Precise String Analysis for JavaScript Programs Using Automata

Abstract

Existing static analyzers for JavaScript use constant propagation domains to analyze strings. The simplicity of these domains results in a huge loss of precision when dealing with features such as dynamic property access. This paper presents a string analysis for the full JavaScript language based on abstract interpretation. The analysis uses finite state automata to track all possible strings a variable might hold during execution. We present an empirical performance and precision evaluation on some JavaScript benchmarks and show that the analysis achieves a higher level of precision especially when handling dynamic property access.