TMPA-2017: Tools and Methods of Program Analysis 3-4 March, 2017, Hotel Holiday Inn Moscow Vinogradovo, Moscow Static Checking of Array Objects in JavaScript Astrid Younang, Lunjin Lu, Nabil Almashfi, Oakland Univerity For video follow the link: https://youtu.be/eZC2x-Qf93I Would like to know more? Visit our website: www.tmpaconf.org www.exactprosystems.com/events/tmpa Follow us: https://www.linkedin.com/company/exactpro-systems-llc?trk=biz-companies-cym https://twitter.com/exactpro

1. Astrid Younang & Lunjin Lu & Nabil Almashfi
March 3,2017

2. Outline
1. Motivation
2. Related Work
3. Conventionality Analysis
4. Conclusion and Future Work

3. Motivation
 JavaScript objects have dynamic set of fields
(properties)
 Arrays are just like regular objects with the property
(field) length that is automatically updated;
 Arrays can have fields whose names are not indices;
 Are they used like regular objects?
 Are they used in a conventional way like in Java ?

4. Motivation
 A conventional array is an array that does not have
any properties other than indices and length.
 Conventionality analysis
• provides valuable information for program
comprehension
• provides valuable information for performance
optimization
• Feature to add to JavaScript development tool

5. var A = [ ] ; / New empty array /
var i ;
function populate_array (x,y,A) {
for (i=x ; i<=y ; i++) {
A[i]= 2*i +10;
}
return A;
}
A = populate_array (0, 3, A) ;
A = populate_array (6, 10, A) ;
A.prop1 = “foo” ;
i= -3.5; A[i] = true;
[0, 3]  [10,16], [6,10] [22,30], // A has indexes 0—3, 6—10
// A is not dense
“prop1”  “foo”,
SNum true // A is not conventional
“length”  11

6. Information tracked by
conventional analysis
 String information: what strings a variable can take as
value?
 Number information: what numbers a variable can
take as a value?
 Type information: is a number definitely integer or
possibly a floating point number?

7. Related Work
 Existing abstract string domains
 Constant propagation domain for strings
(TAJS, SAFE, JSAI)
 Character inclusion, prefix domain, suffix
domain, bricks and string graphs
 Automata-based string domains

8. Related Work
Existing abstract string domains
 do not track range of indexes (which are
strings) precisely
 do not supports conventionality analysis

9. Abstract string domain


10. Abstract string domain- Operations
n – a non-index numeric string
r – a non-numeric string

11. Abstract numeric domain
 Range -- Interval domain
intv(3,5) – all numbers between 3 and 5
norm(3,5) – all numbers between 3 and d plus NaN
Type -- <int, any>

12. Evaluation
 Studied 98 benchmark programs
 70 out of them had less than 2 arrays
(were omitted)

13. Evaluation

14. Evaluation
Only conventional arrays were found on
GitHub
o Programmers most likely use arrays in a
conventional way and flagging possible
non-conventional arrays provides useful
information during program
development.

15. Evaluation
 Arrays are used in a conventional way
in 95% of the benchmark programs.
Storage of single/mixed types
o 377 arrays analyzed
o 11.93% - string values
o 33% - integer values

16. Conclusion & Future work
 Conventionality analysis can be
integrated in static analyzers
 Future work will investigate the use the
use of array information for
performance optimization