Dynamic analyses are commonly implemented by instrumenting the program under analysis. Examples of such analyses for JavaScript range from checkers of user- defined invariants to concolic testers. For a full-stack JavaScript program, these analyses would benefit from reasoning about the state of the client-side and server-side processes it is comprised of. Lifting a dynamic analysis so that it supports full-stack programs can be challenging. It involves distributed communication to maintain the analysis state across all processes, which has to be deadlock-free. In this paper, we advocate maintaining distributed analysis state in a centralized analysis process instead — which is communicated with from the processes under analysis. The approach is supported by a dynamic analysis platform that provides abstractions for this communication. We evaluate the approach through a case study. We use the platform to build a distributed origin analysis, capable of tracking the expressions from which values originate from across process boundaries, and deploy it on collaborative drawing application. The results show that our approach greatly simplifies the lifting process at the cost of a computational overhead. We deem this overhead acceptable for analyses intended for use at development time.

We present Linvail, a novel instrumentation platform for developing dynamic analyses of JavaScript programs. Linvail is particularly well-suited to implementing shadow executions which involve tagging runtime values with analysis-specific data. In contrast to existing instrumentation platforms, Linvail is capable of tracking both tagged objects and tagged primitive values during their entire life-time in a behavior-preserving manner. To demonstrate the expressiveness of our platform, we present the implementation of several state-of-the-art analyses. Our experiments demonstrate that Linvail's accuracy comes at the price of a performance overhead, but we believe that real-world applications will remain usable under analysis.

JavaScript has become a popular programming language. However, its highly dynamic nature encumbers static analysis for quality assurance purposes. Only dynamic techniques such as concolic testing seem to cope. Often, these involve an instrumentation phase in which source code is extended with analysis-specific concerns. The corresponding implementations represent a duplication of engineering efforts. To facilitate developing dynamic analyses for JavaScript, we introduce Aran; a general-purpose JavaScript instrumenter that takes advantage of proxies, a recent addition to the JavaScript reflection APIs.

Functional testing requires executing particular sequences of user actions. Test automation tools enable scripting user actions such that they can be repeated more easily. SELENIUM, for instance, enables testing Web applications through scripts that interact with a Web browser and assert properties about its observable state. However, little is known about how common such tests are in practice. We therefore present a cross-sectional quantitative study of the prevalence of SELENIUM-based tests among open-source Web applications, and of the extent to which such tests are used within individual applications. Automating functional tests also brings about the problem of maintaining test scripts. As the system under test evolves, its test scripts are bound to break. Even less is known about the way test scripts change over time. We therefore also present a longitudinal quantitative study of whether and for how long test scripts are maintained, as well as a longitudinal qualitative study of the kind of changes they undergo. To the former's end, we propose two new metrics based on whether a commit to the application's version repository touches a test file. To the latter's end, we propose to categorize the changes within each commit based on the elements of the test upon which they operate. As such, we are able to identify the elements of a test that are most prone to change.