JavaScript static analysis for evolving language specifications

Abstract

The highly dynamic nature and complex semantics of JavaScript make it difficult to understand the behaviors of JavaScript programs correctly. To automatically reason about them, researchers have developed various JavaScript static analyzers that conform to ECMAScript, the standard specification of JavaScript. However, all the existing JavaScript static analyzers are manually designed

thus, the current approach is labor-intensive and error-prone. Moreover, since late 2014, this problem has become more critical because the JavaScript language itself rapidly evolves with a yearly release cadence and open development process. This thesis introduces a novel approach to derive JavaScript static analyzers from any version of ECMAScript automatically. Our approach consists of three steps: 1) mechanized specification extraction, 2) specification validity check, and 3) derivation of static analyzers. First, we present a tool JISET, which automatically extracts a mechanized specification from ECMAScript. We show that it successfully extracts a mechanized specification from the latest ECMAScript. Then, we present two different tools to detect bugs in JavaScript specifications

JEST performs N+1-version differential testing with JavaScript engines, and JSTAR performs a type analysis for the specification. Finally, we present JSAVER, which automatically derives JavaScript static analyzers from mechanized specifications using a meta-level static analysis. For evaluation, we derived a JavaScript static analyzer from the latest ECMAScript (ES12, 2021). The derived analyzer soundly analyzed all applicable 18,556 official conformance tests with 99.0% of precision in 1.59 seconds on average. We believe that the thesis would be the first step towards the co-evolution of specifications, tests, and tools for programming languages.