An empirical study on bugs in JavaScript engines

JavaScript is a prototype-based dynamic type scripting language. The correct running of a JavaScript program depends on the correctness of both the program and the JavaScript engine.An in-depth understanding of the characteristics of bugs in JavaScript engines can help detect and fix them.We conduct an empirical study on the bugs in three mainstream JavaScript engines: V8, SpiderMonkey, and Chakra. Such an empirical study involves 19,019 bug reports, 16,437 revisions, 805 test cases, and root causes of randomly selected 540 bugs.(1) The Compiler and the DOM are the most buggy component in V8 and SpiderMonkey, respectively. Most of the source files contain only one bug. (2) The scales of the testing programs that reveal bugs are usually small. Most bug fixes involve only limited modifications since the number of modified source files and lines of code modified are small. (3) Most bugs can be fixed within half a year (80.33% for V8 and 91.9% for SpiderMonkey). Only 4.33% of SpiderMonkey bugs need more than a year to fix. Bugs in SpiderMonkey are usually fixed faster than bugs in V8. (4) High priority tends to be assigned to Infrastructure bugs in V8 and Release Automation bugs in SpiderMonkey. The duration of bugs is not strictly correlated with their priorities. (5) Semantic bugs are the most common root causes of bugs. And among semantic bugs, the processing bugs, missing features bugs and function call bugs are more than others.This study deepens our understanding of bugs in JavaScript engines, and empirical results could indicate some potential problems during the detecting and fixing of bugs in JavaScript engines, assist developers of JavaScript engines in improving their development quality, assist maintainers in detecting and fixing bugs more effectively, and suggest users of JavaScript evade potential risks.