Modern javascript engines use just-in-time (JIT) compilation to produce a binary code. JIT compilers are limited in a complexity of optimizations they can perform at a runtime without delaying an execution. On the con...
详细信息
ISBN:
(纸本)9781467375627
Modern javascript engines use just-in-time (JIT) compilation to produce a binary code. JIT compilers are limited in a complexity of optimizations they can perform at a runtime without delaying an execution. On the contrary, ahead-of-time (AOT) compilers don't have such limitations, but they are not well suited for compiling dynamic languages such as javascript. In the paper we discuss methods for augmenting multi-tiered javascript JIT with a capability for AOT compilation, so to reduce program startup time and to move complex optimizations to AOT phase. We have implemented saving of javascript programs as a binary package containing bytecode and native code in open-source WebKit library. Our implementation allows shipping of javascript programs not only as a source code, but also as application binary packages with a precompiled code. In addition, our approach does not require any language feature restrictions. This has resulted in performance gain for popular javascript benchmarks such as SunSpider and Kraken on ARM platform, however, at a cost of increased package size.
javascript is the most popular programming language these days and it is also the core language of the *** environment. Sharing code is a simple task in this environment and the shared code can be easily reused as bui...
详细信息
ISBN:
(纸本)9789897583759
javascript is the most popular programming language these days and it is also the core language of the *** environment. Sharing code is a simple task in this environment and the shared code can be easily reused as building blocks to create new applications. This vibrant and ever growing environment is not perfect though. Due to the large amount of reused code, even simple applications can have a lot of indirect dependencies. Developers may not even be aware of the fact that some of these dependencies could contain malware, since harmful code can be hidden relatively easily due to the dynamic nature of javascript. Dynamic software analysis is one way of detecting suspicious activities. Call graphs can reveal the internal workings of an application and they have been used successfully for malware detection. In ***, no tool has been available for directly generating javascript call graphs before. In this paper, we are going to introduce three tools that can be used to generate call graphs for further analysis. We show that call graphs contain a significant amount of engine-specific information but filters can be used to reduce such differences.
As Web programming standards and browser infrastructures have matured, the implementation of UIs for many Web sites has seen a parallel increase in complexity. In order to deal with this problem, we are researching wa...
详细信息
ISBN:
(纸本)9783642028175
As Web programming standards and browser infrastructures have matured, the implementation of UIs for many Web sites has seen a parallel increase in complexity. In order to deal with this problem, we are researching ways to bridge the gap between the browser view of a UI and its javascript implementation. To achieve this we propose a novel javascript reverse-engineering approach and a prototype tool called Script InSight. This approach helps to relate the semantically meaningful elements in the browser to the lower-level javascript syntax, by leveraging context available during the script execution. The approach uses run-time tracing to build a dynamic, context-sensitive, control-flow model that provides feedback to developers as a summary of tracing information. To demonstrate the applicability of the approach we present a study of an existing open-source Web 2.0 application called the Java Pet Store and metrics taken from several popular online sites.
We present an approach to detect function purity in javascript. A function is pure if none of its applications cause observable side-effects. The approach is based on a pushdown flow analysis that besides traditional ...
详细信息
ISBN:
(纸本)9781467375290
We present an approach to detect function purity in javascript. A function is pure if none of its applications cause observable side-effects. The approach is based on a pushdown flow analysis that besides traditional control and value flow also keeps track of write effects. To increase the precision of our purity analysis, we combine it with an intraprocedural analysis to determine freshness of variables and object references. We formalize the core aspects of our analysis, and discuss our implementation used to analyze several common javascript benchmarks. Experiments show that our technique is capable of detecting function purity, even in the presence of higher-order functions, dynamic property expressions, and prototypal inheritance.
In the simplest form, software testing consists of creating test cases from a defined input space, executing those test cases for the system-under-test (SUT), and evaluating the outputs with a mechanism for determinin...
详细信息
ISBN:
(纸本)9781450379571
In the simplest form, software testing consists of creating test cases from a defined input space, executing those test cases for the system-under-test (SUT), and evaluating the outputs with a mechanism for determining success or failure (i.e. oracle). Bodies of research focus on the selection, execution, evaluation, and even testing of software tests. Many tools and frameworks aim to apply the research in ways that improve test development. However, the options available for testing user interfaces have technical limitations that negatively impact practical application in industry. As such, this industry abstract explores the journey between industry-standard frameworks for testing user interfaces, the negative impacts of their limitations, and a proposed solution that attempts to avoid those issues.
Many websites import large javascript (JS) libraries to speed up development time and enhance user experience. However, many JS libraries that only partially utilized during page loading are all packaged into bundles....
详细信息
ISBN:
(纸本)9780738142593
Many websites import large javascript (JS) libraries to speed up development time and enhance user experience. However, many JS libraries that only partially utilized during page loading are all packaged into bundles. Redundant JS code inflates the page weight, which inflates the time it takes to download, parse, and compile JS resources. Therefore, it is very important to optimize the payload of JS resources to improve Web performance. This paper proposes a scheme combining static structure analysis technique and dynamic tracking technique to identify unused code during application execution and optimize the size of application bundle. Through the dependency relationship between the third-party libraries, this paper designed an analysis structure, which extract various types of function information to improve the redundant functions detection efficiency. After that, in the construction of the application bundle, this paper eliminated the redundant JS code. Our experiments show that the scheme is simple and effective, and reduces the amount of code in the bundle by 32.64% on average, and improves the accuracy by 23% on average compared with the coverage API redundancy detection tool. On the basis of ensuring the robustness of the code, the loading performance of the application is optimized.
Providing security guarantees for systems built out of untrusted components requires the ability to define and enforce access control policies over untrusted code. In Web 2.0 applications, javascript code from differe...
详细信息
ISBN:
(纸本)9781450323741
Providing security guarantees for systems built out of untrusted components requires the ability to define and enforce access control policies over untrusted code. In Web 2.0 applications, javascript code from different origins is often combined on a single page, leading to well-known vulnerabilities. We present a security infrastructure which allows users and content providers to specify access control policies over subsets of a javascript program by leveraging the concept of delimited histories with revocation. We implement our proposal in WebKit and evaluate it with three policies on 50 widely used websites with no changes to their javascript code and report performance overheads and violations.
Web-based malware equipped with stealthy cloaking and obfuscation techniques is becoming more sophisticated nowadays. In this paper, we propose J-FORCE, a crash-free forced javascript execution engine to systematicall...
详细信息
ISBN:
(纸本)9781450349130
Web-based malware equipped with stealthy cloaking and obfuscation techniques is becoming more sophisticated nowadays. In this paper, we propose J-FORCE, a crash-free forced javascript execution engine to systematically explore possible execution paths and reveal malicious behaviors in such malware. In particular, J-FORCE records branch outcomes and mutates them for further explorations. J-FORCE inspects function parameter values that may reveal malicious intentions and expose suspicious DOM injections. We addressed a number of technical challenges encountered. For instance, we keep track of missing objects and DOM elements, and create them on demand. To verify the efficacy of our techniques, we apply J-FORCE to detect Exploit Kit (EK) attacks and malicious Chrome extensions. We observe that J-FORCE is more effective compared to the existing tools.
As javascript and its backend web frameworks garnered mainstream adoption and played a pivotal role in today's industry, challenges of runtime performance, developer experience, and type safety are potential hindr...
详细信息
ISBN:
(纸本)9798400702433
As javascript and its backend web frameworks garnered mainstream adoption and played a pivotal role in today's industry, challenges of runtime performance, developer experience, and type safety are potential hindrances to scaling and maintainability. This paper suggests strategies for web frameworks in javascript to provide a balanced focus between performance and convenience by optimizing the performance of potentially expensive ergonomic features by utilizing javascript's interpreted nature and Just-In-Time compilation through the use of static analysis and dynamic code generation techniques in conjunction with adopting TypeScript's type system to provide an improved developer experience. The reference implementation of the optimization strategies and design for developer experience is illustrated through the implementations in the Elysia javascript web framework, in which the performance is evaluated against non-optimized code and benchmarked against other real-world backend web frameworks.
In today's web applications, javascript code interacts with the Document Object Model (DOM) at runtime. This runtime interaction between javascript and the DOM is errorprone and challenging to test. In order to un...
详细信息
ISBN:
(纸本)9781509000258
In today's web applications, javascript code interacts with the Document Object Model (DOM) at runtime. This runtime interaction between javascript and the DOM is errorprone and challenging to test. In order to unit test a javascript function that has read/write DOM operations, a DOM instance has to be provided as a test fixture. This DOM fixture needs to be in the exact structure expected by the function under test. Otherwise, the test case can terminate prematurely due to a null exception. Generating these fixtures is challenging due to the dynamic nature of javascript and the hierarchical structure of the DOM. We present an automated technique, based on dynamic symbolic execution, which generates test fixtures for unit testing javascript functions. Our approach is implemented in a tool called CONFIX. Our empirical evaluation shows that CONFIX can effectively generate tests that cover DOM-dependent paths. We also find that CONFIX yields considerably higher coverage compared to an existing javascript input generation technique.
暂无评论