A Survey of Dynamic Analysis and Test Generation for JavaScript

Andreasen, Esben; Gong, Liang; Møller, Anders; Pradel, Michael; Selakovic, Marija; Sen, Koushik; Staicu, Cristian-Alexandru

doi:10.1145/3106739

Cited by 65 publications

(51 citation statements)

References 109 publications

(106 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Dynamic symbolic execution is used by Milani Fard et al [35] to generate DOM-based [37] present Atusa, a test generation technique for Ajax-based applications which they evaluate on six web applications. A comprehensive survey of dynamic analysis and test generation for JavaScript is presented by Andreasen et al [38].…”

Section: B Other Analysis and Testing Studies For Javascriptmentioning

confidence: 99%

BugsJS: a Benchmark of JavaScript Bugs

Gyimesi

Vancsics

Stocco

et al. 2019

2019 12th IEEE Conference on Software Testing, Validation and Verification (ICST)

View full text Add to dashboard Cite

JavaScript is a popular programming language that is also error-prone due to its asynchronous, dynamic, and loosely-typed nature. In recent years, numerous techniques have been proposed for analyzing and testing JavaScript applications. However, our survey of the literature in this area revealed that the proposed techniques are often evaluated on different datasets of programs and bugs. The lack of a commonly used benchmark limits the ability to perform fair and unbiased comparisons for assessing the efficacy of new techniques. To fill this gap, we propose BUGSJS, a benchmark of 453 real, manually validated JavaScript bugs from 10 popular JavaScript server-side programs, comprising 444k LOC in total. Each bug is accompanied by its bug report, the test cases that detect it, as well as the patch that fixes it. BUGSJS features a rich interface for accessing the faulty and fixed versions of the programs and executing the corresponding test cases, which facilitates conducting highly-reproducible empirical studies and comparisons of JavaScript analysis and testing tools.

show abstract

Section: B Other Analysis and Testing Studies For Javascriptmentioning

confidence: 99%

BugsJS: a Benchmark of JavaScript Bugs

Gyimesi

Vancsics

Stocco

et al. 2019

2019 12th IEEE Conference on Software Testing, Validation and Verification (ICST)

View full text Add to dashboard Cite

show abstract

“…This work is licensed under a Creative Commons Attribution International 4.0 License. present; (2) we define the JSIL symbolic semantics by lifting the JSIL instrumented semantics; and (3) we link the JSIL symbolic semantics to the JSIL concrete semantics by describing the frames that can be safely added to the initial state. The key innovation is to have the instrumented semantics as a proper interim stage in the design of the symbolic execution, obtaining more modular reasoning and substantially simpler proofs.…”

Section: :1mentioning

confidence: 99%

“…When running Cosette on this test, if the validKey(k) function was implemented incorrectly, 3 we will obtain the counter-model k = "hasOwnProperty". To understand this error, recall the heap and the implementation of get from Figure 1.…”

Section: Whole-program Symbolic Testingmentioning

confidence: 99%

“…2 In JavaScript, functions are also modelled as objects in the heap. 3 For instance, validKey(k) may only require that k is a string, which is a reasonable implementation in the sense that it disallows JavaScript's implicit coercions. 1…”

Section: Whole-program Symbolic Testingmentioning

confidence: 99%

“…(1) creates a new object o; (2) assigns 42 to the symbolic propertyŝ of o; (3) collects the properties of o; and (4) asserts that o has two properties in the end. The last assertion will cause the symbolic execution to fail.…”

Section: (Right) This Codementioning

confidence: 99%

See 2 more Smart Citations

Symbolic Execution for JavaScript

Santos

Maksimovic

Grohens

et al. 2018

Proceedings of the 20th International Symposium on Principles and Practice of Declarative Programming

View full text Add to dashboard Cite

We present a framework for trustworthy symbolic execution of JavaScripts programs, whose aim is to assist developers in the testing of their code: the developer writes symbolic tests for which the framework provides concrete counter-models. We create the framework following a new, general methodology for designing compositional program analyses for dynamic languages. We prove that the underlying symbolic execution is sound and does not generate false positives. We establish additional trust by using the theory to precisely guide the implementation and by thorough testing. We apply our framework to whole-program symbolic testing of real-world JavaScript libraries and compositional debugging of separation logic specifications of JavaScript programs.

show abstract

ThingsMigrate: Platform‐independent migration of stateful JavaScript Internet of Things applications

et al. 2020

View full text Add to dashboard Cite

The Internet of Things (IoT) has gained wide popularity both in academic and industrial contexts. Unlike traditional embedded devices with specialized firmwares, modern IoT devices accommodate general‐purpose operating systems, allowing developers to run more sophisticated applications written in high‐level languages like JavaScript. Because IoT devices are subject to resource constraints like available battery power, we need to dynamically migrate a running process between different devices to prevent losing state. However, it is challenging to apply migration techniques using memory snapshots across the heterogeneous pool of IoT devices. We present ThingsMigrate, a middleware providing platform‐independent migration of JavaScript processes across IoT devices. Prior to execution, ThingsMigrate instruments the source code of a given program to expose its internal state. During run‐time, the transformed program produces on demand a JSON snapshot of its current state, from which new code is generated to resume execution. Thus, ThingsMigrate enables process migration entirely in the application space without any modifications to the underlying virtual machine (VM), providing VM‐independence. We present three versions of ThingsMigrate, each building on the previous to optimize for run‐time latency and memory consumption. We report on the experience of building each successive version and discuss the insights gained and the learning outcomes. We evaluated ThingsMigrate against standard benchmarks, over two IoT platforms and a cloud‐like environment. We show that it can migrate even highly CPU‐intensive applications, with average run‐time latency overhead of 33% and memory overhead of 78%. ThingsMigrate supports multiple subsequent migrations without introducing additional overhead over each subsequent migration.

show abstract

A Survey of Dynamic Analysis and Test Generation for JavaScript

Cited by 65 publications

References 109 publications

BugsJS: a Benchmark of JavaScript Bugs

BugsJS: a Benchmark of JavaScript Bugs

Symbolic Execution for JavaScript

ThingsMigrate: Platform‐independent migration of stateful JavaScript Internet of Things applications

Contact Info

Product

Resources

About