JSLint

The JavaScript Verifier

©2002 Douglas Crockford

JSLint is a JavaScript program that looks for problems in JavaScript programs.

What is JSLint?

When C was a young programming language, there were several common programming errors that were not caught by the primitive compilers, so an accessory program called lint was developed which would scan a source file, looking for problems.

As the language matured, the definition of the language was strengthened to eliminate some insecurities, and compilers got better at issuing warnings. lint is no longer needed.

JavaScript is a young language. It was originally intended to do small tasks in webpages, tasks for which Java was too heavy and clumsy. But JavaScript is a very capable language, and it is now being used in larger projects. Many of the features that were intended to make the language easy to use are troublesome for larger projects. A lint for JavaScript is needed: JSLint, a JavaScript syntax checker and validator.

JSLint takes a JavaScript source and scans it. If it finds a problem, it returns a message describing the problem and an approximate location within the source. The problem is not necessarily a syntax error, although it often is. JSLint looks at some style conventions as well as structural problems. It does not prove that your program is correct. It just provides another set of eyes to help spot problems.

JSLint defines a professional subset of JavaScript, a stricter language than that defined by Edition 3 of the ECMAScript Language Specification. The subset is related to recommendations found in Code Conventions for the JavaScript Programming Language.

JavaScript is a sloppy language, but inside it there is an elegant, better language. JSLint helps you to program in that better language and to avoid most of the slop.

Semicolon

JavaScript uses a C-like syntax which requires the use of semicolons to delimit statements. JavaScript attempts to make semicolons optional with a semicolon insertion mechanism. This is dangerous.

Like C, JavaScript has ++ and -- and ( operators which can be prefixes or suffixes. The disambiguation is done by the semicolon.

In Javascript, a linefeed can be whitespace or it can act as a semicolon. This replaces one ambiguity with another.

JSLint expects that every statement be followed by ; except for for, function, if, switch, try, and while. JSLint does not expect to see unnecessary semicolons or the empty statement.

Line Breaking

As a further defense against the semicolon insertion mechanism, JSLint expects long statements to be broken only after one of these punctuation characters or operators:

, . ; : { } ( [ = < > ? ! + - * / % ~ ^ | &

== != <= >= += -= *= /= %= ^= |= &= << >> || &&

=== !== <<= >>= >>> >>>=

JSLint does not expect to see a long statement broken after an identifier, a string, a number, closer, or a suffix operator:

) ] ++ --

JSLint allows you to turn on the Tolerate sloppy line breaking option.

Semicolon insertion can mask copy/paste errors. If you always break lines after operators, then JSLint can do better at finding them.

Comma

The comma operator can lead to excessively tricky expressions. It can also mask some programming errors.

JSLint expects to see the comma used as a separator, but not as an operator (except in the initialization and incrementation parts of the for statement). It does not expect to see elided elements in array literals. Extra commas should not be used. A comma should not appear after the last element of an array literal or object literal because it can be misinterpreted by some browsers.

Required Blocks

JSLint expects that if and for statements will be made with blocks {that is, with statements enclosed in braces}.

JavaScript allows an if to be written like this:

if (condition)
    statement;

That form is known to contribute to mistakes in projects where many programmers are working on the same code. That is why JSLint expects the use of a block:

if (condition) {
    statement;
}

Experience shows that this form is more resilient.

Forbidden Blocks

In many languages, a block introduces a scope. Variables introduced in a scope are not visible to other parts of the program.

In JavaScript, blocks do not introduce a scope. There is only function-scope. JavaScript's blocks confuse experienced programmers and lead to errors.

JSLint expects blocks with function, if, switch, while, for, do, and try statements and nowhere else.

Expression Statements

An expression statement is expected to be an assignment or a function/method call. All other expression statements are considered to be errors.

var

JavaScript allows var definitions to occur anywhere within a function. JSLint is more strict.

JSLint expects that a var will be declared only once, and that it will be declared before it is used.

JSLint expects that parameters will not also be declared as vars.

JSLint does not expect the arguments array to be declared as a var.

JSLint does not expect that a var will be defined in a block. This is because JavaScript blocks do not have block scope. This can have unexpected consequences. Define all variables at the top of the function.

switch

A common error in switch statements is to forget to place a break statement after each case, resulting in unintended fall-through. JSLint expects that the statement before a case or default is one of these: break, case, continue, return, switch, or throw.

with

The with statement was intended to provide a shorthand in accessing members in deeply nested objects. Unfortunately, it behaves very badly when setting new members. Never use the with statement. Use a var instead.

JSLint does not expect to see a with statement.

=

JSLint does not expect to see an assignment statement in the condition part of an if or while statement. This is because it is more likely that

if (a = b) {
    ...
}

was intended to be

if (a == b) {
    ...
}

If you really intend an assignment, wrap it in another set of parens:

if ((a = b)) {
    ...
}

== and !=

The == and != operators do type coercion before comparing. This is bad because it causes '' == 0 to be true. This can mask type errors.

When comparing to any of the following values, use the === or !== operators, which do not do type coercion.

0 '' undefined null false true

If you want the type coercion, then use the short form. Instead of

(foo != 0)

just say

(foo)

and instead of

(foo == 0)

say

(!foo)

The === and !== operators are preferred. There is a Disallow == and != option which requires the use of === and !== in all cases.

Labels

JavaScript allows any statement to have a label, and labels have a separate name space. JSLint is more strict.

JSLint expects labels only on statements that interact with break: switch, while, do, and for. JSLint expects that labels will be distinct from vars and parameters.

Unreachable Code

JSLint expects that a return, break, continue, or throw statement will be followed by a } or case or default.

Confusing Pluses and Minuses

JSLint expects that + will not be followed by + or ++, and that - will not be followed by - or --. A misplaced space can turn + + into ++, an error that is difficult to see. Use parens to avoid confusion..

++ and --

The ++ (increment) and -- (decrement) operators have been known to contribute to bad code by encouraging excessive trickiness. They are second only to faulty architecture in enabling to viruses and other security menaces. There is an option that prohibits the use of these operators.

Bitwise Operators

JavaScript does not have an integer type, bit it does have bitwise operators. The bitwise operators convert their operands from floating point to integers and back, so they are not near as efficient as in C or other languages. They are rarely useful in browser applications. The similarity to the logical operators can mask some programming errors. There is an option that prohibits the use of these operators.

eval is evil

The eval function (and its relatives, Function, setTimeout, and setInterval) provide access to the JavaScript compiler. This is sometimes useful for parsing JSON text, but in virtually all other cases it indicates the presences of extremely bad coding. The eval function is the most misused feature of JavaScript.

void

In most C-like languages, void is a type. In JavaScript, void is a prefix operator that always returns undefined. JSLint does not expect to see void because it is confusing and not very useful.

Regular Expressions

JavaScript's syntax for regular expression literals overloads the / character. To avoid ambiguity, JSLint expects that the character preceding a regular expression literal is a ( or = or : or , character.

The ECMAScript specification requires that the / character within a regular expression literal be escaped.

Undefined variables

In JavaScript, undefined variables are assumed to be implied global variables. JSLint provides an option for detecting these.

Use the /*extern ... */ declaration to indicate symbols which are defined in other modules. See Extern below.

Constructors and new

Constructors are function which are designed to be used with the new prefix. The new prefix creates a new object based on the function's prototype, and binds that object to the function's implied this parameter. If you neglect to use the new prefix, no new object will be made and this will be bound to the global object. This is a serious mistake.

JSLint enforces the convention that constructor functions be given names with initial uppercase. JSLint does not expect to see a function invocation with an initial uppercase name unless it has the new prefix. JSLint does not expect to see the new prefix used with functions whose names do not start with initial uppercase.

JSLint does not expect to see the wrapper forms new Number, new String, new Boolean.

JSLint does not expect to see new Object (use {} instead).

JSLint does not expect to see new Array (use [] instead).

Not Looked For

JSLint does not do flow analysis to determine that variables are assigned values before used. This is because variables are given a value (undefined) which is a reasonable default for many applications.

JSLint does not do any kind of global analysis. It does not attempt to determine that functions used with new are really constructors (except by enforcing capitalization conventions), or that method names are spelled correctly.

HTML

JSLint is able to handle HTML text. It can inspect the JavaScript content contained within <script>...</script> tags. It also inspects the HTML content, looking for problems that are known to interfere with JavaScript:

JSLint is less anal than the sycophantic conformanity demanded by XHTML, but more strict than the popular browsers.

JSLint also checks for the occurence of '</' in string literals. You should always write '<\/' instead. The extra backslash is ignored by the JavaScript compiler but not by the HTML parser. Tricks like this should not be necessary, and yet they are.

There is an option that allows use of upper case tagnames.

Report

If the source is as JSLint expects, it generates a function report. It lists for each function:

These suffixes may appear in the report:

(closure)The parameter or var is used by an inner function.
(outer)The var is defined by an outer function.
(unused)The var is defined but not used. This may be an indication of an error.
(?) The global var is defined by default within a function. This may be an indication of an error. It can also be a normal occurrence because JSLint does not know about global vars or functions that are defined by the browser or by other files. Select the Detect undefined variables option to flag these as errors.

The report will also include a list of all of the member names that were used. There is a list of JSLint messages.

External

You can include in your program a comment that lists the global functions and objects that your program depends on, but that are not defined in your program or script file. Including this information can improve the quality of the report that is generated.

An external declaration can look like this:

/*extern getElementByClass, breakCycles, JSONRequest */

A global declaration starts with /*extern. Notice that there is no space before the e.

Select the Assume a browser option to predefine the standard global properties that are supplied by web browsers, such as window and document and alert. Select the Assume Rhino option to predefine the global properties provided by the Rhino environment. Select the Assume a Yahoo Widget option to predefine the global properties provided by the Yahoo! Widgets environment.

Options

The implementation of JSLint accepts an option object which allows you to determine the subset of JavaScript that is acceptable to you. It is also possible to set those options within the source of a script.

An option specification can look like this:

/*jslint nomen: true, evil: false */

An option specification starts with /*jslint. Notice that there is no space before the j. The specification contains a sequence of name value pairs, where the names are JSLint options, and the values are true or false. An option specification takes precedence over the option object.

These are the current options:

adsafe true if ADSAFE rules should be enforced
bitwise true if bitwise operators should not be allowed
browser true if the standard browser globals should be predefined
cap true if upper case HTML should be allowed
debug true if debugger statements should be allowed
eqeqeq true if === should be required
evil true if eval should be allowed
fragment true if HTML fragments should be allowed
laxbreak true if line breaks should not be checked
nomen true if names should be checked
passfail true if the scan should stop on first error
plusplus true if increment/decrement should not be allowed
rhino true if the Rhino environment globals should be predefined
undef true if undefined variables are errors
white true if strict whitespace rules apply
widget true if the Yahoo Widgets globals should be predefined

Feedback

Please let me know if JSLint is useful for you. Is it too strict? Is there a check or a report that could speed up your debugging? douglas@crockford.com

I intend to continue to adapt JSLint based on your comments. Keep watching for improvements.

Try it

Try it. Paste your script into the window and click the button. The analysis is done by a script running on your machine. Your script is not sent over the network.

It is also available as a Konfabulator widget. You can check a file by dragging it and dropping it on the widget. You can recheck the file by double-clicking the widget.

It is also available in a WSH Command Line version.

It is also available in a Rhino Command Line version.

Implementation

JSLint uses a Pratt Parser (Top Down Operator Precedence). It is written in JavaScript. The full source code is available: