一句话：提出近似解释动态分析，自动推断 JavaScript 动态属性访问的确定事实，用于静态分析减少不健全性并改进调用图构建。
JavaScript 静态分析常因动态属性访问（通过运行时计算名读写对象属性）而面临不健全问题；现有先进分析为保证可扩展性与精度多忽略这类操作，导致漏掉调用边和别名关系。本文提出近似解释（approximate interpretation）这一动态分析技术，能高效、全自动地推断动态属性访问（尤其是复杂库 API 初始化代码中）的似确定事实，并将所得信息用于静态分析，以恢复原本丢失的抽象信息。作者实现该技术并在 141 个真实 Node.js 应用与库上实验：平均调用边增加 55.1%，可达函数增加 21.8%，已解析调用点增加 17.7%，单态调用点仅减少 1.5%；在 36 个有动态调用图的项目上，分析召回率从 75.9% 提至 88.1%，精度下降可忽略。
Static program analysis for JavaScript is more difficult than for many other programming languages. One of the main reasons is the presence of dynamic property accesses that read and write object properties via dynamically computed property names. To ensure scalability and precision, existing state-of-the-art analyses for JavaScript mostly ignore these operations although it results in missed call edges and aliasing relations. We present a novel dynamic analysis technique named approximate interpretation that is designed to efficiently and fully automatically infer likely determinate facts about dynamic property accesses, in particular those that occur in complex library API initialization code, and how to use the produced information in static analysis to recover much of the abstract information that is otherwise missed. Our implementation of the technique and experiments on 141 real-world Node.js-based JavaScript applications and libraries show that the approach leads to significant improvements in call graph construction. On average the use of approximate interpretation leads to 55.1 % more call edges, 21.8 % more reachable functions, 17.7 % more resolved call sites, and only 1.5 % fewer monomorphic call sites. For 36 JavaScript projects where dynamic call graphs are available, average analysis recall is improved from 75.9 % to 88.1 % with a negligible reduction in precision.
@article{LaursenXM24,
title = {Reducing Static Analysis Unsoundness with Approximate Interpretation},
author = {Mathias Rud Laursen and Wenyuan Xu and Anders Møller},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {PLDI},
year = {2024},
doi = {10.1145/3656424}
}