Type refinement for static analysis of JavaScript

Abstract

Static analysis of JavaScript has proven useful for a variety of purposes, including optimization, error checking, security auditing, program refactoring, and more. We propose a technique called type refinement that can improve the precision of such static analyses for JavaScript without any discernible performance impact. Refinement is a known technique that uses the conditions in branch guards to refine the analysis information propagated along each branch path. The key insight of this paper is to recognize that JavaScript semantics include many implicit conditional checks on types, and that performing type refinement on these implicit checks provides significant benefit for analysis precision.To demonstrate the effectiveness of type refinement, we implement a static analysis tool for reporting potential type-errors in JavaScript programs. We provide an extensive empirical evaluation of type refinement using a benchmark suite containing a variety of JavaScript application domains, ranging from the standard performance benchmark suites (Sunspider and Octane), to open-source JavaScript applications, to machine-generated JavaScript via Emscripten. We show that type refinement can significantly improve analysis precision by up to 86% without affecting the performance of the analysis.

Desynchronized Multi-State Abstractions for Open Programs in Dynamic Languages

“…TAJS [17,18], WALA [27], JSAI [15,19], and SAFE [1,21] are whole-program JavaScript analyses. Unlike the above systems, they require no annotations at all and are highly automated.…”

“…As a result, there is a proliferation of generic libraries and code reuse in the JavaScript community. Unfortunately, even though library authors would like to know that their libraries work correctly with any client, current verification techniques cannot verify this because they do not also follow the DRY mantra -they require reverifying libraries along with each and every client [15,[17][18][19]27]. This paper brings the DRY mantra to automatic dynamic language verification by modularly verifying libraries without the presence of client code.…”

Automatic Analysis of Open Objects in Dynamic Language Programs

“…As opposed to directly abstracting open objects, TAJS [21,22], WALA [31], and JSAI [19,24] extend standard field-sensitive analyses to JavaScript by adding a summary field for all unknown attributes. They employ clever interprocedural analysis tricks to propagate statically known object attributes through loops and across function call boundaries.…”

Dompletion

“…Further, it is possible to assign this variable to a different type by executing a different assignment statement within the same JavaScript code. The dynamic typed feature of JavaScript makes it difficult to analyze the variable types statically, as these types can be modified during program execution [15,23].…”