors. However, prior studies have shown that JIT intervention may suffer from user disengagement, a phenomenon in which a user's level of engagement with intervention apps and target behaviors declines over time. In this study, we aimed to deepen our understanding of disengagement in a mobile JIT intervention system. As a case study, we conducted a user study with college students (n = 54) for eight weeks to understand how disengagement appears over time and what factors influence user disengagement. Our findings reveal that personal traits, such as boredom proneness and self-control issues, are closely related to disengagement, with key factors including 1) boredom and habituation related to repetitive and monotonous JIT interventions, 2) inopportune alarm, 3) distrust for the JIT feedback mechanism, and 4) a lack of motivation due to low rewards. We provide theoretical and practical design guidelines for follow-up studies on JIT intervention system design.