JSAI: Designing a Sound, Configurable, and Efficient Static Analyzer for JavaScript
Abstract
We describe JSAI, an abstract interpreter for JavaScript. JSAI uses novel abstract domains to compute a reduced product of type inference, pointer analysis, string analysis, integer and boolean constant propagation, and control-flow analysis. In addition, JSAI allows for analysis control-flow sensitivity (i.e., context-, path-, and heap-sensitivity) to be modularly configured without requiring any changes to the analysis implementation. JSAI is designed to be provably sound with respect to a specific concrete semantics for JavaScript, which has been extensively tested against existing production-quality JavaScript implementations. We provide a comprehensive evaluation of JSAI's performance and precision using an extensive benchmark suite. This benchmark suite includes real-world JavaScript applications, machine-generated JavaScript code via Emscripten, and browser addons. We use JSAI's configurability to evaluate a large number of analysis sensitivities (some well-known, some novel) and observe some surprising results. We believe that JSAI's configurability and its formal specifications position it as a useful research platform to experiment on novel sensitivities, abstract domains, and client analyses for JavaScript.
Keywords
Cite
@article{arxiv.1403.3996,
title = {JSAI: Designing a Sound, Configurable, and Efficient Static Analyzer for JavaScript},
author = {Vineeth Kashyap and Kyle Dewey and Ethan A. Kuefner and John Wagner and Kevin Gibbons and John Sarracino and Ben Wiedermann and Ben Hardekopf},
journal= {arXiv preprint arXiv:1403.3996},
year = {2014}
}