Understanding and Verifying JavaScript Programs Philippa Gardner Imperial College London LFCS 30th Anniversary 1/31
JavaScript at Imperial Philippa Gardner Jos´ e Fragoso Santos Petar Maksimovi´ c Daiva Naudˇ zi¯ unien˙ e Azalea Raad Thomas Wood 2/31
Mechanised Language Specification Standard ML: formal definition Milner, Harper, MacQueen, Tofte, 1990 and 1997; mechanised definition Lee, Crary, Harper, 2006. C: many partial definitions, some mechanised e.g. by Norrish 1998 , Leroy 2009; complete mechanised definition Ellison, Rosu, 2012; lots of recent work on C11, e.g. Batty’s thesis, 2014. Fragments of Java: many partial (large) definitions, first studied by Drossopoulou, Eisenbach, 1997; mechanised definition, Syme, 1998. Javascript: complete formal definition of the ECMAScript 3 standard (ES3), Maffeis, Mitchell, Tally, 2008; mechanised definition of ES5, us, 2014; Park, Stefanescu, Rosu, 2015. 3/31
JavaScript at Imperial � DOM Specification P. Gardner, G. Smith, M. Wheelhouse, U. Zarfaty. Local Hoare Reasoning about the DOM, PODS 2008. 4/31
JavaScript at Imperial � DOM Specification � JSLogic: a program logic for JavaScript P. Gardner, S. Maffeis, G. Smith. Towards a Program Logic for JavaScript, POPL 2012. 4/31
JavaScript at Imperial � DOM Specification � JSLogic: a program logic for JavaScript � JSCert: a mechanised specification of ES5 in Coq M. Bodin, A. Chargu´ eraud, D. Filaretti, P. Gardner, S. Maffeis, D. Naudˇ zi¯ unien˙ e, A. Schmitt, G. Smith. A Trusted Mechanised JavaScript Specification, POPL 2014. Inria Collaborators � JSCert JSRef JavaScript Test262 A. Schmitt A. Chargu´ eraud M. Bodin 4/31
JavaScript at Imperial � DOM Specification � JSLogic: a program logic for JavaScript � JSCert: a mechanised specification of ES5 in Coq JSIL: an intermediate language for JavaScript JSVerify: a verification tool for JavaScript 4/31
JavaScript and Verification JavaScript 5/31
JavaScript and Verification ECMAScript 5 English Standard Language Libraries How is it organised? Chapters 1-7: Overview, notation, parsing Chapters 8-14: Language constructs Chapter 15: Library functions 6/31
JavaScript and Verification ES5 Strict Language Libraries How is it organised? Same as before; strict-only features throughout chapters 8-15 How is it different? Better behavioural properties: lexicographic scoping, mandatory variable declarations, explicit error throwing... 7/31
JavaScript and Verification Non-core Core ES5 Strict Libraries What is Core ES5 Strict? All of the language constructs Core library functions Non-core library functions definable using the core language Why the core language? Important for verification 8/31
Verifying Core ES5 Strict Core ES5 Strict • JSIL: simple intermediate goto language, good for verification, memory model similar to JavaScript • Semantics-directed compilation from Core ES5 Strict to JSIL • Core library functions implemented in JSIL • JSVerify: Smallfoot-like verification tool for JSIL (in future for JavaScript) • Core library functions specified and verified using JSVerify 9/31
JavaScript vs. JSIL Verification 10/31
Incorporating Non-core Libraries Non-core Libraries Axiomatic specification to verify client programs Does not follow the standard, which is operational Justification of specifications Informal appeal to the English standard Reference implementation in JSIL or Core ES5 Strict, following the standard, verified with JSVerify, tested against Test262 Verification of industrial-strength library implementations 11/31
Introducing JSIL JSCert Core ES5 Strict Non-core libraries Semantics-directed compilation JSIL 12/31
Introducing JSIL JSCert Core ES5 Strict Non-core libraries Semantics-directed compilation JSIL To be implemented Attributes, for-in, getters/setters, the arguments object Some core library functions 12/31
The Syntax of JSIL Expressions: e ::= v | x | ⊖ e | e ⊕ e | typeof ( e ) v | e . o e | e . v e | base ( e ) | field ( e ) Commands: c ::= skip | x := e | x := new () | x := [ e , e ] | [ e , e ] := e | delete ( e ) | x := hasField ( e , e ) | x := protoField ( e , e ) | x := protoObj ( e , e ) | goto i | goto [ e ] i , j | x := e ( e ) with j 13/31
The Syntax of JSIL Expressions: e ::= v | x | ⊖ e | e ⊕ e | typeof ( e ) v | e . o e | e . v e | base ( e ) | field ( e ) Commands: c ::= skip | x := e | x := new () | x := [ e , e ] | [ e , e ] := e | delete ( e ) | x := hasField ( e , e ) | x := protoField ( e , e ) | x := protoObj ( e , e ) | goto i | goto [ e ] i , j | x := e ( e ) with j Extensible objects, dynamic fields 13/31
The Syntax of JSIL Expressions: e ::= v | x | ⊖ e | e ⊕ e | typeof ( e ) v | e . o e | e . v e | base ( e ) | field ( e ) Commands: c ::= skip | x := e | x := new () | x := [ e , e ] | [ e , e ] := e | delete ( e ) | x := hasField ( e , e ) | x := protoField ( e , e ) | x := protoObj ( e , e ) | goto i | goto [ e ] i , j | x := e ( e ) with j Prototype chains 13/31
The Syntax of JSIL Expressions: e ::= v | x | ⊖ e | e ⊕ e | typeof ( e ) v | e . o e | e . v e | base ( e ) | field ( e ) Commands: c ::= skip | x := e | x := new () | x := [ e , e ] | [ e , e ] := e | delete ( e ) | x := hasField ( e , e ) | x := protoField ( e , e ) | x := protoObj ( e , e ) | goto i | goto [ e ] i , j | x := e ( e ) with j Dynamic function choice 13/31
The Syntax of JSIL Expressions: e ::= v | x | ⊖ e | e ⊕ e | typeof ( e ) v | e . o e | e . v e | base ( e ) | field ( e ) Commands: c ::= skip | x := e | x := new () | x := [ e , e ] | [ e , e ] := e | delete ( e ) | x := hasField ( e , e ) | x := protoField ( e , e ) | x := protoObj ( e , e ) | goto i | goto [ e ] i , j | x := e ( e ) with j Procedures: proc ::= proc m ( x ) { c } 13/31
Compiling ES5 Strict to JSIL JavaScript Code Object . prototype . foo = 1; var bar = 2; function f () { this . baz = this . bar + foo ; } f . prototype . bar = 3 Three ways of calling f : • Function call: f () • Method call: this . f () • Constructor call: new f () 14/31
Compiling Functions • Each function translated to a top-level procedure. • Global code translated to a special procedure main . • No nesting of procedures. • Scope and the this object as first two parameters JavaScript Code JSIL Code function f() { ... } proc f ( x sc , x this ) { ... } Global code proc main () { ... } 15/31
Compiling ES5 Strict to JSIL Heap JavaScript Code Object.prototype.foo = 1; var bar = 2; function f() { this.baz = this.bar + foo; } f.prototype.bar = 3 16/31
Compiling ES5 Strict to JSIL Heap JavaScript Code Object.prototype.foo = 1; var bar = 2; function f() { this.baz = this.bar + foo; } f.prototype.bar = 3 JSIL Code [ l op , “foo” ] := 1 17/31
Compiling ES5 Strict to JSIL Heap JavaScript Code Object.prototype.foo = 1; var bar = 2; function f() { this.baz = this.bar + foo; } f.prototype.bar = 3 JSIL Code [ l g , “bar” ] := 2 18/31
Compiling ES5 Strict to JSIL JavaScript Code Heap Object.prototype.foo = 1; var bar = 2; function f() { this.baz = this.bar + foo; } f.prototype.bar = 3 JSIL Code x fp := new () [ x fp , @ proto ] := l op x fo := new () [ x fo , @ code ] := “f” [ x fo , @ scope ] := [ l g ] [ x fo , @ proto ] := ... [ x fo , ”prototype” ] := x fp [ l g , “f” ] := x fo 19/31
Compiling ES5 Strict to JSIL Heap JavaScript Code Object.prototype.foo = 1; var bar = 2; function f() { this.baz = this.bar + foo; } f.prototype.bar = 3 JSIL Code [ x fp , “bar” ] := 3 20/31
Constructor call: new f() JavaScript Code Object.prototype.foo = 1; Heap var bar = 2; function f() { this.baz = this.bar + foo; } f.prototype.bar = 3 new f() ← − constructor call JSIL Code x n := new () x fo := [ l g , “f” ] x fp := [ x fo , “prototype” ] [ x n , @ proto ] := x fp x scope := [ x fo , @ scope ] x this := x n x f := [ x fo , @ code ] x ret := x f ( x scope , x this ) 21/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo 22/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo Step 1 l n . o baz 22/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo Step 1 Step 2 l n . o baz l n . o bar 22/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo Step 1 Step 2 l n . o baz l n . o bar Step 3 getValue ( l n . o bar ) 22/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo Step 1 Step 2 l n . o baz l n . o bar Step 3 getValue ( l n . o bar ) Step 4 3 22/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo Step 1 Step 2 Step 5 l n . o baz l n . o bar l g . v foo Step 3 getValue ( l n . o bar ) Step 4 3 22/31
Constructor call: new f() In this case, the this is bound to the newly created object. this . baz = this . bar + foo Step 1 Step 2 Step 5 l n . o baz l n . o bar l g . v foo Step 3 Step 6 getValue ( l n . o bar ) getValue ( l g . v foo ) Step 4 3 22/31
Recommend
More recommend
