Abstract:The popularity and wide adoption of JavaScript both at the client and server side makes its code analysis more important than ever before. Most of the algorithms for vulnerability analysis, coding issue detection, or type inference rely on the call graph representation of the underlying program. Despite some obvious advantages of dynamic analysis, static algorithms should also be considered for call graph construction as they do not require extensive test beds for programs and their costly execution and tracing. In this paper, we systematically compare five widely adopted static algorithms - implemented by the npm call graph, IBM WALA, Google Closure Compiler, Approximate Call Graph, and Type Analyzer for JavaScript tools - for building JavaScript call graphs on 26 WebKit SunSpider benchmark programs and 6 real-world <a class="link-external link-http" href="http://Node.js" rel="external noopener nofollow">this http URL</a> modules. We provide a performance analysis as well as a quantitative and qualitative evaluation of the results. We found that there was a relatively large intersection of the found call edges among the algorithms, which proved to be 100 precise. However, most of the tools found edges that were missed by all others. ACG had the highest precision followed immediately by TAJS, but ACG found significantly more call edges. As for the combination of tools, ACG and TAJS together covered 99% of the found true edges by all algorithms, while maintaining a precision as high as 98%. Only two of the tools were able to analyze up-to-date multi-file <a class="link-external link-http" href="http://Node.js" rel="external noopener nofollow">this http URL</a> modules due to incomplete language features support. They agreed on almost 60% of the call edges, but each of them found valid edges that the other missed.

An Empirical Study of Java Dynamic Call Graph Extractors

Empirical Study Of The Usability Of Dynamic Information In Reverse Engineering

Points to analysis for partial call graph construction

Effective code coverage in compositional systematic dynamic testing

Static JavaScript Call Graphs: A Comparative Study

An Instrumentation Tool for Program Dynamic Analysis in Java

On the Soundness of Call Graph Construction in the Presence of Dynamic Language Features - A Benchmark and Tool Evaluation

Efficient Construction of Practical Python Call Graphs with Entity Knowledge Base

Program Verification by Reachability Searching over Dynamic Call Tree.

Code Definition Analysis for Call Graph Generation

The Dynamics of Software Composition Analysis

RunDroid: recovering execution call graphs for Android applications

A Function Call Graph Extraction Method Combining Static and Dynamic Analysis

Scalable and Precise Application-Centered Call Graph Construction for Python

Code2graph: automatic generation of static call graphs for Python source code

Survey on Querying and Mining Algorithms on Dynamic Graphs

Structure and Interpretation of Computer Programs

Survey on Dynamic Graph Pattern Matching Technologies

Automated Parallel Kernel Extraction from Dynamic Application Traces

DPAC: an infrastructure for dynamic program analysis of concurrency Java programs

Scalable Demand-Driven Call Graph Generation for Python