JSAI: A Static Analysis Platform for JavaScript

JavaScript is used everywhere from the browser to the server, including desktops and mobile devices. However, the cur-rent state of the art in JavaScript static analysis lags far be-hind that of other languages such as C and Java. Our goal is to help remedy this lack. We describe JSAI, a formally specified, robust abstract interpreter for JavaScript. JSAI uses novel abstract domains to compute a reduced prod-uct of type inference, pointer analysis, control-flow analysis, string analysis, and integer and boolean constant propaga-tion. Part of JSAI’s novelty is user-configurable analysis sen-sitivity, i.e., context-, path-, and heap-sensitivity. JSAI is designed to be provably sound with respect to a specific con-crete semantics for JavaScript, which has been extensively tested against a commercial JavaScript implementation. We provide a comprehensive evaluation of JSAI’s perfor-mance and precision using an extensive benchmark suite, including real-world JavaScript applications, machine gener-ated JavaScript code via Emscripten, and browser addons. We use JSAI’s configurability to evaluate a large number of analysis sensitivities (some well-known, some novel) and observe some surprising results that go against common wis-dom. These results highlight the usefulness of a configurable analysis platform such as JSAI