EMME: a formal tool for ECMAScript Memory Model Evaluation

TL;DR

This paper presents EMME, a formal tool based on Alloy, for validating the ECMAScript memory model and analyzing JavaScript engines to find bugs and optimization opportunities.

Contribution

It introduces a formal version of the ECMAScript memory model and a tool, EMME, for exhaustive execution analysis of JavaScript programs.

Findings

EMME can detect bugs in JavaScript engines.

The formal model ensures consistency and correctness.

Analysis reveals optimization opportunities in engines.

Abstract

Nearly all web-based interfaces are written in JavaScript. Given its prevalence, the support for high performance JavaScript code is crucial. The ECMA Technical Committee 39 (TC39) has recently extended the ECMAScript language (i.e., JavaScript) to support shared memory accesses between different threads. The extension is given in terms of a natural language memory model specification. In this paper we describe a formal approach for validating both the memory model and its implementations in various JavaScript engines. We first introduce a formal version of the memory model and report results on checking the model for consistency and other properties. We then introduce our tool, EMME, built on top of the Alloy analyzer, which leverages the model to generate all possible valid executions of a given JavaScript program. Finally, we report results using EMME together with small test programs to analyze industrial JavaScript engines. We show that EMME can find bugs as well as missed opportunities for optimization.