A tested semantics for getters, setters, and eval in JavaScript

Politz, Joe Gibbs; Carroll, Matthew J.; Lerner, Benjamin S.; Pombrio, Justin; Krishnamurthi, Shriram

doi:10.1145/2384577.2384579

Cited by 38 publications

(18 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There is a rich landscape of IRs for JavaScript, broadly divided into two categories: (1) those for syntax-directed analyses, following the abstract syntax tree of the program, such as λ J S [Guha et al 2010], S5 [Politz et al 2012], and notJS [Kashyap et al 2014]; and (2) those for analyses based on the control-flow graph of the program, such as JSIR [Livshits 2014], WALA [Sridharan et al 2012] and the IR of TAJS [Andreasen and Mùller 2014;Jensen et al 2009]. SAFE [Lee et al 2012], an analysis framework for JavaScript, provides IRs in both categories.…”

Section: Related Workmentioning

confidence: 99%

JaVerT: JavaScript verification toolchain

Santos

Maksimovic

Naudžiūnienė

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

The dynamic nature of JavaScript and its complex semantics make it a difficult target for logic-based verification. We introduce JaVerT, a semi-automatic JavaScript Verification Toolchain, based on separation logic and aimed at the specialist developer wanting rich, mechanically verified specifications of critical JavaScript code. To specify JavaScript programs, we design abstractions that capture its key heap structures (for example, prototype chains and function closures), allowing the developer to write clear and succinct specifications with minimal knowledge of the JavaScript internals. To verify JavaScript programs, we develop JaVerT, a verification pipeline consisting of: JS-2-JSIL, a well-tested compiler from JavaScript to JSIL, an intermediate goto language capturing the fundamental dynamic features of JavaScript; JSIL Verify, a semi-automatic verification tool based on a sound JSIL separation logic; and verified axiomatic specifications of the JavaScript internal functions. Using JaVerT, we verify functional correctness properties of: data-structure libraries (key-value map, priority queue) written in an object-oriented style; operations on data structures such as binary search trees (BSTs) and lists; examples illustrating function closures; and test cases from the official ECMAScript test suite. The verification times suggest that reasoning about larger, more complex code using JaVerT is feasible. INTRODUCTIONSeparation logic was developed in order to reason about programs that manipulate data structures in the heap. The reasoning has been shown to be tractable, with compositional techniques that scale [Reynolds 2002] and properly engineered tools applied to real-world code. In particular, separation logic has been used to reason about programs written in static languages: for example, the semi-automatic verification tool Verifast [Jacobs et al. 2011] for reasoning about C and Java Authors' addresses: José Fragoso Santos, Imperial College London, UK, jose.fragoso.santos@imperial.ac.uk; Petar Maksimović, Imperial College London, UK, petar.maksimovic@imperial.ac.uk, Mathematical Institute SASA, Serbia; Daiva Naudžiūnienė, Imperial College London, UK, daiva.naudziuniene@imperial.ac.uk; Thomas Wood, Imperial College London, UK, thomas.wood@imperial.ac.uk; Philippa Gardner, Imperial College London, UK, p.gardner@imperial.ac.uk.Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). 50:2 J. Fragoso Santos, P. Maksimović, D. Naudžiūnienė, T. Wood, P. Gardner programs; the automatic verification tool Infer [Calcagno et al. 2015], being developed at Facebook, for reasoning about C, Java, C++ and Objective C programs; and the interactive Coq development for reasoning about, f...

show abstract

Section: Related Workmentioning

confidence: 99%

JaVerT: JavaScript verification toolchain

Santos

Maksimovic

Naudžiūnienė

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

show abstract

“…They target the Firefox implementation of ES3, and validate their semantics by testing it against the test262 and Mozilla test suites [18,42]. More recently, λJS has been extended to model the strict mode of ES5 [50], and an unpublished, small-scale Coq formalisation of λJS has been announced on the Brown PLT blog [51].…”

Section: Formal Javascript Specificationsmentioning

confidence: 99%

A trusted mechanised JavaScript specification

Bodin

Charguéraud

Filaretti

et al. 2014

Proceedings of the 41st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages

View full text Add to dashboard Cite

JavaScript is the most widely used web language for client-side applications. Whilst the development of JavaScript was initially just led by implementation, there is now increasing momentum behind the ECMA standardisation process. The time is ripe for a formal, mechanised specification of JavaScript, to clarify ambiguities in the ECMA standards, to serve as a trusted reference for high-level language compilation and JavaScript implementations, and to provide a platform for high-assurance proofs of language properties.We present JSCert, a formalisation of the current ECMA standard in the Coq proof assistant, and JSRef, a reference interpreter for JavaScript extracted from Coq to OCaml. We give a Coq proof that JSRef is correct with respect to JSCert and assess JSRef using test262, the ECMA conformance test suite. Our methodology ensures that JSCert is a comparatively accurate formulation of the English standard, which will only improve as time goes on. We have demonstrated that modern techniques of mechanised specification can handle the complexity of JavaScript.

show abstract

“…Even simple examples can produce very large output: for instance, in the JavaScript semantics S5 [2], console.log("Hello world") produces the output shown in Figure 2. This code blow-up can frustate attempts to understand the output and to subsequently debug programs that process it.…”

Section: Challengesmentioning

confidence: 99%