Points-to analysis for javascript

Abstract

The complexity of JavaScript programs has increased over the last year. JavaScript is a scripting language designed for client-side web scripting. Even though JavaScript was originally designed for simple purposes such as validating forms or controlling user interfaces in web pages, JavaScript now provides full-featured application development environments with various libraries. Moreover, JavaScript programs of several hundred kilobytes are used on many popular web sites. Therefore, it is evident that program analysis for JavaScript is needed to deal with the increasing complexity in JavaScript programs. (Static) program analysis is the technique which predicts the behavior of a computer program without actually executing the program. By using the technique, we can gather useful information to develop programs easily, or verify that a program does not cause a runtime error. For JavaScript, although there are several researches on program analysis for security problems and type system, there is no serious program analysis for optimizing compilers and software engineering tools. However, the latter is also important. Points-to analysis for JavaScript is a basis for further program analysis for JavaScript, but has not yet been developed. The goal of points-to analysis for JavaScript is to determine the set of objects pointed to by a reference variable or a reference object field. It has a wide range of applications in code optimization and software engineering tools. This paper presents a points-to analysis for JavaScript which precisely handles the dynamic features of JavaScript such as the runtime modification of objects and classes through addition of fields or updating of methods, which make the analysis difficult and inaccurate. We evaluate the analysis on a set of JavaScript programs. We also apply the analysis to a code optimization technique to show that the analysis can be useful.