  We describe JSAI, an abstract interpreter for JavaScript. JSAI uses novel
abstract domains to compute a reduced product of type inference, pointer
analysis, string analysis, integer and boolean constant propagation, and
control-flow analysis. In addition, JSAI allows for analysis control-flow
sensitivity (i.e., context-, path-, and heap-sensitivity) to be modularly
configured without requiring any changes to the analysis implementation. JSAI
is designed to be provably sound with respect to a specific concrete semantics
for JavaScript, which has been extensively tested against existing
production-quality JavaScript implementations.
  We provide a comprehensive evaluation of JSAI's performance and precision
using an extensive benchmark suite. This benchmark suite includes real-world
JavaScript applications, machine-generated JavaScript code via Emscripten, and
browser addons. We use JSAI's configurability to evaluate a large number of
analysis sensitivities (some well-known, some novel) and observe some
surprising results. We believe that JSAI's configurability and its formal
specifications position it as a useful research platform to experiment on novel
sensitivities, abstract domains, and client analyses for JavaScript.
