Detecting JavaScript races that matter

Abstract

As JavaScript has become virtually omnipresent as the language for programming large and complex web applications in the last several years, we have seen an increase in interest in finding data races in client-side JavaScript. While JavaScript execution is single-threaded, there is still enough potential for data races, created largely by the nondeterminism of the scheduler. Recently, several academic efforts have explored both static and runtime analysis approaches in an effort to find data races. However, despite this, we have not seen these analysis techniques deployed in practice and we have only seen scarce evidence that developers find and fix bugs related to data races in JavaScript. In this paper we argue for a different formulation of what it means to have a data race in a JavaScript application and distinguish between benign and harmful races, affecting persistent browser or server state. We further argue that while benign races-the subject of the majority of prior workdo exist, harmful races are exceedingly rare in practice (19 harmful vs. 621 benign). Our results shed a new light on the issues of data race prevalence and importance. To find races, we also propose a novel lightweight runtime symbolic exploration algorithm for finding races in traces of runtime execution. Our algorithm eschews schedule exploration in favor of smaller runtime overheads and thus can be used by beta testers or in crowd-sourced testing. In our experiments on 26 sites, we demonstrate that benign races are considerably more common than harmful ones.

A model for reasoning about JavaScript promises

“…This means that, even with one thread, it is possible to have multiple different interleavings of promise reactions. There has been notable recent work on the detection of event races in JavaScript (see, e.g., Jensen et al [2015]; Mutlu et al [2015]; Petrov et al [2012]; Raychev et al [2013]), but, to our knowledge, none of this work explicitly considers promises.…”

Practical initialization race detection for JavaScript web applications

“…The R 4 tool [Jensen et al 2015] is based on EventRacer's trace construction and also fails to detect the error in the example. The tool by Mutlu et al [2015] only considers race errors that affect persistent storage, which is not the case for the error in this example (and for the two following examples).…”

“…Such races occur due to nondeterministic ordering of event handlers, for example when program behavior depends on whether a user event appears before or after a script has been loaded. Traditional testing is insufficient for discovering unexpected harmful event orderings, which has motivated the development of a range of powerful techniques and tools to detect event races automatically [Hong et al 2014;Ide et al 2009;Jensen et al 2015;Mutlu et al 2015;Petrov et al 2012;Raychev et al 2013;Wang et al 2016;Zheng et al 2011]. However, these existing approaches suffer from various limitations, which makes them unsuitable for production use.…”

“…For example, the dynamic race detector EventRacer [Raychev et al 2013] reports an overwhelming number of races on typical web applications. Most of those races are benign, and it is difficult to classify each race warning as harmful or benign based on the output of the tool [Hong et al 66:2 Christoffer Quist Adamsen, Anders Mùller, and Frank Tip 2014;Jensen et al 2015;Mutlu et al 2015]. Many races arise due to ad-hoc synchronization that was added by programmers to prevent event race errors, or simply do not affect the application's functionality.…”

“…Many races arise due to ad-hoc synchronization that was added by programmers to prevent event race errors, or simply do not affect the application's functionality. The tool by Mutlu et al [2015] attempts to focus on harmful races, specifically those that affect persistent storage, using a combination of dynamic execution and lightweight static analysis. However, with their technique, any error that may disappear by reloading the web page is considered benign, even though the error may damage functionality or user experience.…”