This document discusses various tools for static analysis of JavaScript code, including JSLint, JSHint, JSONLint, the Google Closure Compiler, and others. It provides examples of how to use each tool and configure options. Regular expressions are demonstrated for filtering output. The importance of tuning tools to the specific codebase is emphasized.

1. NoahSussman
ns@noahsussman.com
@noahsussman
ToolsandTechniques
JavaScriptStaticAnalysis
SoftwareTestProfessionalsonlinesession
NewYork
May2013

2. “Lint”

3. “StaticAnalysis”means“AutomatedReading”

4. spinroot.com/gerard/pdf/ScrubPaper_rev.pdf

5. Thegoalofstaticanalysisisto
automateyourselfreadingcode.
—SebastianBergmann

6. TheCaseForStaticAnalysis
Static analysis can reveal interesting places to start
reading in an unfamiliar code base.
It can also be used to locate areas of the code base
that may benefit from refactoring.
Additionally static analysis may highlight potential
sources of latent bugs.

7. “Errors”aren’tnecessarilybad.
Edsger Dijkstra famously said that tests can show the
presence of bugs, but never their absence.
Static analysis can tell you where to start reading, but
it can’t tell you where and when to stop reading and
take action.
The feedback from any of these tools is ultimately just
another data point. How to respond to that data is a
problem static analysis can’t solve ;-)

8. Goodhart’sLaw
Anymetricthatisusedtogauge
performance,willbegamedsuch
thatitisnolongeranaccurate
measureofperformance.

9. —GerardHolzmann(NASA/JPL)
"reliabilityisasystemproperty,notacomponentproperty"
"sincesmalldefectscanlineupandleadtoabiganomaly…being
meticulousaboutevensmalldefectscanreallypayoff.Everysmall
defectthatyoueliminate,eliminatesonelinkinthechainthatcould
buildtowardalargerproblem.
Acodingstandardcouldhelp.Almosteveryorganizationhasacoding
standardandinmostcasesthedevelopersarecompletelyunawareofit
--theydon'treadit...Ifyoucomeupwithacodingstandardyoubetter
haverulesthatmatter,thatcorrelatewithriskandyoubettermakesure
thatyoucancheckcompliancemechanically."

10. UniformityandComprehensibility

11. Checksfordetectableerrors
Find places where semicolon insertion might
produce unintended results
Detect unintentional declaration of global variables
Detect undeclared variables
Warn about potential unintended behavior from ==
Flag usages of eval()

12. Firstweneedanexistingcodebase.
wget http://code.jquery.com/jquery-1.10.1.js
mv jquery-1.10.1.js jquery.js

13. JSLint
npm -g install jslint
jslint jquery.js
JSLint is Douglas Crockford's personal linting tool.
It ships with a great default ruleset -- Crockford's own,
constantly updated as he continues to learn about
JavaScript and its pitfalls.
JSLint is highly opinionated. While this is generally
seen as a good thing, there's a limited amount of
flexibility when it comes to disabling individual rules.
It’s hard to apply JSLint to legacy code.

14. JSHint
npm -g install jshint
jshint jquery.js
JSHint is very similar to JSLint (in fact it began life as
JSLint fork) but all of JSHint’s warnings and errors can
be configured or disabled via command line options or
with a .jshintrc configuration file.

15. JSONLint
npm -g install jsonlint
jsonlint myFile.json
JSONLint is a validator for the JSON data-interchange
format. JSON is used by almost all modern Web APIs.
JSONLint automates the process of testing whether
there are parsiing errors in a block of JSON.

16. GoogleClosureCompiler
curl -sO http://closure-compiler.googlecode.com/files/compiler-latest.zip
unzip -qo compiler-latest.zip
java -jar compiler.jar jquery.js
Closure compilation is the closest thing that JavaScript
has to an "interpreter" syntax check like php
-­‐l or
ruby
-­‐c
Closure also warns you about potential issues such
as missing parameters and undeclared or redefined
variables.
If code won't compile with the Closure Compiler, then
you can be certain said code is deeply hosed in some
fundamental way.

17. TheGoogleJavaScriptLinter(gjslint)
fixjsstyle
yardstick
ProjectMessDetector(PMD)
Copy-PasteDetector(CPD)
CSSLint
TidyforHTML5
PHPCodeSniffer

18. JSONLint
GoogleClosureCompiler
JSHint
UseandConfiguration

19. jsonlint myFile.json
JSONLintinaction

20. GoogleClosureCompilerinaction

21. jslint jquery.js
JSLintinaction

22. jshint jquery.js
JSHintinaction

23. ConfigureJSHintandClosureCompiler

24. .jshintrcfile

25. Usea.jshintrcfile

26. OutputTuning
http://www.jslint.com/lint.html#options
http://www.jshint.com/docs/#enforcing_options
http://jslinterrors.com
https://developers.google.com/closure/compiler/docs/error-ref

27. In-the-wildexamplesofoutputtuning

28. RegularExpressions
jslint jquery.js |
egrep -v 'is OK.$' |
egrep -v '^ *$'
This relatively simple regex suppresses status
messages from JSLint. The only lines that will be
printed are lines containing errors and warnings.

29. RegularExpressions
tidy_ignore_regex='(DOCTYPE|title|not
approved|proprietary attribute|
implicit <body>|trimming empty|
missing <li>)|"tabindex" has invalid
value "-1"|missing </template> before
<li>|inserting implicit <ul>|missing
</ul> before </template>|missing
quote mark for attribute value'

30. TunetheToolsToMatchTheCode
jslint --predef Meteor --predef Template --predef '$'
--predef '_' --predef Session --predef setTitle --predef Conf
--predef google --predef Npm
--predef makeInfoWindowEvent
--predef IS_DEV
--predef IS_PRODUCTION
--plusplus
--devel
--vars
--nomen
--sloppy
--white
--terse
--browser jquery.js |
egrep -v 'is OK.$' |
egrep -v '^ *$'

31. TunetheToolsToMatchTheCode
java compiler.jar jquery.js
--warning_level DEFAULT
--jscomp_off missingProperties
--compilation_level ADVANCED_OPTIMIZATIONS
--externs ../../tests/conf/externs.js |
> /dev/null

32. Don’tFeartheFilter
yardstick_runner () {
reasonable_upper_bound_for_CCN=10
result=$(echo $* |
xargs yardstick |
grep -v @ | egrep -v '^ ' |
perl -lnwe 's{^(S+)(s+)(d+).*}{$3$2$1} and print' |
sort -rn |
head -n1 |
xargs -I @ echo @: high cyclomatic complexity.)
count=`echo $result | cut -d ' ' -f1`
if [ $count -gt $reasonable_upper_bound_for_CCN ]
then
echo WARNING: $result >&2
fi
}

33. Don’tFeartheFilter

34. ThewholetimeI’mwritingcode,
I’mconstantlytestingmy
assumptions.
—RasmusLerdorf

35. Questions?
@noahsussman
ns@noahsussman.com
infiniteundo.com