一句话：扩展 Jalangi 为 WeJalangi，用于微信小程序动态分析与缺陷诊断，并在开源及腾讯商用小程序中验证有效性。
微信小程序是运行在微信平台上的大型 JavaScript 应用生态，每周有数百万小程序被访问，其性能与健壮性至关重要。然而，由于 JavaScript 的动态语言特性和复杂运行时环境，动态分析此前很少用于提升这类工业平台应用的质量。本文报告了扩展学术动态分析框架 Jalangi 的经验，得到 WeJalangi，并用于诊断微信小程序缺陷。WeJalangi 兼容 DLint、Smemory、JITProf 等现有动态分析工具。作者在其上实现空指针检查器，在 152 个开源小程序上测试可用性，并在腾讯对 6 个热门商用小程序开展案例研究。案例研究准确定位 6 个空指针问题，其中 3 个此前未被发现，所有报告缺陷均获开发者与测试人员确认。
JavaScript is one of the most popular programming languages. WeChat Mini-Program is a large ecosystem of JavaScript applications that runs on the WeChat platform. Millions of Mini-Programs are accessed by WeChat users every week. Consequently, the performance and robustness of Mini-Programs are particularly important. Unfortunately, many Mini-Programs suffer from various defects and performance problems. Dynamic analysis is a useful technique to pinpoint application defects. However, due to the dynamic features of the JavaScript language and the complexity of the runtime environment, dynamic analysis techniques were rarely used to improve the quality of JavaScript applications running on industrial platforms such as WeChat Mini-Program previously. In this work, we report our experience of extending Jalangi, a dynamic analysis framework for JavaScript applications developed by academia, and applying the extended version, named WeJalangi, to diagnose defects in WeChat Mini-Programs. WeJalangi is compatible with existing dynamic analysis tools such as DLint, Smemory, and JITProf. We implemented a null pointer checker on WeJalangi and tested the tool's usability on 152 open-source Mini-Programs. We also conducted a case study in Tencent by applying WeJalangi on six popular commercial Mini-Programs. In the case study, WeJalangi accurately located six null pointer issues and three of them haven't been discovered previously. All of the reported defects have been confirmed by developers and testers.
DOI 原文 ·
@inproceedings{paperbot5938,
title = {Industry practice of Javascript dynamic analysis on WeChat mini-programs},
author = {Yi Liu and Jinhui Xie and Jianbo Yang and Shiyu Guo and Yuetang Deng and Shuqing Li and Yechang Wu and Yepang Liu},
booktitle = {ASE},
year = {2020},
doi = {10.1145/3324884.3421842}
}