Points-to analysis for JavaScript

Jang, Dongseok; Choe, Kwang-Moo

doi:10.1145/1529282.1529711

Cited by 45 publications

(38 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The tool is implemented in Java and uses the JavaScript parser from the Mozilla Rhino project 10 . The new extensions amount to 7,500 lines of code on top of the existing 21,000 lines (excluding Rhino).…”

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Modeling the HTML DOM and browser API in static analysis of JavaScript web applications

Jensen

Madsen

Møller

2011

Proceedings of the 19th ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering

View full text Add to dashboard Cite

Developers of JavaScript web applications have little tool support for catching errors early in development. In comparison, an abundance of tools exist for statically typed languages, including sophisticated integrated development environments and specialized static analyses. Transferring such technologies to the domain of JavaScript web applications is challenging. In this paper, we discuss the challenges, which include the dynamic aspects of JavaScript and the complex interactions between JavaScript, HTML, and the browser. From this, we present the first static analysis that is capable of reasoning about the flow of control and data in modern JavaScript applications that interact with the HTML DOM and browser API.One application of such a static analysis is to detect typerelated and dataflow-related programming errors. We report on experiments with a range of modern web applications, including Chrome Experiments and IE Test Drive applications, to measure the precision and performance of the technique. The experiments indicate that the analysis is able to show absence of errors related to missing object properties and to identify dead and unreachable code. By measuring the precision of the types inferred for object properties, the analysis is precise enough to show that most expressions have unique types. By also producing precise call graphs, the analysis additionally shows that most invocations in the programs are monomorphic. We furthermore study the usefulness of the analysis to detect spelling errors in the code. Despite the encouraging results, not all problems are solved and some of the experiments indicate a potential for improvement, which allows us to identify central remaining challenges and outline directions for future work.

show abstract

Section: Discussionmentioning

confidence: 99%

“…More recently, Jang and Choe have presented a pointsto analysis for a restricted subset of JavaScript based on set constraints [10]. The points-to results are used for optimizations that inline property accesses.…”

Section: Related Workmentioning

confidence: 99%

Modeling the HTML DOM and browser API in static analysis of JavaScript web applications

Jensen

Madsen

Møller

2011

Proceedings of the 19th ACM SIGSOFT Symposium and the 13th European Conference on Foundations of Software Engineering

View full text Add to dashboard Cite

show abstract

“…(1) an unsound 2 dataflow analysis-based approach using baked-in abstractions and analysis sensitivities [17,26,31], or (2) a formally-specified type system requiring annotations to existing code, proven sound with respect to a specific JavaScript formal semantics but restricted to a small subset of the full JavaScript language [45,30,19,28]. No existing JavaScript analyses are formally specified, implemented using an executable abstract semantics, tested against a formal concrete semantics, or target configurable sensitivity.…”

Section: Related Workmentioning

confidence: 99%

“…Various previous works [15,45,31,39,25,44,24] propose different subsets of the JavaScript language and provide analyses for that subset. These analyses range from type inference, to pointer analysis, to numeric range and kind analysis.…”

Section: Related Workmentioning

confidence: 99%

JSAI: a static analysis platform for JavaScript

Kashyap

Dewey

Kuefner

et al. 2014

Proceedings of the 22nd ACM SIGSOFT International Symposium on Foundations of Software Engineering

134

View full text Add to dashboard Cite

JavaScript is used everywhere from the browser to the server, including desktops and mobile devices. However, the current state of the art in JavaScript static analysis lags far behind that of other languages such as C and Java. Our goal is to help remedy this lack. We describe JSAI, a formally specified, robust abstract interpreter for JavaScript. JSAI uses novel abstract domains to compute a reduced product of type inference, pointer analysis, control-flow analysis, string analysis, and integer and boolean constant propagation. Part of JSAI's novelty is user-configurable analysis sensitivity, i.e., context-, path-, and heap-sensitivity. JSAI is designed to be provably sound with respect to a specific concrete semantics for JavaScript, which has been extensively tested against a commercial JavaScript implementation.We provide a comprehensive evaluation of JSAI's performance and precision using an extensive benchmark suite, including real-world JavaScript applications, machine generated JavaScript code via Emscripten, and browser addons. We use JSAI's configurability to evaluate a large number of analysis sensitivities (some well-known, some novel) and observe some surprising results that go against common wisdom. These results highlight the usefulness of a configurable analysis platform such as JSAI.

show abstract

“…The current state of the art is well surveyed by Andreasen and Møller [9], with the main tools in the field being WALA [50,54] and TAJS [9,28,27]. These tools (and others) provide traditional static analysis frameworks encompassing features such as points-to [26,54] and determinacy analysis [9,50], type inference [33,28] and security properties [23,24]. The modelling of the HTML DOM is generally treated as part of the heap abstraction [27,24] and thus the tree structure is not precisely tracked.…”

Section: Introductionmentioning

confidence: 99%

Detecting redundant CSS rules in HTML5 applications: a tree rewriting approach

Hague

Lin

Ong

2015

Proceedings of the 2015 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applicatio

View full text Add to dashboard Cite

HTML5 applications normally have a large set of CSS (Cascading Style Sheets) rules for data display. Each CSS rule consists of a node selector and a declaration block (which assigns values to selected nodes' display attributes). As web applications evolve, maintaining CSS files can easily become problematic. Some CSS rules will be replaced by new ones, but these obsolete (hence redundant) CSS rules often remain in the applications. Not only does this "bloat" the applications -increasing the bandwidth requirement -but it also significantly increases web browsers' processing time. Most works on detecting redundant CSS rules in HTML5 applications do not consider the dynamic behaviors of HTML5 (specified in JavaScript); in fact, the only proposed method that takes these into account is dynamic analysis, which cannot soundly prove redundancy of CSS rules. In this paper, we introduce an abstraction of HTML5 applications based on monotonic tree-rewriting and study its "redundancy problem". We establish the precise complexity of the problem and various subproblems of practical importance (ranging from P to EXP). In particular, our algorithm relies on an efficient reduction to an analysis of symbolic pushdown systems (for which highly optimised solvers are available), which yields a fast method for checking redundancy in practice. We implemented our algorithm and demonstrated its efficacy in detecting redundant CSS rules in HTML5 applications.

show abstract

Points-to analysis for JavaScript

Cited by 45 publications

References 12 publications

Modeling the HTML DOM and browser API in static analysis of JavaScript web applications

Modeling the HTML DOM and browser API in static analysis of JavaScript web applications

JSAI: a static analysis platform for JavaScript

Detecting redundant CSS rules in HTML5 applications: a tree rewriting approach

Contact Info

Product

Resources

About