Improving precision and scalability of Javascript static analysis by parameterization

Abstract

JavaScript has various dynamic features, and it helps to develop programs quickly. However, such features make it hard to understanding program behaviors and verification of run-time errors. Static analysis is a solution to answer the problems. While the results of static analysis help to infer program behaviors at run-time, it can also include infeasible errors that do not appear since the static analysis over-approximates run-time behaviors. In JavaScript static analysis, the over-approximation on dynamic features leads to a huge amount of computations because of control flow explosions, and scalability problems. To improve precision and scalability, static analysis users discover main causes of imprecision and either suggest analysis techniques or design new techniques to address the problems. JavaScript static analysis researchers have inspected such problems manually.In this thesis, we make JavaScript static analysis to automatically perform two stages for improving precision and scalability: finding main causes of imprecision and selecting analysis techniques. First, we present a novel technique that generates a graph to identify main causes of imprecision. The graph contains data-flow information from imprecise program points to the starting points of the imprecision. In the graph, we propose four common node/edge patterns to enable automatic detection of the four common main causes of analysis imprecision. Previous studies have changed components of static analysis to eliminate such main causes of imprecision. To discover the influence of components, we survey static analysis studies that change components according to program characteristics and classify the components in four analysis parameters: analysis sensitivity, state abstraction, initial abstract state, and abstract transfer function. In addition, many program attributes have been used to choose proper components, and we classify them into syntactic attributes and semantic attributes. Through this survey, we introduce a partial loop sensitive analysis technique on loop analysis to improve scalability than fully loop sensitive analysis. When static analysis uses partial loop sensitivity, it separates loop iterations only when the iterations require loop sensitive analysis to get precise analysis results. Our technique chooses variables and their values to adopt partial loop sensitivity.We experimentally demonstrated that our technique could identify main causes of imprecision, using graphs and patterns. The evaluation shows that the technique found 96 % (144/150) of the main causes of imprecision problems in 17 JavaScript applications through four common patterns, and analyzed five more JavaScript programs that show timeout in a state-of-the-art analyzer SAFELSA. Next, we evaluate a partial loop sensitive analysis technique in two perspectives: scalability and precision. This technique reduces 5% of analysis time and 19% analysis iterations on average. For the perspective of precision, we inspect two metrics in property accesses: the number of object dereference points with multiple objects (MultiDeref), and the number of object property accesses with a property name with non-constant value (MultiProp). The number of MultiDeref and MultiProp grows 0.56% and 29.34%, respectively. From the evaluation, we conclude that a partial loop sensitive analysis technique improves scalability while losing precision.