# `JSLint`

## The JavaScript Verifier

©2002 Douglas Crockford

`JSLint` is a JavaScript program that looks for problems in JavaScript programs.

## What is `JSLint`?

When C was a young programming language, there were several common programming errors that were not caught by the primitive compilers, so an accessory program called `lint` was developed which would scan a source file, looking for problems.

As the language matured, the definition of the language was strengthened to eliminate some insecurities, and compilers got better at issuing warnings. `lint` is no longer needed.

JavaScript is a young language. It was originally intended to do small tasks in webpages, tasks for which Java was too heavy and clumsy. But JavaScript is a very capable language, and it is now being used in larger projects. Many of the features that were intended to make the language easy to use are troublesome for larger projects. A `lint` for JavaScript is needed: `JSLint`, a JavaScript syntax checker and validator.

`JSLint` takes a JavaScript source and scans it. If it finds a problem, it returns a message describing the problem and an approximate location within the source. The problem is not necessarily a syntax error, although it often is. `JSLint` looks at some style conventions as well as structural problems. It does not prove that your program is correct. It just provides another set of eyes to help spot problems.

`JSLint` defines a professional subset of JavaScript, a stricter language than that defined by Edition 3 of the ECMAScript Language Specification. The subset is related to recommendations found in Code Conventions for the JavaScript Programming Language.

JavaScript is a sloppy language, but inside it there is an elegant, better language. JSLint helps you to program in that better language and to avoid most of the slop.

## Semicolon

JavaScript uses a C-like syntax which requires the use of semicolons to delimit statements. JavaScript attempts to make semicolons optional with a semicolon insertion mechanism. This is dangerous.

Like C, JavaScript has `++` and `--` and `(` operators which can be prefixes or suffixes. The disambiguation is done by the semicolon.

In Javascript, a linefeed can be whitespace or it can act as a semicolon. This replaces one ambiguity with another.

`JSLint` expects that every statement be followed by `;` except for `for`, `function`, `if`, `switch`, `try`, and `while`. `JSLint` does not expect to see unnecessary semicolons or the empty statement.

## Line Breaking

As a further defense against the semicolon insertion mechanism, `JSLint` expects long statements to be broken only after one of these punctuation characters or operators:

`, . ; : { } ( [ = < > ? ! + - * / % ~ ^ | &`

`== != <= >= += -= *= /= %= ^= |= &= << >> || &&`

`=== !== <<= >>= >>> >>>=`

`JSLint` does not expect to see a long statement broken after an identifier, a string, a number, closer, or a suffix operator:

`) ] ++ --`

`JSLint` allows you to turn on the `Tolerate sloppy line breaking` option.

Semicolon insertion can mask copy/paste errors. If you always break lines after operators, then JSLint can do better at finding them.

## Comma

The comma operator can lead to excessively tricky expressions. It can also mask some programming errors.

`JSLint` expects to see the comma used as a separator, but not as an operator (except in the initialization and incrementation parts of the `for` statement). It does not expect to see elided elements in array literals. Extra commas should not be used. A comma should not appear after the last element of an array literal or object literal because it can be misinterpreted by some browsers.

## Required Blocks

`JSLint` expects that `if` and `for` statements will be made with blocks {that is, with statements enclosed in braces}.

JavaScript allows an `if` to be written like this:

    if (condition)
        statement;

That form is known to contribute to mistakes in projects where many programmers are working on the same code. That is why `JSLint` expects the use of a block:

    if (condition) {
        statement;
    }

Experience shows that this form is more resilient.

## Forbidden Blocks

In many languages, a block introduces a scope. Variables introduced in a scope are not visible to other parts of the program.

In JavaScript, blocks do not introduce a scope. There is only function-scope. JavaScript's blocks confuse experienced programmers and lead to errors.

`JSLint` expects blocks with `function`, `if`, `switch`, `while`, `for`, `do`, and `try` statements and nowhere else.

## Expression Statements

An expression statement is expected to be an assignment or a function/method call. All other expression statements are considered to be errors.

## `var`

JavaScript allows `var` definitions to occur anywhere within a function. `JSLint` is more strict.

`JSLint` expects that a `var` will be declared only once, and that it will be declared before it is used.

`JSLint` expects that parameters will not also be declared as vars.

`JSLint` does not expect the `arguments` array to be declared as a `var`.

`JSLint` does not expect that a var will be defined in a block. This is because JavaScript blocks do not have block scope. This can have unexpected consequences. Define all variables at the top of the function.

## `switch`

A common error in `switch` statements is to forget to place a `break` statement after each `case`, resulting in unintended fall-through. `JSLint` expects that the statement before a `case` or `default` is one of these: `break`, `case`, `continue`, `return`, `switch`, or `throw`.

## `with`

The `with` statement was intended to provide a shorthand in accessing members in deeply nested objects. Unfortunately, it behaves very badly when setting new members. Never use the `with` statement. Use a `var` instead.

`JSLint` does not expect to see a `with` statement.

## =

`JSLint` does not expect to see an assignment statement in the condition part of an `if` or `while` statement. This is because it is more likely that

    if (a = b) {
        ...
    }

was intended to be

    if (a == b) {
        ...
    }

If you really intend an assignment, wrap it in another set of parens:

    if ((a = b)) {
        ...
    }

## == and !=

The `==` and `!=` operators do type coercion before comparing. This is bad because it causes `'' == 0` to be `true`. This can mask type errors.

When comparing to any of the following values, use the `===` or `!==` operators, which do not do type coercion.

`0 '' undefined null false true`

If you want the type coercion, then use the short form. Instead of

    (foo != 0)

just say

    (foo)

and instead of

    (foo == 0)

say

    (!foo)

The `===` and `!==` operators are preferred. There is a `Disallow == and !=` option which requires the use of `===` and `!==` in all cases.

## Labels

JavaScript allows any statement to have a label, and labels have a separate name space. `JSLint` is more strict.

`JSLint` expects labels only on statements that interact with `break`: `switch`, `while`, `do`, and `for`. `JSLint` expects that labels will be distinct from vars and parameters.

## Unreachable Code

`JSLint` expects that a `return`, `break`, `continue`, or `throw` statement will be followed by a `}` or `case` or `default`.

## Confusing Pluses and Minuses

`JSLint` expects that `+` will not be followed by `+` or `++`, and that `-` will not be followed by `-` or `--`. A misplaced space can turn `+ +` into `++`, an error that is difficult to see. Use parens to avoid confusion..

## `++` and `--`

The `++` (increment) and `--` (decrement) operators have been known to contribute to bad code by encouraging excessive trickiness. They are second only to faulty architecture in enabling to viruses and other security menaces. There is an option that prohibits the use of these operators.

## Bitwise Operators

JavaScript does not have an integer type, bit it does have bitwise operators. The bitwise operators convert their operands from floating point to integers and back, so they are not near as efficient as in C or other languages. They are rarely useful in browser applications. The similarity to the logical operators can mask some programming errors. There is an option that prohibits the use of these operators.

## `eval` is evil

The `eval` function (and its relatives, `Function`, `setTimeout`, and `setInterval`) provide access to the JavaScript compiler. This is sometimes useful for parsing JSON text, but in virtually all other cases it indicates the presences of extremely bad coding. The `eval` function is the most misused feature of JavaScript.

## `void`

In most C-like languages, `void` is a type. In JavaScript, `void` is a prefix operator that always returns `undefined`. `JSLint` does not expect to see `void` because it is confusing and not very useful.

## Regular Expressions

JavaScript's syntax for regular expression literals overloads the `/` character. To avoid ambiguity, `JSLint` expects that the character preceding a regular expression literal is a `(` or `=` or `:` or `,` character.

The ECMAScript specification requires that the `/` character within a regular expression literal be escaped.

## Undefined variables

In JavaScript, undefined variables are assumed to be implied global variables. JSLint provides an option for detecting these.

Use the `/*extern` ...`*/` declaration to indicate symbols which are defined in other modules. See Extern below.

## Constructors and `new`

Constructors are function which are designed to be used with the `new` prefix. The `new` prefix creates a new object based on the function's prototype, and binds that object to the function's implied `this` parameter. If you neglect to use the `new` prefix, no new object will be made and `this` will be bound to the global object. This is a serious mistake.

`JSLint` enforces the convention that constructor functions be given names with initial uppercase. `JSLint` does not expect to see a function invocation with an initial uppercase name unless it has the `new` prefix. `JSLint` does not expect to see the `new` prefix used with functions whose names do not start with initial uppercase.

`JSLint` does not expect to see the wrapper forms `new Number`, `new String`, `new Boolean`.

`JSLint` does not expect to see `new Object` (use `{}` instead).

`JSLint` does not expect to see `new Array` (use `[]` instead).

## Not Looked For

`JSLint` does not do flow analysis to determine that variables are assigned values before used. This is because variables are given a value (`undefined`) which is a reasonable default for many applications.

`JSLint` does not do any kind of global analysis. It does not attempt to determine that functions used with `new` are really constructors (except by enforcing capitalization conventions), or that method names are spelled correctly.

## HTML

`JSLint` is able to handle HTML text. It can inspect the JavaScript content contained within `<script>`...`</script>` tags. It also inspects the HTML content, looking for problems that are known to interfere with JavaScript:

- All tag names must be in lower case.
- All tags that can take a close tag (such as `</p>`) must have a close tag.
- All tags are correctly nested.
- Entities must be used for literal `'<'`.

`JSLint` is less anal than the sycophantic conformanity demanded by XHTML, but more strict than the popular browsers.

`JSLint` also checks for the occurence of`'</'` in string literals. You should always write`'<\/'` instead. The extra backslash is ignored by the JavaScript compiler but not by the HTML parser. Tricks like this should not be necessary, and yet they are.

There is an option that allows use of upper case tagnames.

## Report

If the source is as `JSLint` expects, it generates a function report. It lists for each function:

- The line number on which it starts.
- Its name. In the case of anonymous functions, `JSLint` will "guess" the name.
- The parameters (including `arguments` if used).
- The vars.
- The global vars. An unexpected item here can be an indication of an error.
- The labels.

These suffixes may appear in the report:

(closure) | The parameter or var is used by an inner function.
(outer) | The var is defined by an outer function.
(unused) | The var is defined but not used. This may be an indication of an error.
(?) | The global var is defined by default within a function. This may be an indication of an error. It can also be a normal occurrence because `JSLint` does not know about global vars or functions that are defined by the browser or by other files. Select the `Detect undefined variables` option to flag these as errors.

The report will also include a list of all of the member names that were used. There is a list of JSLint messages.

## External

You can include in your program a comment that lists the global functions and objects that your program depends on, but that are not defined in your program or script file. Including this information can improve the quality of the report that is generated.

An external declaration can look like this:

    /*extern getElementByClass, breakCycles, JSONRequest */

A global declaration starts with `/*extern`. Notice that there is no space before the `e`.

Select the `Assume a browser` option to predefine the standard global properties that are supplied by web browsers, such as `window` and `document` and `alert`. Select the `Assume Rhino` option to predefine the global properties provided by the Rhino environment. Select the `Assume a Yahoo Widget` option to predefine the global properties provided by the Yahoo! Widgets environment.

## Options

The implementation of `JSLint` accepts an option object which allows you to determine the subset of JavaScript that is acceptable to you. It is also possible to set those options within the source of a script.

An option specification can look like this:

    /*jslint nomen: true, evil: false */

An option specification starts with `/*jslint`. Notice that there is no space before the `j`. The specification contains a sequence of name value pairs, where the names are `JSLint` options, and the values are `true` or `false`. An option specification takes precedence over the option object.

These are the current options:

`adsafe` | `true` if ADSAFE rules should be enforced
`bitwise` | `true` if bitwise operators should not be allowed
`browser` | `true` if the standard browser globals should be predefined
`cap` | `true` if upper case HTML should be allowed
`debug` | `true` if debugger statements should be allowed
`eqeqeq` | `true` if === should be required
`evil` | `true` if eval should be allowed
`fragment` | `true` if HTML fragments should be allowed
`laxbreak` | `true` if line breaks should not be checked
`nomen` | `true` if names should be checked
`passfail` | `true` if the scan should stop on first error
`plusplus` | `true` if increment/decrement should not be allowed
`rhino` | `true` if the Rhino environment globals should be predefined
`undef` | `true` if undefined variables are errors
`white` | `true` if strict whitespace rules apply
`widget` | `true` if the Yahoo Widgets globals should be predefined

## Feedback

Please let me know if `JSLint` is useful for you. Is it too strict? Is there a check or a report that could speed up your debugging? douglas@crockford.com

I intend to continue to adapt `JSLint` based on your comments. Keep watching for improvements.

## Try it

Try it. Paste your script into the window and click the button. The analysis is done by a script running on your machine. Your script is not sent over the network.

It is also available as a Konfabulator widget. You can check a file by dragging it and dropping it on the widget. You can recheck the file by double-clicking the widget.

It is also available in a WSH Command Line version.

It is also available in a Rhino Command Line version.

## Implementation

`JSLint` uses a Pratt Parser (Top Down Operator Precedence). It is written in JavaScript. The full source code is available:

- `fulljslint.js`
- `rhino.js`
- `web.js`
- `wsh.js`