TMPA-2017: Static Checking of Array Objects in JavaScript

TMPA-2017: Tools and Methods of Program Analysis
3-4 March, 2017, Hotel Holiday Inn Moscow Vinogradovo, Moscow

Static Checking of Array Objects in JavaScript
Astrid Younang, Lunjin Lu, Nabil Almashfi, Oakland Univerity

For video follow the link: https://youtu.be/eZC2x-Qf93I

Would like to know more?
Visit our website:
www.tmpaconf.org
www.exactprosystems.com/events/tmpa

Follow us:
https://www.linkedin.com/company/exactpro-systems-llc?trk=biz-companies-cym
https://twitter.com/exactpro

Transcript

1. Astrid Younang & Lunjin Lu & Nabil Almashfi March 3,2017
2. Outline 1. Motivation 2. Related Work 3. Conventionality Analysis 4. Conclusion and Future Work
3. Motivation  JavaScript objects have dynamic set of fields (properties)  Arrays are just like regular objects with the property (field) length that is automatically updated;  Arrays can have fields whose names are not indices;  Are they used like regular objects?  Are they used in a conventional way like in Java ?
4. Motivation  A conventional array is an array that does not have any properties other than indices and length.  Conventionality analysis • provides valuable information for program comprehension • provides valuable information for performance optimization • Feature to add to JavaScript development tool
5. var A = [ ] ; / New empty array / var i ; function populate_array (x,y,A) { for (i=x ; i<=y ; i++) { A[i]= 2*i +10; } return A; } A = populate_array (0, 3, A) ; A = populate_array (6, 10, A) ; A.prop1 = “foo” ; i= -3.5; A[i] = true; [0, 3]  [10,16], [6,10] [22,30], // A has indexes 0—3, 6—10 // A is not dense “prop1”  “foo”, SNum true // A is not conventional “length”  11
6. Information tracked by conventional analysis  String information: what strings a variable can take as value?  Number information: what numbers a variable can take as a value?  Type information: is a number definitely integer or possibly a floating point number?
7. Related Work  Existing abstract string domains  Constant propagation domain for strings (TAJS, SAFE, JSAI)  Character inclusion, prefix domain, suffix domain, bricks and string graphs  Automata-based string domains
8. Related Work Existing abstract string domains  do not track range of indexes (which are strings) precisely  do not supports conventionality analysis
9. Abstract string domain 
10. Abstract string domain- Operations n – a non-index numeric string r – a non-numeric string
11. Abstract numeric domain  Range -- Interval domain intv(3,5) – all numbers between 3 and 5 norm(3,5) – all numbers between 3 and d plus NaN Type -- <int, any>
12. Evaluation  Studied 98 benchmark programs  70 out of them had less than 2 arrays (were omitted)
13. Evaluation
14. Evaluation Only conventional arrays were found on GitHub o Programmers most likely use arrays in a conventional way and flagging possible non-conventional arrays provides useful information during program development.
15. Evaluation  Arrays are used in a conventional way in 95% of the benchmark programs. Storage of single/mixed types o 377 arrays analyzed o 11.93% - string values o 33% - integer values
16. Conclusion & Future work  Conventionality analysis can be integrated in static analyzers  Future work will investigate the use the use of array information for performance optimization