Precise String Domain for Analyzing JavaScript Arrays and Objects

Abstract

JavaScript is a scripting language that is used for creating web pages. It is widely used and a top contender in realworld usage. JavaScript has many dynamic features that makes it challenging to static analysis. Arrays and objects are one aspect that needs more attention. Array elements are inherently sparse where elements can be added at noncontiguous locations. Object properties can be dynamically accessed and they can also store values of different types. Existing JavaScript static analyzers use constant propagation domains that lose huge amount of precision when analyzing arrays and objects. In this paper, we propose a string abstract domain that is capable of capturing precise information about arrays and objects. The domain we propose provides useful information for the detection of some errors such as the attempt to access a nonexistent element or property. We also define the abstract semantics of some crucial operations over this domain.