Determinacy in static analysis for jQuery

Abstract

Static analysis for JavaScript can potentially help programmers find errors early during development. Although much progress has been made on analysis techniques, a major obstacle is the prevalence of libraries, in particular jQuery, which apply programming patterns that have detrimental consequences on the analysis precision and performance.Previous work on dynamic determinacy analysis has demonstrated how information about program expressions that always resolve to a fixed value in some call context may lead to significant scalability improvements of static analysis for such code. We present a static dataflow analysis for JavaScript that infers and exploits determinacy information on-the-fly, to enable analysis of some of the most complex parts of jQuery. The analysis combines selective context and path sensitivity, constant propagation, and branch pruning, based on a systematic investigation of the main causes of analysis imprecision when using a more basic analysis.The techniques are implemented in the TAJS analysis tool and evaluated on a collection of small programs that use jQuery. Our results show that the proposed analysis techniques boost both precision and performance, specifically for inferring type information and call graphs.

JaVerT: JavaScript verification toolchain

“…The existing literature covers a wide range of analysis techniques for JavaScript programs, including: type systems [Anderson et al 2005;Bierman et al 2014;Feldthaus and Mùller 2014;Jensen et al 2009;Microsoft 2014;Rastogi et al 2015;Thiemann 2005], control flow analysis [Feldthaus et al 2013], pointer analysis [Jang and Choe 2009;Sridharan et al 2012] and abstract interpretation [Andreasen and Mùller 2014;Jensen et al 2009;Kashyap et al 2014;Park and Ryu 2015], among others. In contrast, there has been comparatively little work on logic-based verification of JavaScript programs.…”

“…There is a rich landscape of IRs for JavaScript, broadly divided into two categories: (1) those for syntax-directed analyses, following the abstract syntax tree of the program, such as λ J S [Guha et al 2010], S5 [Politz et al 2012], and notJS [Kashyap et al 2014]; and (2) those for analyses based on the control-flow graph of the program, such as JSIR [Livshits 2014], WALA [Sridharan et al 2012] and the IR of TAJS [Andreasen and Mùller 2014;Jensen et al 2009]. SAFE [Lee et al 2012], an analysis framework for JavaScript, provides IRs in both categories.…”

Detecting redundant CSS rules in HTML5 applications: a tree rewriting approach

“…Developing a translation tool that covers all covers all aspects of such an extremely rich and complex language as JavaScript is a difficult problem [9]. Our proof-of-concept prototype covers many, but by no means all, interesting features of the language.…”

“…Therefore, an important research direction is to develop a more robust translation, perhaps by building on top of existing JavaScript static analysers like WALA [50,54] and TAJS [9,28,27]. As Andreasen and Møller [9] describe, a static analysis of JavaScript in the presence of jQuery is presently a formidable task for existing static analysers for JavaScript. For this reason, we do not expect the task of building a more robust translation to our tree-rewriting model to be easy.…”

“…Static analysis of JavaScript code is a challenging goal, especially in the presence of libraries like jQuery. The current state of the art is well surveyed by Andreasen and Møller [9], with the main tools in the field being WALA [50,54] and TAJS [9,28,27]. These tools (and others) provide traditional static analysis frameworks encompassing features such as points-to [26,54] and determinacy analysis [9,50], type inference [33,28] and security properties [23,24].…”