Collecting Type Information Using Unit Tests
for Customizing JavaScript VMs
work-in-progress report on eJS project

Tomoharu Ugawa1

Hideya Iwasaki2

1 Kochi University of Technology

Takafumi Kataoka1

2 The University of Electro-Communications

eJS: JavaScript VM for IoT• Goal: make IoT programing easier for many people• Why JavaScript• JavaScript is popular• suitable for prototyping• Challenge• Reduce VM footprint

JavaScript engines for IoT• DukTape• Espruino• JerryScript• MuJS• v7/mJSJavaScript engines for IoT• DukTape• Espruino• JerryScript• MuJS• v7/mJS• QuickJS

JavaScript engines for IoT• DukTape• Espruino• JerryScript• MuJS• v7/mJS• QuickJS• support all features of JS, or• support features selected by VM developer

Specialization
Assumptions• Applications on an embedded system are fixed• Each application uses a subset of JavaScript features

Specialization
Assumptions• Applications on an embedded system are fixed• Each application uses a subset of JavaScript features
Our approach• Generate a specialized VM for each set of applications• Give up supporting other applications
APP1

APP2
VM

Fully-featured JavaScript VMAPP1

APP2

VMAPP3crash(or fallback)Subset JavaScript VM for APP1 & APP2

Overview of eJS
targetapplications

application
application B
application A
extract
requirements

eJS Toolkit
specification of
full-featured
JavaScript VM

specializedVM
specializeOverview of eJS
targetapplications

application
application B
application A
extract

compilerequirements
eJS Toolkit
specification of
full-featured
JavaScript VM

app A app B

app C

specializedVM
specialize

embedded system

Overview of eJS
targetapplications

application
application B
application A
extract

compilerequirements
eJS Toolkit
specification offull-featured
JavaScript VM

app A app B

app C

specializedVM
specialize

embedded system

Accuracy of Requirements
Extract accurate requirements of applications

featuresapplication uses

Accuracy of Requirements
Extract accurate requirements of applications• too conservative→ large VM is generated
featuresapplication uses

Accuracy of Requirements
Extract accurate requirements of applications• too conservative→ large VM is generated• missing features→ VM may crash or expensive fallbackfeatures
application uses

Operator Overloading• Number + Number = Number• Number + String = String• Number + Boolean = Number

Operator Overloading• Number + Number = Number• Number + String = String• Number + Boolean = Number

switch(type(v1)) {case NUM:
switch (type(v2)) {case NUM:
dst = NUM(val(v1) + val(v2));
break;
case STR:
v1 = ToString(v1);dst = concat(v1, v2);
break;…
}
case STR:…

ADD instruction

Size Reduction by Specialization• Exclude code for unused operations• Simplify dispatching code
switch(type(v1)) {case NUM:
switch (type(v2)) {case NUM:
dst = Num(val(v1) + val(v2));
break;
case STR:
v1 = toStr(v1);dst = concat(v1, v2);
break;…
}
case STR:…

switch(type(v1)) {case NUM:
dst = NUM(val(v1) + val(v2));
break;
case STR:
dst = concat(v1, v2);
break;}

Specialized Interpreter(Only supports NUM+NUM & STR+STR)
Code for unused operation (NUM + STR)

Application’s Requirement = Type Information
Operand Specification• combinations of operand datatypes of each instruction
ADD(NUM, NUM) -> accept
ADD(STR, STR) -> accept
ADD(_, _) -> error
SUB(NUM, NUM) -> accept…

operand specificationeJS Toolkit
specification of
full-featured
JavaScript VM

specializedVM
specializeCollecting Type Information• Type inference• Profiling

Problem• Input to application• parameters, sensor responses, events, …
• large space to be explored
eventsxyz

APP

Sensor.get()sensorProblem• Input to application• parameters, sensor responses, events, …
• large space to be explored• Execution environment• real hardware is needed
to execute application

eventsxyzAPP

Sensor.get()sensorSolution: Unit tests
function getTemp() {var s = Sensor.get();c = Number(“0x” + s);
f = (c * 9 / 5) + 32;
return f;}application in question

“00”

32

“1E”

86

describe(”test”, function() {it(“getTemp”, function() {spyOn(”Sensor”, ”get”).and.returnValue(“0”);var ret = getTemp();expect(ret).toBe(32);success += (ret === 32);});
it(“string”, function() {spyOn(”Sensor”, ”get”).and.returnValue(“1E”);
var ret = getTemp();expect(ret).toBe(86);success += (ret === 86);});});

test cases using
unit test framework

Profiling Framework

pseudoprofiling
VM

Profiling Framework
applicationc = Number(“0x” + s);compilewith log flag

testcasesuccess += (ret === 32);

pseudo-record operand datatypesof each instruction
if log flag is set…
string_log r3 "0x"add_log
r1 r3 r1…
fixnumr4 32
eq
r3 r3 r4add
r2 r2 r3…

compileprofiling
VMExperiment
JavaScript programs• morse (113 LOC)

test LOC

coverage7899.8%• ported from C• humidity and temperature meter (HT) (459 LOC)
• mainmodulemain

113

87.4%

• sensor — ported from Python

sensor

170

66.0%

LCD

9977.1%

total

38277.4%• LCD — ported from C

test LOC coverage

Result• Generated operandInterpreter Size (KB)

specifications were correct20

fully-featuredinference
profiling• VM size
15• fully-featured VM• conservative type inference• abstract interpretationof bytecode• profiling

1050bettermorseHTAdvantage & Disadvantage• Advantage• free — users do not need to create extra stuﬀ
• practical — we can do on desktop computer• no overestimation• Disadvantage• unsound• accuracy depends on quality of test cases

Conclusion and Future Work• Framework to collect application requirements• Observe executions of unit tests• Future Work• Combination with type inference• Measure quality of test suite — coverage?