毕业设计外文文献-jQuery的静态分析中的确定性

附录A外文翻译—原文部分DeterminacyinStaticAnalysisforjQueryEsbenAndreasenAndersMøllerAarhusUniversity{esbena,amoeller}@cs.au.dkJavaScriptprogrammersneedbettertoolstohelpdetecterrorsearlyduringdevelopment,transformcodeforrefactoringoroptimization,andunderstandexistingcodebases.Staticanalysismaybeafruitfulfoundationforsuchtools.However,thedynamiclanguagefeaturesofJavaScriptarechallengingtoreasonaboutwithstaticanalysis,andtheprevalentuseoflibrariesisamajorobstacleforfurtherprogress.MostJavaScriptwebapplicationstodayuselibrariestoprovideconvenientfunctionalityontopofthebasicbrowserAPI,andtheselibrariesgenerallyexploitthedynamiclanguagefeaturesintensely.Moreover,thelibrarycodeformanywebsitesisanorderofmagnitudelargerthantheapplicationcodeitself.Asurveyhasshownthat58%ofthetop10millionwebsitesusethejQuerylibrary,andithasamarketshareamongJavaScriptlibrariesof93.4%[35].ThismeansthatpracticalstaticanalysistoolsforJavaScriptwebapplicationsmustbeabletocopewithjQuery.SincejQueryevolvesandnewversionsappearregularly,andthousandsofpluginsexist,writinganalysis-specificmodelsofthelibrary,forexampleasdetailedannotationsofthelibraryinterface,isnotaviableoption.Instead,weneedtoimprovethestaticanalysistechniquestobecomeabletoreasonpreciselyandefficientlyabouttheprogrammingpatternsthatareusedinthelibrarycode.Asanexample,considerwhatisrequiredforastaticanalysistoreasonaboutthesmallsnippetofjQuerylibrarycodeshowninFigure1.Thiscodeconvertsastringintoanarray["ajaxStart","ajaxStop",...,"ajaxSend"]andtheniteratesoverthisarrayusingthejQuery.eachlibraryfunction,assigningafunctiontoapropertyoftheobjectjQuery.fn,whichjQueryapplicationsuseasprototypeobjectforHTMLnodesets.Inthefirstiteration,forexample,jQuery.fn.ajaxStartissettoafunctionthatpassesacallbackftothis.on("ajaxStart",f).IftheanalysisdoesnothavepreciseinformationaboutthevalueofointheassignmentjQuery.fn[o]orattheinnerexpressionthis.on(o,f),thensubsequentcallstothefunctionsonjQuery.fnwillbemixedtogetherbytheanalysis.However,thatinformationrequiresdetailedknowledgebytheanalysisofthemeaningofnotonlythesplitandjQuery.eachfunctions,butalsocontextsensitivereasoningofthenestedclosures.Specifically,noticethatointheinnermostclosureisboundintheouterclosure,sotheanalysismusttracktheconnectionsbetweentheclosureobjects.Inaddition,theanalysismusthavepreciseknowledgeofthevaluesofjQuery.eachandsplitatthefunctioncalls,whichisnottrivialtoobtainduetothedynamicresolutionofvariablesandobjectpropertiesinJavaScript.Inprinciple,bothfunctionscouldberedefinedelsewhereintheprogram.ThesplitfunctionispartoftheJavaScriptstandardlibrary[6].ThejQuery.eachfunction,ontheotherhand,isitselfdefinedinjQuery,usingseveralforandfor-inloopsandthenativefunctionscallandapply.Thosefunctionsprovidefunctionalitytocallanygivenfunction.ImprecisetreatmentoftheirargumentsduringtheanalysisofeachwillalsohavesevereconsequencesontheanalysisprecisionforthecodeinFigure1.JavaScriptlibrariesoftenusereflectiontoimplementoverloading.Asanexample,thejQueryattrfunctionforaccessingHTMLattributesworksasagetterifgivenonestringargument(theattributename)andasasetterifgivenoneobjectargument(withasetofpropertiescorrespondingtotheattributestoset)ortwoargumentswherethefirstisastring(theattributename)andthesecondisastring(thenewattributevalue)orafunction(thatcomputesthenewattributevaluebasedontheoldvalue).MuchofthatfunctionalityissharedbyotherjQueryfunctions,soitisplacedinageneral,highlyoverloadedfunction,namedaccess,showninFigure2.Lines6–9handlethecaseofmultiplesettersusingrecursivecalls,singlesettersarehandledinlines12–34,andthereturnvalueforordinarygettersiscomputedinline42.Theoverloadingisimplementedusingreflectioninthebranches,forexample,line12checkswhetherthevalueparameterisprovided,inwhichcaseitisasetteroperation.Theactualgettingandsettingofattributesisdoneviathefnfunctioninlines20,24,31,41and42.Analyzingfunctionssuchasaccessevidentlyrequiresprecisetechniquestoavoidmixingtogetherthedifferentmodesofoperationandthedataflowfromdifferentcallsites.Staticanalysismustinevitablyapproximatethedataflow,butforJavaScriptevensmalllossesofprecisionareamplifiedbythepoorencapsulationmechanismsofthelanguage.(JavaScripthasnomodulesystemandnonotionofprivatefields,althoughthesefeaturestosomeextentcanbemimickedwithclosures.)Thisoftenoccurswithdynamicpropertyaccess,writtenx[y](e.g.line3inFigure1)wherexisanexpressionthatevaluatestoanobjectandyevaluatestoastring,possiblyviacoercion,thatisinterpretedasanobjectpropertyname.Ifxevaluatestotheglobalobject,whichplaysacentralroleinJavaScriptprograms,andthevalueofyisunknownduetoapproximations,thenareadoperationz=x[y]mayconservativelyresultinnumerousbuiltinvalues—includingtheevalfunctionandtheFunctionfunctionthatmakeitpossibletoexecutedynamicallygeneratedcode,thedocumentobjectthatgivesaccesstotheentireHTMLDOM,andothercriticalobjects,suchasArrayandMath.Iftheprogrambeinganalyzedsubsequentlyuseszinfunctioncallsorpropertyaccessoperationsthentheanalysismayconservativelyinferthat,forexample,evalisbeinginvokedorthecoremethodsonarraysarebeingmodified.Mostoftheresultingdataflowislikelyspuriousinsuchcases.Foranassignmentx[y]=fwherethevalueofyisunknown,staticanalysiswillinferthattheassignmentmayoverwriteanymethodofx,includingtoString,whichisusedintypecoercions.Foracallx[y](...)wherexisafunctionobjectandthevalueofyisunknown,ycouldinprinciplebethestring"apply",inwhichcasethefunctionxisinvokedinsteadofsomefunctionstoredinoneofx’sproperties.Obviously,suchimprecisionquicklyrenderstheanalysisresultsuseless.Staticanalysistoolsoftenrequiremoretimeandspacewhenprecisiondegrades.Conversely,improvinganalysisprecisioncancausesignificantimprovementsoftimeandspacerequirementsinpractice,eventhoughthetheoreticalworst-casecomplexitymaybehigher[21,30,33].WhileworkingwithspecificanalysistoolsforJavaScript,weoftenobservethatsomeprogramscanbeanalyzedwithhighprecisionusingmodestresources,whereasotherprogramscannotbeanalyzedatallduetocascadingspuriousdataflow,evenwithmanyGBofspaceandhoursofrunningtime.Theuseofchallengingdynamiclanguagefeaturesismoredecisiveforanalysissuccessthantheprogramsize.Ourgoalistoenablepractical,soundstaticanalysisofJavaScriptprogramsthatusethejQuerylibrary.Asameasureofanalysisprecisionweconsider(1)typeanalysis,whichinfersthepossibletypesofallvariablesandexpressions,(2)callgraphconstruction,whichinfersthepossiblecalleesateveryfunctioncallsite,and(3)deadcodedetection,whichmaybeusefulforoptimizationofapplicationsthatdonotusetheentirelibrary.AswefocusonthejQuerylibraryitself,inthisworkwetakethefirststepsandconsideronlysmallclientprograms,notfull-scaleapplicationsofthelibrary.Forthereasonsdiscussedabove,timeandspaceefficiencyisnotourprimaryconcernatthispoint,andwesimplyconsideranalysisexecutionsthatrequirelessthanoneminuteastractable.AlthoughjQueryhasbeenstudiedinpreviousworkrelatedtodataflowanalysis[22,29,33],noexistingstaticanalysishasbeenshowncapableofreasoningpreciselyabouttheprogrammingpatternsfoundinlibrariessuchasjQuery.AmongthemostpromisingideasistheobservationbySchäferetal.thatdeterminacyinformationcanbeexploitedinstaticanalysis,mostimportantlytohandledynamicpropertyaccessoperationsandoverloadedfunctions[29].Anexpressionissaidtobedeterminateifitalwaysevaluatestothesamevaluewhenexecutedatruntime.Inpractice,themostusefuldeterminacyfactsonlyholdinagivencontext,soalldeterminacyfactsintheapproachbySchäferetal.arequalifiedwithacompletecallstackandwithvaluesofloopiterationvariables.Asanexample,adynamicanalysisofthecodefromFigure1maytellusthatthevariableoalwayshasthevalueajaxStartinline4forthefirstiterationoftheloopinsidethejQuery.eachfunction,andsimilarlyfortheotheriterations.SuchinformationmaythenbeusedbyastaticanalysistoenablecontextsensitivityandloopunrollingatthecriticalplacesintheJavaScriptcode.WeelaborateontheconnectionbetweenourapproachanddynamicdeterminacyanalysisinSection2.Ourmaincontributionsareasfollows:•Weshowhowtointegratedeterminacyintoastaticanalysis,whichavoidsthedrawbacksofdynamicdeterminacyanalysis.Thedesignofourstaticanalysisisbasedonasystematicinvestigationofimprecisioninanexistingdataflowanalysistool,TAJS[15–18],whenappliedtojQuery.ByextendingTAJSwithselectivecontextandpathsensitivity,weobtainafullyautomaticstaticanalysisthatsimultaneouslyinfersandexploitsdeterminacyinformation.Aspartofthis,weintroduceaflow-sensitivevariantofthecorrelationtrackingtechniquebySridharanetal.[33].Theindividualanalysistechniquesweapplyarevariationsofwellknownideas,buttoourknowledgetheyhavenotbeforebeenappliedinconcerttoanalyzeJavaScriptprograms.•WeexperimentallymeasuretheeffectoftheanalysisextensionsonanalysisprecisionandperformanceusingacollectionofsmalljQueryprogramsanddifferentversionsofthelibrary.Theexperimentsdemonstratethattheimprovedanalysisiscapableofperformingsoundandpreciseanalysisof86of154benchmarkprograms,showingthatthepresentedtechniquesmakeitpossibletoobtaindetailedtypeinformationandcallgraphinformationforsubstantialpartsofjQuery.Mostimportantly,theeffectsoftheindividualanalysistechniquesareinvestigated.Weobservethatthecombinationofselectivecontextandpathsensitivity,constantpropagation,andbranchpruningiscriticalforsuccessfulanalysis.AlthoughthisworkdoesnotsolvealltheproblemsinstaticanalysisofprogramsthatusejQuery,wehavenowreachedtheimportantmilestoneofhandlingatleastsmallapplicationsthatinvolveconsiderablepartsofthelibrary.Programsthatcouldnotbeanalyzedbeforewithavailableresourcescannowbeanalyzedwithhighprecisionwithinseconds.Theseresultsnotonlyprovidenewinsightintochallengesandpossiblesolutionstostaticanalysisfordynamiclanguages;theymayalsoenablenewpracticaltoolsforsupportingJavaScriptprogrammersbecomemoreproductive.

附录B外文翻译—译文部分jQuery的静态分析中的确定性JavaScript程序员需要更好的工具来帮助在开发过程中尽早检测错误，转换代码以进行重构或优化，并了解现有的代码库。静态分析可能是此类工具的富有成效的基础。然而，JavaScript的动态语言特性对静态分析的推理具有挑战性，并且图书馆的普遍使用是进一步发展的主要障碍。今天大多数JavaScriptWeb应用程序使用库在基本浏览器API之上提供方便的功能，并且这些库通常强烈地利用动态语言功能。此外，许多网站的库代码比应用程序代码本身大一个数量级。一项调查显示，前1000万网站中有58％使用jQuery库，其在JavaScript库中的市场份额为93.4％[35]。这意味着JavaScriptWeb应用程序的实用静态分析工具必须能够处理jQuery。由于jQuery不断发展并且新版本经常出现，并且存在数千个插件，因此编写特定于库的分析模型（例如库接口的详细注释）并不是一个可行的选择。相反，我们需要改进静态分析技术，以便能够准确有效地推断库代码中使用的编程模式。作为一个例子，考虑静态分析需要什么来推理图1中所示的jQuery库代码的小片段。这段代码将字符串转换为数组[“ajaxStart”，“ajaxStop”，...，“ajaxSend然后使用jQuery.each库函数遍历此数组，将函数分配给对象jQuery.fn的属性，jQuery应用程序将其用作HTML节点集的原型对象。例如，在第一次迭代中，jQuery.fn.ajaxStart设置为将回调f传递给this.on（“ajaxStart”，f）的函数。如果分析在赋值jQuery.fn[o]或内部表达式this.on（o，f）中没有关于o值的精确信息，那么对jQuery.fn上函数的后续调用将混合在一起通过分析。但是，通过分析split和jQuery.each函数的含义，以及嵌套闭包的上下文敏感推理，该信息需要详细的知识。具体来说，请注意最内层闭包中的o绑定在外部闭包中，因此分析必须跟踪闭包对象之间的连接。此外，分析必须准确了解jQuery.each的值并在函数调用中进行拆分，由于JavaScript中变量和对象属性的动态解析，这一点并不容易获得。原则上，这两个功能可以在程序的其他地方重新定义。split函数是JavaScript标准库的一部分[6]。另一方面，jQuery.each函数本身是在jQuery中定义的，使用了几个for和for-in循环以及本机函数调用和应用。这些函数提供调用任何给定函数的功能。在分析每个参数时对其参数的不精确处理也会对图1中的代码的分析精度产生严重影响。JavaScript库通常使用反射来实现重载。例如，如果给定一个字符串参数（属性名称），则用于访问HTML属性的jQueryattr函数用作getter;如果给定一个对象参数（具有与要设置的属性对应的一组属性），则用作setter;或者两个参数，其中第一个是字符串（属性名称），第二个是字符串（新属性值）或函数（根据旧值计算新属性值）。大部分功能由其他jQuery函数共享，因此它被放置在一个通用的，高度重载的函数中，名为access，如图2所示。第6-9行使用递归调用处理多个setter的情况，单个setter在在第42行计算普通吸气剂的返回值。使用分支中的反射实现过载，例如，第12行检查是否提供了值参数，在这种情况下，它是一个设定器操作。属性的实际获取和设置是通过第20,24,31,41和42行中的fn函数完成的。分析功能如访问显然需要精确的技术，以避免将不同的操作模式和来自不同呼叫站点的数据流混合在一起。静态分析必然会接近数据流，但对于JavaScript来说，即使语言的封装机制很差，也会导致精确度的微小损失。（JavaScript没有模块系统，也没有私有字段的概念，尽管这些特性在某种程度上可以用闭包来模仿。）这通常发生在动态属性访问中，写成x[y]（例如图1中的第3行），其中x是表达式，求值为一个对象，y求值为一个字符串，可能是通过强制，被解释为一个对象属性名。如果x计算为在JavaScript程序中起核心作用的全局对象，并且y的值由于近似而未知，那么读取操作z=x[y]可能保守地导致许多内置值-包括eval函数以及可以执行动态生成的代码的Function函数，可以访问整个HTMLDOM的文档对象，以及其他关键对象，例如Array和Math。如果随后被分析的程序在函数调用或属性访问操作中使用z，那么分析可以保守地推断，例如，正在调用eval或正在修改数组上的核心方法。在这种情况下，大多数结果数据流可能是虚假的。对于赋值x[y]=f，其中y的值是未知的，静态分析将推断赋值可以覆盖x的任何方法，包括在类型强制中使用的toString。对于调用x[y]（...），其中x是一个函数对象，y的值是未知的，y原则上可以是字符串“apply”，在这种情况下调用函数x而不是存储一些函数在x的属性之一。显然，这种不精确很快就会使