how does bugDetect work? about safe HOT 2 CLOSED

SAFE is a framework to support implementing various JavaScript static analysis techniques and bug detectors. Thus, only basic techniques and detectors are implemented in SAFE. If you want to implement an arity checker, you can implement it by simply extending the bug detector. It currently provides 1) absent property read:

By the way, JavaScript allows function invocations with different arities, and some developers want to use this language feature to mimic function overloading. Therefore, I think that detecting arity mismatches as bugs might be annoying to some developers.

from safe.

SAFE ... currently provides 1) absent property read ... and 2) always false or true branches
as example detectors.

OK, yes, this works as expected, then:

function shoeSize(shoe) {
  if (shoe || ~shoe) {
    console.log('to be or not to be');
  }
  return shoe.size;
}

shoeSize({ large: true });

$ safe bugDetect buggy.js 
buggy.js:
1 error:
    kr.ac.kaist.safe.errors.error.IdNotBoundError: buggy.js:3:5-12: Identifier console is not bound.
No warning
buggy.js:3:5-38:
    [Warning] The property "log" of the object "console["log"]('to be or not to be')" is absent.
buggy.js:2:7-11:
    [Warning] The conditional expression "shoe" is always true.
The command 'bugDetect' took 1608 ms.

... I think that detecting arity mismatches as bugs might be annoying to some developers.

I was confusing SAFE with JSTAR:

JSTAR performs a type analysis and detects specification bugs using a bug detector consisting of four checkers: 1) a reference checker, 2) an arity checker, 3) an assertion checker, and 4) an operand checker. -- https://github.com/kaist-plrg/jstar/blob/main/ase21-park-jstar.pdf

from safe.