Discovering User-Defined Event Handlers in
Presence of JavaScript Libraries
Shuai Wang, Wensheng Dou*, Chushu Gao, Jun Wei, Tao Huang
Technology Center of Software Engineering
Institute of Software at Chinese Academy of Sciences
Beijing, China
{wangshuai, wsdou, gaochushu, wj, tao}@otcaix.iscas.ac.cn
Abstract—JavaScript libraries, such as JQuery, are widely
used in web applications. In these libraries’ event delegation
models, a DOM element’s event handler is usually bound to its
parent nodes. This makes it difficult for developers to figure out
the user-defined event handlers of a specified DOM element. In
this paper, we propose an approach that identifies the user-
defined event handlers of DOM elements in a web page. We dy-
namically collect the execution trace for each triggered event in a
web page, and analyze how each function is used in the execution
trace to discover the event handlers for each event. We evaluate
our approach on seven real-world web applications. The result
shows that our approach is effective, with an overall precision of
100% and recall of 99.8%.
Keywords—JavaScript; event; event delegation
I. INTRODUCTION
JavaScript libraries, such as jQuery [1], prototype [2], YUI
[3], and MooTools [4], are widely used in web applications.
These libraries can provide convenient event delegation
models, compatibility of different environments, easier
integration with other technologies, and so on. The business
report [5] shows that 94.8% web applications are built on the
top 10 popular JavaScript libraries.
Web applications are event-driven [6]. It is important to
know what event handlers can be triggered by an event on a
specific DOM element. This information can be used to
understand JavaScript programs by developers [7], or
automatically generate test cases, such as Crawljax [8].
In order to facilitate the event handling, common JavaScript
libraries usually provides an event delegation model. The event
delegation model binds the event handlers to the parent
element of a DOM element, rather than itself. The event
delegation model will dynamically trigger the bound event
handlers for the DOM element at runtime. The delegation
model hides the user-defined event handlers for each DOM
element in a web page. For example, when a user clicks a div
element, which function is user-defined event handlers for the
click event? Existing development tools, such as Chrome
DevTools [7], consider the library event handlers (defined in
libraries) as the event handlers, and cannot accurately figure
out the real user-defined event handlers. Therefore, the user-
defined event handlers are hidden by the library event handlers.
It is challenging to accurately identify the user-defined
event handlers of DOM elements in a web page. (1) There is no
de facto specification for the DOM event delegation model,
and different JavaScript libraries implement event delegation in
different ways. For example, jQuery implements event
delegation using a dispatcher pattern, which uses a single
dispatcher function to invoke multiple user-defined event
handlers, while YUI using a wrapper pattern, which creates a
particular wrapper function for each user-defined event
handler. (2) JavaScript is highly dynamic, it treats functions as
first-class citizens, it allows developers to create functions dy-
namically, pass functions as parameters to other functions, re-
turn functions as values from other functions, and assign func-
tions to variables, which makes it a particularly difficult lan-
guage to analyze.
To tackle this problem, we introduce an approach to
automatically identify user-defined event handlers of DOM
elements. Our approach is inspired by the following
observation: user-defined event handlers act like standard event
handlers, and are invoked by library event handlers instead of
browsers. (1) When event handlers are being bound, functions
are passed as parameters to event binding function calls, and
are never invoked in the execution of event binding functions.
(2) When a corresponding event is fired, an event handler is
invoked and receives an argument similar to a standard DOM
event [9]. (3) A library event handler may invoke multiple use-
defined event handlers in a polymorphic manner. Based on
these observations, our approach conducts dynamic analysis on
a given web page to discover all the user-defined event
handlers. Firstly, our approach figures out candidate user-
defined event handlers. We monitor the execution of all func-
tions when the web page is initializing, and check whether a
function-type argument is registered as a callback function
within the execution of receiver functions, and is not invoked
by receivers. Secondly, we trigger all the events on each DOM
element and monitor the execution of event handlers. If a
candidate event handler is invoked in a polymorphic manner
and receives an argument similar to a standard DOM event,
this candidate event handler would be a user-defined event
handler for the triggered event.
* Corresponding author
2015 Asia-Pacific Software Engineering Conference
1530-1362/15 $31.00 © 2015 IEEE
DOI 10.1109/APSEC.2015.56
293