Skip to main content

State-Sensitive Points-to Analysis for the Dynamic Behavior of JavaScript Objects

  • Conference paper
ECOOP 2014 – Object-Oriented Programming (ECOOP 2014)

Part of the book series: Lecture Notes in Computer Science ((LNPSE,volume 8586))

Included in the following conference series:

Abstract

JavaScript object behavior is dynamic and adheres to prototype-based inheritance. The behavior of a JavaScript object can be changed by adding and removing properties at runtime. Points-to analysis calculates the set of values a reference property or variable may have during execution. We present a novel, partially flow-sensitive, context-sensitive points-to algorithm that accurately models dynamic changes in object behavior. The algorithm represents objects by their creation sites and local property names; it tracks property updates via a new control-flow graph representation. The calling context comprises the receiver object, its local properties and prototype chain. We compare the new points-to algorithm with an existing JavaScript points-to algorithm in terms of their respective performance and accuracy on a client application. The experimental results on real JavaScript websites show that the new points-to analysis significantly improves precision, uniquely resolving on average 11% more property lookup statements.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. Aho, A.V., Sethi, R., Ullman, J.D.: Compilers: Principles, Techniques and Tools. Addison Wesley (1986)

    Google Scholar 

  2. Balakrishnan, G., Reps, T.: Recency-abstraction for heap-allocated storage. In: Yi, K. (ed.) SAS 2006. LNCS, vol. 4134, pp. 221–239. Springer, Heidelberg (2006)

    Chapter  Google Scholar 

  3. Chugh, R., Herman, D., Jhala, R.: Dependent types for JavaScript. In: Proceedings of the ACM International Conference on Object Oriented Programming Systems Languages and Applications, pp. 587–606 (2012)

    Google Scholar 

  4. Chugh, R., Meister, J.A., Jhala, R., Lerner, S.: Staged information flow for JavaScript. In: Proceedings of the 2009 ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 50–62 (2009)

    Google Scholar 

  5. Chugh, R., Rondon, P.M., Jhala, R.: Nested refinements: a logic for duck typing. In: Proceedings of the 39th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 231–244 (2012)

    Google Scholar 

  6. De, A., D’Souza, D.: Scalable flow-sensitive pointer analysis for Java with strong updates. In: Noble, J. (ed.) ECOOP 2012. LNCS, vol. 7313, pp. 665–687. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  7. Flanagan, D.: JavaScript: The Definitive Guide. O’Reilly Media, Inc. (2006)

    Google Scholar 

  8. Guarnieri, S., Livshits, B.: Gatekeeper: mostly static enforcement of security and reliability policies for JavaScript code. In: Proceedings of the 18th Conference on USENIX Security Symposium, pp. 151–168 (2009)

    Google Scholar 

  9. Guarnieri, S., Livshits, B.: Gulfstream: staged static analysis for streaming JavaScript applications. In: Proceedings of the 2010 USENIX Conference on Web Application Development, p. 6 (2010)

    Google Scholar 

  10. Guarnieri, S., Pistoia, M., Tripp, O., Dolby, J., Teilhet, S., Berg, R.: Saving the world wide web from vulnerable JavaScript. In: Proceedings of the 2011 International Symposium on Software Testing and Analysis, pp. 177–187 (2011)

    Google Scholar 

  11. Heidegger, P., Thiemann, P.: Recency types for analyzing scripting languages. In: D’Hondt, T. (ed.) ECOOP 2010. LNCS, vol. 6183, pp. 200–224. Springer, Heidelberg (2010)

    Chapter  Google Scholar 

  12. Jensen, S.H., Møller, A., Thiemann, P.: Type analysis for javaScript. In: Palsberg, J., Su, Z. (eds.) SAS 2009. LNCS, vol. 5673, pp. 238–255. Springer, Heidelberg (2009)

    Chapter  Google Scholar 

  13. Kastrinis, G., Smaragdakis, Y.: Hybrid context-sensitivity for points-to analysis. In: Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 423–434 (2013)

    Google Scholar 

  14. Lerner, B.S., Joe Gibbs, P., Guha, A., Shriram, K.: TeJaS: Retrofitting type systems for JavaScript. In: Proceedings of the 9th Symposium on Dynamic Languages (2013)

    Google Scholar 

  15. Lhoták, O., Hendren, L.: Context-sensitive points-to analysis: Is it worth it? In: Mycroft, A., Zeller, A. (eds.) CC 2006. LNCS, vol. 3923, pp. 47–64. Springer, Heidelberg (2006)

    Chapter  Google Scholar 

  16. Lieberman, H.: Using prototypical objects to implement shared behavior in object-oriented systems. In: Conference proceedings on Object-Oriented Programming Systems, Languages and Applications, pp. 214–223 (1986)

    Google Scholar 

  17. Madsen, M., Livshits, B., Fanning, M.: Practical static analysis of JavaScript applications in the presence of frameworks and libraries. In: Proceedings of the 2013 9th Joint Meeting on Foundations of Software Engineering, pp. 499–509 (2013)

    Google Scholar 

  18. Milanova, A., Rountev, A., Ryder, B.G.: Parameterized object sensitivity for points-to analysis for Java. ACM TOSEM 14(1), 1–41 (2005)

    Article  Google Scholar 

  19. Orion, http://www.eclipse.org/orion/

  20. Richards, G., Lebresne, S., Burg, B., Vitek, J.: An analysis of the dynamic behavior of JavaScript programs. In: Proceedings of the 2010 ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 1–12 (2010)

    Google Scholar 

  21. Ryder, B.G.: Dimensions of precision in reference analysis of object-oriented programming languages. In: Hedin, G. (ed.) CC 2003. LNCS, vol. 2622, pp. 126–137. Springer, Heidelberg (2003)

    Chapter  Google Scholar 

  22. Schafer, M., Sridharan, M., Dolby, J., Tip, F.: Effective smart completion for JavaScript. Technical Report RC25359, IBM (2013)

    Google Scholar 

  23. Sethi, R.: Programming Languages, Concepts & Constructs, 2nd edn. Addison Wesley (1996)

    Google Scholar 

  24. Sharir, M., Pnueli, A.: Two approaches to interprocedural data flow analysis. In: Program Flow Analysis: Theory and Applications, pp. 189–234 (1981)

    Google Scholar 

  25. Smaragdakis, Y., Bravenboer, M., Lhoták, O.: Pick your contexts well: understanding object-sensitivity. In: Proceedings of the 38th Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, pp. 17–30 (2011)

    Google Scholar 

  26. Sridharan, M., Dolby, J., Chandra, S., Schäfer, M., Tip, F.: Correlation tracking for points-to analysis of JavaScript. In: Noble, J. (ed.) ECOOP 2012. LNCS, vol. 7313, pp. 435–458. Springer, Heidelberg (2012)

    Chapter  Google Scholar 

  27. Wegner, P.: Dimensions of object-based language design. In: Conference Proceedings on Object-Oriented Programming Systems, Languages and Applications, pp. 168–182 (1987)

    Google Scholar 

  28. Wei, S., Ryder, B.G.: Practical blended taint analysis for JavaScript. In: Proceedings of the 2013 International Symposium on Software Testing and Analysis, pp. 336–346 (2013)

    Google Scholar 

Download references

Author information

Authors and Affiliations

Authors

Editor information

Editors and Affiliations

Rights and permissions

Reprints and permissions

Copyright information

© 2014 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Wei, S., Ryder, B.G. (2014). State-Sensitive Points-to Analysis for the Dynamic Behavior of JavaScript Objects. In: Jones, R. (eds) ECOOP 2014 – Object-Oriented Programming. ECOOP 2014. Lecture Notes in Computer Science, vol 8586. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-44202-9_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-44202-9_1

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-44201-2

  • Online ISBN: 978-3-662-44202-9

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics