String Analysis for Dynamic Field Access
String Analysis for Dynamic Field Access
复制标题
DOI：
10.1007/978-3-642-54807-9_12
复制
发表时间：
2014-04
期刊：
影响因子：
--
通讯作者：
Magnus Madsen;Esben Andreasen
中科院分区：
文献类型：
--
作者：
Magnus Madsen;Esben Andreasen
在JavaScript和一般的脚本语言中，动态字段访问是一个常用的特性。不幸的是，当前的静态分析工具要么完全忽略动态字段访问，要么使用过于保守的近似，导致精度和可伸缩性差。我们提出了新的字符串域来解释静态分析工具中的动态字段访问。域的一个关键特征是相等、连接和连接操作需要(1)时间。对jQuery和Prototype等4种常用JavaScript库进行了实验评估，结果表明传统的字符串域是不够的。例如，常用的常量字符串域最多只能确保21%的动态字段访问没有误报。相比之下，我们的字符串域确保高达90%的动态字段访问没有误报。我们证明，配备该域的数据流分析获得了显著的精度，导致10个基准程序中的7个的分析速度提高了1.5倍以上。
In JavaScript, and scripting languages in general, dynamic field access is a commonly used feature. Unfortunately, current static analysis tools either completely ignore dynamic field access or use overly conservative approximations that lead to poor precision and scalability.We present new string domains to reason about dynamic field access in a static analysis tool. A key feature of the domains is that the equal, concatenate and join operations take(1) time.Experimental evaluation on four common JavaScript libraries, including jQuery and Prototype, shows that traditional string domains are insufficient. For instance, the commonly used constant string domain can only ensure that at most 21% dynamic field accesses are without false positives. In contrast, our string domainensures no false positives for up to 90% of all dynamic field accesses.We demonstrate that a dataflow analysis equipped with thedomain gains significant precision resulting in an analysis speedup of more than 1.5x for 7 out of 10 benchmark programs.