JaVerT: JavaScript verification toolchain

Abstract

The dynamic nature of JavaScript and its complex semantics make it a difficult target for logic-based verification. We introduce JaVerT, a semi-automatic JavaScript Verification Toolchain, based on separation logic and aimed at the specialist developer wanting rich, mechanically verified specifications of critical JavaScript code. To specify JavaScript programs, we design abstractions that capture its key heap structures (for example, prototype chains and function closures), allowing the developer to write clear and succinct specifications with minimal knowledge of the JavaScript internals. To verify JavaScript programs, we develop JaVerT, a verification pipeline consisting of: JS-2-JSIL, a well-tested compiler from JavaScript to JSIL, an intermediate goto language capturing the fundamental dynamic features of JavaScript; JSIL Verify, a semi-automatic verification tool based on a sound JSIL separation logic; and verified axiomatic specifications of the JavaScript internal functions. Using JaVerT, we verify functional correctness properties of: data-structure libraries (key-value map, priority queue) written in an object-oriented style; operations on data structures such as binary search trees (BSTs) and lists; examples illustrating function closures; and test cases from the official ECMAScript test suite. The verification times suggest that reasoning about larger, more complex code using JaVerT is feasible. INTRODUCTIONSeparation logic was developed in order to reason about programs that manipulate data structures in the heap. The reasoning has been shown to be tractable, with compositional techniques that scale [Reynolds 2002] and properly engineered tools applied to real-world code. In particular, separation logic has been used to reason about programs written in static languages: for example, the semi-automatic verification tool Verifast [Jacobs et al. 2011] for reasoning about C and Java Authors' addresses: José Fragoso Santos, Imperial College London, UK, jose.fragoso.santos@imperial.ac.uk; Petar Maksimović, Imperial College London, UK, petar.maksimovic@imperial.ac.uk, Mathematical Institute SASA, Serbia; Daiva Naudžiūnienė, Imperial College London, UK, daiva.naudziuniene@imperial.ac.uk; Thomas Wood, Imperial College London, UK, thomas.wood@imperial.ac.uk; Philippa Gardner, Imperial College London, UK, p.gardner@imperial.ac.uk.Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). 50:2 J. Fragoso Santos, P. Maksimović, D. Naudžiūnienė, T. Wood, P. Gardner programs; the automatic verification tool Infer [Calcagno et al. 2015], being developed at Facebook, for reasoning about C, Java, C++ and Objective C programs; and the interactive Coq development for reasoning about, f...

Symbolic Execution for JavaScript

“…We also apply Cosette to specification-driven bug-finding. Functional correctness specifications of JS programs are highly intricate, with only a few tools (JaVerT [22] and KJS [16,36]) supporting such expressivity. When these tools cannot prove that a given function satisfies a specification, the developer has to understand a complicated proof trace to discover the error (JaVerT), or act with essentially no feedback (KJS).…”

“…Cosette supports the specification of symbolic states via simple separation logic assertions in the style of JaVerT [22]. Developers have at their disposal a number of built-in predicates that capture the fundamental concepts of JavaScript (discussed throughout the text), and can define their own predicates as well.…”

“…We present a new methodology for designing compositional program analyses for dynamic languages, illustrating our approach by defining a new compositional symbolic execution for JSIL, an intermediate representation for JS analysis [22]. We develop a new, abstract semantics for JSIL, in the spirit of [50], which we instantiate to obtain the concrete, instrumented, and symbolic semantics.…”

“…We approach this problem by first designing an instrumented version of the language semantics that does observe the frame property. To achieve this, the JSIL instrumented semantics keeps track of both the present and the absent properties of a given object, using ideas from [22,23]. An instrumented state σ is a triple (h, d, ρ) consisting of an instrumented heap, a domain table, and a store.…”

“…We extend JS with constructs for creating and reasoning about symbolic values. Using JS-2-JSIL [22], a trusted compiler from JS to the JSIL intermediate language, we compile the extended JS program to an extended JSIL program. The core of Cosette is a new symbolic interpreter for JSIL, written in Rosette [48,49], a framework for creating symbolic interpreters.…”