Dynamic Flow Analysis for JavaScript

Static flow analyses compute a safe approximation of a program’s dataflow without executing it. Dynamic flow analyses compute a similar safe approximation by running the program on test data such that it achieves sufficient coverage.

We design and implement a dynamic flow analysis for JavaScript. Our formalization and implementation observe a program’s execution in a training run and generate flow constraints from the observations. We show that a solution of the constraints yields a safe approximation to the program’s dataflow if each path in every function is executed at least once in the training run. As a by-product, we can reconstruct types for JavaScript functions from the results of the flow analysis.

Our implementation shows that dynamic flow analysis is feasible for JavaScript. While our formalization concentrates on a core language, the implementation covers full JavaScript. We evaluated the implementation using the SunSpider benchmark.