Analyzing JavaScript Programs Using Octagon Domain

Abstract

Static analyzers for JavaScript use constant propagation and interval domains to discover numerical properties of program variables. These domains are non-relational and incapable of tracking relationships between variables, leading to imprecise analysis. This paper presents a static analyzer for the full language of JavaScript that employs the octagon domain to capture numerical properties of the program. Our work is built on top of TAJS (type analyzer for JavaScript) which employs a constant propagation domain for numerical properties. We reengineered TAJS’s abstract domain for abstractions of primitive values and its abstract domain for object abstractions and related transfer functions, resulting in an analyzer that is much more precise. Our experiments show an improvement in analysis precision of JavaScript programs with an acceptable increase in cost.