JavaScript has been a de facto standard language for client-side web programs, and now it
is expanding its territory to general purpose programs. In this article, we classify the client …

The dynamic nature of JavaScript and its complex semantics make it a difficult target for logic-
based verification. We introduce JaVerT, a semi-automatic JavaScript Verification Toolchain …

Static analysis tools for JavaScript must strike a delicate balance, achieving the level of
precision required by the most complex features of target programs without incurring …

JavaScript is one of the most dominant programming languages. However, despite its
popularity, it is a challenging task to correctly understand the behaviors of JavaScript …

In this thesis, we aim at designing both theoretically and experimentally methods for the
automatic detection of potential bugs in software–or the proof of the absence thereof. This …

Containers are ubiquitous data structures that support a variety of manipulations on the
elements, inducing the indirect value flows in the program. Tracking value flows through …

To infer complex structural invariants, shape analyses rely on expressive families of logical
properties. Many such analyses manipulate abstract memory states that consist of …

In static analysis of modern JavaScript libraries, relational analysis at key locations is critical
to provide sound and useful results. Prior work addresses this challenge by the use of …

Array partitioning analyses split arrays into contiguous partitions to infer properties of cell
sets. Such analyses cannot group together non contiguous cells, even when they have …

We present an approach for the static analysis of programs handling arrays, with a Galois
connection between the semantics of the array program and semantics of purely scalar …