JSAI: a static analysis platform for JavaScript

Kashyap, Vineeth; Dewey, Kyle; Kuefner, Ethan A.; Wagner, John; Gibbons, Kevin; Sarracino, John; Wiedermann, Ben; Hardekopf, Ben

doi:10.1145/2635868.2635904

Cited by 134 publications

(79 citation statements)

References 36 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Several studies have focused on static analysis for JavaScript since ASATs have different kinds of requirements for dynamic languages than for static languages [126,111,86]. Other research has been conducted on general ASATs, including how developers use these tools…”

Section: Introductionmentioning

confidence: 99%

Why and how JavaScript developers use linters

Tomasdottir

Aniche

Deursen

2017

2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

A linter is a type of static analysis tool that warns software developers about possible errors in code or violations to coding standards. By using such a tool, errors can be surfaced early in the development process when they are cheaper to fix, and code can be kept more readable and maintainable. For such a tool to be successful, it is important for its creators to understand the needs and challenges of developers when using a linter. Furthermore, it needs to be made clear to developers why using such a tool can be beneficial, along with how linters can be configured to identify appropriate and relevant issues for their projects.In this thesis, we examine developers' perceptions of linters to increase our knowledge on these tools for JavaScript, the most widely used programming language in the world today. More specifically, we study why and how developers use ESLint, the most popular JavaScript linter, along with the challenges that they face while using the tool. We collect data with three different methods where we first interview 15 experts on using linters, then analyze over 9,500 ESLint configuration files and finally survey more than 300 developers from the JavaScript community. The combined results from these analyses provide developers, tool makers and researchers with valuable knowledge and advice on using and developing a linter for JavaScript.

show abstract

Section: Introductionmentioning

confidence: 99%

Why and how JavaScript developers use linters

Tomasdottir

Aniche

Deursen

2017

2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

show abstract

“…We used the abstract interpreter JSAI from [15] to test the assertions. JSAI is a framework written in Scala.…”

Section: Discussionmentioning

confidence: 99%

“…The assertion statement is a special function call. All the details about the translator can be found in [15]. The static analysis engine takes as input the abstract syntax tree extended with assertion statements.…”

mentioning

confidence: 99%

Static Checking of Range Assertions in JavaScript Programs

Younang¹,

Lu²

2017

IJCTE

View full text Add to dashboard Cite

Abstract-Because of the dynamic nature of JavaScript, an array access operation with a property (index) that is out of its range will not throw an arrayIndexoutOfBound exception, but will silently return the value undefined. This can cause programs to crash or malfunction. This work extends the JavaScript language with range assertions and allows developers to insert them at any program point. Range assertions could help detect such silent arrayIndexoutOfBound exceptions and can be useful for program understanding and debugging. We propose an assertion language that can be used in any JavaScript static analyzer. Assertions are statically checked and possible violations are reported. The experiments on a set of benchmark programs reported a violation that would have been previously unnoticed.Index Terms-Abstract interpretation, interval domain, JavaScript, range assertions. I. INTRODUCTIONStatic analysis, which is the automatic discovery of program properties, has long been used for program understanding and program verification. Program developers rely on it to identify potential errors and correct them. For programming languages like C and Java, state of the art static analyzers are available for each stage of development thanks to their static nature. However, the situation is different for JavaScript. It supports first class functions, uses prototype inheritance and dynamic typing. The very same features that made JavaScript special, easy to use and attractive for developers are the same ones behind the difficulty of developing static analyzers that are scalable and precise enough.With the increasing use of the language, a lot of effort has been done this last decade by the research community to equip JavaScript developers with better tools. The main contributions of this paper are: 1. The extension of the JavaScript language with range assertions. We designed an assertion language that can be integrated in any JavaScript static analyzer. 2. An empirical evaluation of assertion checks on a set of benchmarks. Range assertions were manually inserted in the analyzed programs. On most of the benchmarks, the inserted assertions were satisfied, which is a sign of a good execution of the programs as far as the checked properties were concerned. Some assertions were reported to have failed due to the over-approximation of the analysis. We found one real violation on 7 benchmark programs analyzed. II. MOTIVATING EXAMPLEArrays in JavaScript are different from regular objects with the length property. An index is a string of digit characters representing a positive integer property between 0 and 2 32 -2. The length property is automatically updated to the maximum index plus 1. Due to its dynamic nature, JavaScript allows array objects to have properties that are negative numbers, non-integer numbers and non-numeric values. When accessing a non-existing property in an array, JavaScript does not throw an arrayIndexoutOfBound In the above example, the range assertion fails because the variable i has not been initialized. T...

show abstract

“…The existing literature covers a wide range of analysis techniques for JavaScript programs, including: type systems [Anderson et al 2005;Bierman et al 2014;Feldthaus and Mùller 2014;Jensen et al 2009;Microsoft 2014;Rastogi et al 2015;Thiemann 2005], control flow analysis [Feldthaus et al 2013], pointer analysis [Jang and Choe 2009;Sridharan et al 2012] and abstract interpretation [Andreasen and Mùller 2014;Jensen et al 2009;Kashyap et al 2014;Park and Ryu 2015], among others. In contrast, there has been comparatively little work on logic-based verification of JavaScript programs.…”

Section: Related Workmentioning

confidence: 99%

“…There is a rich landscape of IRs for JavaScript, broadly divided into two categories: (1) those for syntax-directed analyses, following the abstract syntax tree of the program, such as λ J S [Guha et al 2010], S5 [Politz et al 2012], and notJS [Kashyap et al 2014]; and (2) those for analyses based on the control-flow graph of the program, such as JSIR [Livshits 2014], WALA [Sridharan et al 2012] and the IR of TAJS [Andreasen and Mùller 2014;Jensen et al 2009]. SAFE [Lee et al 2012], an analysis framework for JavaScript, provides IRs in both categories.…”

Section: Related Workmentioning

confidence: 99%

JaVerT: JavaScript verification toolchain

Santos

Maksimovic

Naudžiūnienė

et al. 2017

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

The dynamic nature of JavaScript and its complex semantics make it a difficult target for logic-based verification. We introduce JaVerT, a semi-automatic JavaScript Verification Toolchain, based on separation logic and aimed at the specialist developer wanting rich, mechanically verified specifications of critical JavaScript code. To specify JavaScript programs, we design abstractions that capture its key heap structures (for example, prototype chains and function closures), allowing the developer to write clear and succinct specifications with minimal knowledge of the JavaScript internals. To verify JavaScript programs, we develop JaVerT, a verification pipeline consisting of: JS-2-JSIL, a well-tested compiler from JavaScript to JSIL, an intermediate goto language capturing the fundamental dynamic features of JavaScript; JSIL Verify, a semi-automatic verification tool based on a sound JSIL separation logic; and verified axiomatic specifications of the JavaScript internal functions. Using JaVerT, we verify functional correctness properties of: data-structure libraries (key-value map, priority queue) written in an object-oriented style; operations on data structures such as binary search trees (BSTs) and lists; examples illustrating function closures; and test cases from the official ECMAScript test suite. The verification times suggest that reasoning about larger, more complex code using JaVerT is feasible. INTRODUCTIONSeparation logic was developed in order to reason about programs that manipulate data structures in the heap. The reasoning has been shown to be tractable, with compositional techniques that scale [Reynolds 2002] and properly engineered tools applied to real-world code. In particular, separation logic has been used to reason about programs written in static languages: for example, the semi-automatic verification tool Verifast [Jacobs et al. 2011] for reasoning about C and Java Authors' addresses: José Fragoso Santos, Imperial College London, UK, jose.fragoso.santos@imperial.ac.uk; Petar Maksimović, Imperial College London, UK, petar.maksimovic@imperial.ac.uk, Mathematical Institute SASA, Serbia; Daiva Naudžiūnienė, Imperial College London, UK, daiva.naudziuniene@imperial.ac.uk; Thomas Wood, Imperial College London, UK, thomas.wood@imperial.ac.uk; Philippa Gardner, Imperial College London, UK, p.gardner@imperial.ac.uk.Permission to make digital or hard copies of part or all of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for third-party components of this work must be honored. For all other uses, contact the owner/author(s). 50:2 J. Fragoso Santos, P. Maksimović, D. Naudžiūnienė, T. Wood, P. Gardner programs; the automatic verification tool Infer [Calcagno et al. 2015], being developed at Facebook, for reasoning about C, Java, C++ and Objective C programs; and the interactive Coq development for reasoning about, f...

show abstract

JSAI: a static analysis platform for JavaScript

Cited by 134 publications

References 36 publications

Why and how JavaScript developers use linters

Why and how JavaScript developers use linters

Static Checking of Range Assertions in JavaScript Programs

JaVerT: JavaScript verification toolchain

Contact Info

Product

Resources

About