Tue 16 Jun 2015 14:50 - 15:15 at PLDI Main RED (Portland 256) - Semantics I Chair(s): Hans-J. Boehm

This paper presents KJS, the most complete and throughly tested formal semantics of JavaScript to date. Being executable, KJS has been tested against the ECMAScript 5 conformance test suite, and passes all 2,782 core language tests. Among the existing implementations of JavaScript, only Chrome’s passes all the tests, and no other semantics passes more than 90%. In addition to a reference implementation for JavaScript, KJS also yields a simple coverage metric for a test suite: the set of semantic rules it exercises. Our semantics revealed that the ECMAScript 5 conformance test suite fails to cover several semantic rules. Guided by the semantics, we wrote tests to exercise those rules. The new tests revealed bugs both in production JavaScript engines (Chrome, Safari, Firefox) and in other semantics. KJS is symbolically executable, thus it can be used for formal analysis and verification of JavaScript programs. We verified non-trivial programs and found known security vulnerabilities.

PLDI 2015 Artifact Evaluated Badge