Static Checking of Range Assertions in JavaScript Programs

Abstract

Abstract-Because of the dynamic nature of JavaScript, an array access operation with a property (index) that is out of its range will not throw an arrayIndexoutOfBound exception, but will silently return the value undefined. This can cause programs to crash or malfunction. This work extends the JavaScript language with range assertions and allows developers to insert them at any program point. Range assertions could help detect such silent arrayIndexoutOfBound exceptions and can be useful for program understanding and debugging. We propose an assertion language that can be used in any JavaScript static analyzer. Assertions are statically checked and possible violations are reported. The experiments on a set of benchmark programs reported a violation that would have been previously unnoticed.Index Terms-Abstract interpretation, interval domain, JavaScript, range assertions. I. INTRODUCTIONStatic analysis, which is the automatic discovery of program properties, has long been used for program understanding and program verification. Program developers rely on it to identify potential errors and correct them. For programming languages like C and Java, state of the art static analyzers are available for each stage of development thanks to their static nature. However, the situation is different for JavaScript. It supports first class functions, uses prototype inheritance and dynamic typing. The very same features that made JavaScript special, easy to use and attractive for developers are the same ones behind the difficulty of developing static analyzers that are scalable and precise enough.With the increasing use of the language, a lot of effort has been done this last decade by the research community to equip JavaScript developers with better tools. The main contributions of this paper are: 1. The extension of the JavaScript language with range assertions. We designed an assertion language that can be integrated in any JavaScript static analyzer. 2. An empirical evaluation of assertion checks on a set of benchmarks. Range assertions were manually inserted in the analyzed programs. On most of the benchmarks, the inserted assertions were satisfied, which is a sign of a good execution of the programs as far as the checked properties were concerned. Some assertions were reported to have failed due to the over-approximation of the analysis. We found one real violation on 7 benchmark programs analyzed. II. MOTIVATING EXAMPLEArrays in JavaScript are different from regular objects with the length property. An index is a string of digit characters representing a positive integer property between 0 and 2 32 -2. The length property is automatically updated to the maximum index plus 1. Due to its dynamic nature, JavaScript allows array objects to have properties that are negative numbers, non-integer numbers and non-numeric values. When accessing a non-existing property in an array, JavaScript does not throw an arrayIndexoutOfBound In the above example, the range assertion fails because the variable i has not been initialized. T...