Event-driven programming is widely practiced in the JavaScript community, both on the client side to handle UI events and AJAX requests, and on the server side to accommodate long-running operations such as file or network I/O. Many popular event-based APIs allow event names to be specified as free-form strings without any validation, potentially leading to lost events for which no listener has been registered and dead listeners for events that are never emitted. In previous work, Madsen et al. presented a precise static analysis for detecting such problems, but their analysis does not scale because it may require a number of contexts that is exponential in the size of the program. Concentrating on the problem of detecting dead listeners, we present an approach to learn how to use event-based APIs by first mining a large corpus of JavaScript code using a simple static analysis to identify code snippets that register an event listener, and then applying statistical modeling to identify anomalous patterns, which often indicate incorrect API usage. In a large-scale evaluation on 127,531 open-source JavaScript code bases, our technique was able to detect 75 anomalous listener-registration patterns, while maintaining a precision of 90.9% and recall of 7.5% over a validation set, demonstrating that a learning-based approach to detecting event-handling bug patterns is feasible. In an additional experiment, we investigated instances of these patterns in 25 open-source projects, and reported 30 issues to the project maintainers, of which 7 have been confirmed as bugs.

中文翻译：

---

学习如何倾听：自动查找事件驱动 JavaScript API 中的错误模式


事件驱动编程在 JavaScript 社区中得到广泛应用，既可以在客户端处理 UI 事件和 AJAX 请求，也可以在服务器端适应长时间运行的操作，例如文件或网络 I/O。许多流行的基于事件的 API 允许将事件名称指定为自由格式字符串而不进行任何验证，这可能会导致未注册侦听器的事件丢失以及从未发出的事件的死侦听器。在之前的工作中，Madsen 等人。提出了一种精确的静态分析来检测此类问题，但他们的分析无法扩展，因为它可能需要大量与程序大小呈指数关系的上下文。专注于检测死亡监听器的问题，我们提出了一种学习如何使用基于事件的 API 的方法，首先使用简单的静态分析来挖掘大量 JavaScript 代码，以识别注册事件监听器的代码片段，然后应用统计建模以识别异常模式，这通常表明 API 使用不正确。在对 127,531 个开源 JavaScript 代码库进行的大规模评估中，我们的技术能够检测到 75 种异常监听者注册模式，同时在验证集上保持 90.9% 的精确度和 7.5% 的召回率，这表明学习-基于方法来检测事件处理错误模式是可行的。在另一项实验中，我们调查了 25 个开源项目中这些模式的实例，并向项目维护人员报告了 30 个问题，其中 7 个已被确认为错误。