Reducing Static Analysis Unsoundness with Approximate Interpretation
summary
Introduces approximate interpretation, a dynamic phase that force-executes each function once to emit determinacy hints and feeds them into an extended points-to analysis implemented in Jelly. Implementation is ~2,700 lines for the dynamic phase plus ~200 lines to consume hints. Evaluation on 141 real Node.js projects yields +55.1% call edges, +21.8% reachable functions, +17.7% resolved call sites, average recall on 36 apps improves from 75.9% to 88.1%, and the dynamic phase averages 4.5 seconds per program with <10% static-analysis slowdown for most cases.
AI-written summary · about
chapters (14)
- 0:00Points-to and control flow analysis
- 1:03Static analysis for JavaScript
- 2:26Dynamic property access unsoundness
- 3:11Determinacy hints from execution
- 4:35Two-phase algorithm overview
- 5:16Approximate interpretation details
- 7:02Force execution for uncalled functions
- 8:50Example walkthrough
- 11:21Extended static analysis phase
- 12:26Implementation in Jelly
- 12:47Experimental results
- 14:13Performance overhead
- 15:18Conclusion
- 15:44Question and answer session
related talks
33mThe story of when assumption met a magic hat
11mDependencies Static Analysis and The Grid
27mBeyond JavaScript
36mFast and Dynamic
26mJavaScript JITs
29mAutomatically Generated Supernodes for AST Interpreters Improve Virtual-machine P...
29mJavaScript in JavaScript: Inception
17mV8 engine, JS Code Interpretation, and Execution