Type Inference for Static Compilation of JavaScript Satish Chandra∗ Colin S. Gordon† Jean-Baptiste Jeannin∗ Cole Schlesinger∗ Manu Sridharan∗ Frank Tip‡ Youngil Choi§ ∗Samsung Research America, USA †Drexel University, USA {schandra,jb.jeannin,cole.s,m.sridharan}@samsung.com [email protected] ‡Northeastern University, USA §Samsung Electronics, South Korea [email protected] [email protected] Abstract real-world applications—ranging from servers to embed- We present a type system and inference algorithm for a ded devices—has sparked significant interest in JavaScript- rich subset of JavaScript equipped with objects, structural focused program analyses and type systems in both the aca- subtyping, prototype inheritance, and first-class methods. demic research community and in industry. The type system supports abstract and recursive objects, In this paper, we report on a type inference algorithm for and is expressive enough to accommodate several standard JavaScript developed as part of a larger, ongoing effort to benchmarks with only minor workarounds. The invariants enable type-based ahead-of-time compilation of JavaScript enforced by the types enable an ahead-of-time compiler to programs. Ahead-of-time compilation has the potential to carry out optimizations typically beyond the reach of static enable lighter-weight execution, compared to runtimes that compilers for dynamic languages. Unlike previous inference rely on just-in-time optimizations [5, 9], without compromis- techniques for prototype inheritance, our algorithm uses ing performance. This is particularly relevant for resource- a combination of lower and upper bound propagation to constrained devices such as mobile phones where both perfor- infer types and discover type errors in all code, including mance and memory footprint are important. Types are key to uninvoked functions. The inference is expressed in a simple doing effective optimizations in an ahead-of-time compiler. constraint language, designed to leverage off-the-shelf fixed JavaScript is famously dynamic; for example, it contains point solvers. We prove soundness for both the type system eval for runtime code generation and supports introspective and inference algorithm. An experimental evaluation showed behavior, features that are at odds with static compilation. that the inference is powerful, handling the aforementioned Ahead-of-time compilation of unrestricted JavaScript is not benchmarks with no manual type annotation, and that the our goal. Rather, our goal is to compile a subset that is inferred types enable effective static compilation. rich enough for idiomatic use by JavaScript developers. Although JavaScript code that uses highly dynamic features Categories and Subject Descriptors D.3.3 [Programming does exist [39], data shows that the majority of application Languages]: Language Constructs and Features; D.3.4 [Pro- code does not require that flexibility. With growing interest in gramming Languages]: Processors using JavaScript across a range of devices, including resource- Keywords object-oriented type systems, type inference, constrained devices, it is important to examine the tradeoff JavaScript between language flexibility and the cost of implementation. The JavaScript compilation scenario imposes several 1. Introduction desiderata for a type system. First, the types must be sound, so they can be relied upon for compiler transformations. JavaScript is one of the most popular programming languages Second, the types must impose enough restrictions to allow currently in use [6]. It has become the de facto standard the compiler to generate code with good, predictable perfor- in web programming, and its growing use in large-scale, mance for core language constructs (Section 2.1 discusses some of these optimizations). At the same time, the system Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed must be expressive enough to type check idiomatic coding for profit or commercial advantage and that copies bear this notice and the full citation patterns and make porting of mostly-type-safe JavaScript on the first page. Copyrights for components of this work owned by others than ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, code easy. Finally, in keeping with the nature of the language, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. as well as to ease porting of existing code, we desire powerful OOPSLA’16, November 2–4, 2016, Amsterdam, Netherlands type inference. To meet developer expectations, the infer- c 2016 ACM. 978-1-4503-4444-9/16/11...$15.00 ence must infer types and discover type errors in all code, http://dx.doi.org/10.1145/2983990.2984017 410 including uninvoked functions from libraries or code under Leveraging inferred types, we have built a backend that development. compiles type-checked JavaScript programs to optimized No existing work on JavaScript type systems and infer- native binaries for both PCs and mobile devices. We have ence meets our needs entirely. Among the recently developed compiled slightly-modified versions of six of the Octane type systems, TypeScript [8] and Flow [3] both have rich benchmarks [1], which ranged from 230 to 1300 LOC, using type systems that focus on programmer productivity at the ex- our compiler. The modifications needed for the programs to pense of soundness. TypeScript relies heavily on programmer type check were minor (see Section 5 for details). annotations to be effective, and both treat inherited properties Preliminary data suggests that for resource-constrained too imprecisely for efficient code generation. Defensive Java- devices, trading off some language flexibility for static com- Script [15] has a sound type system and type inference, and pilation is a compelling proposition. With ahead-of-time com- Safe TypeScript [36] extends TypeScript with a sound type pilation (AOTC), the six Octane programs incurred a signif- system, but neither supports prototype inheritance. TAJS [29] icantly smaller memory footprint compared to running the is sound and handles prototype inheritance precisely, but it same JavaScript sources with a just-in-time optimizing en- does not compute types for uninvoked functions; the classic gine. The execution performance is not as fast as JIT engines work on type inference for SELF [12] has the same drawback. when the programs run for a large number of iterations, but is Choi et al. [21] present a JavaScript type system targeting acceptable otherwise, and vastly better than a non-optimizing ahead-of-time compilation that forms the basis of our type interpreter (details in Section 5). system, but their work does not have inference and instead We have also created six GUI-based applications for the relies on programmer annotations. See Section 6 for further Tizen [7] platform, reworking from existing web applications; discussion of related work. these programs ranged between 250 to 1000 lines of code. In This paper presents a type system and inference algorithm all cases, all types in the user-written JavaScript code were for a rich subset of JavaScript that achieves our goals. Our inferred, and no explicit annotations were required. We do type system builds upon that of Choi et al. [21], adding require annotated signatures of library functions, and we have support for abstract objects, first-class methods, and recursive created these for many of the JavaScript standard libraries objects, each of which we found crucial for handling real- as well as for the Tizen platform API. Experiences with and world JavaScript idioms; we prove these extensions sound. limitations of our system are discussed in Section 5. The type system supports a number of additional features such Contributions: as polymorphic arrays, operator overloading, and intersection types in manually-written interface descriptors for library • We present a type system, significantly extending previous code, which is important for building GUI applications. work [21], for typing common JavaScript inheritance Our type inference technique builds on existing literature patterns, and we prove the type system sound. Our system (e.g., [12, 23, 35]) to handle a complex combination of strikes a useful balance between allowing common coding language features, including structural subtyping, prototype patterns and enabling ahead-of-time compilation. inheritance, first-class methods, and recursive types; we are • We present an inference algorithm for our type system unaware of any single previous type inference technique that and prove it sound. To our best knowledge, this algorithm soundly handles these features in combination. is the first to handle a combination of structural subtyping, We formulate type inference as a constraint satisfaction prototype inheritance, abstract types, and recursive types, problem over a language composed primarily of subtype con- while also inferring types for uninvoked functions. This straints over standard row variables. Our formulation shows inference algorithm may be of independent interest, for that various aspects of the type system, including source-level example, as a basis for software productivity tools. subtyping, prototype inheritance, and attaching methods to • We discuss our experiences with applying an ahead-of- objects, can all be reduced to these simple subtype constraints.