What we eval in the shadows: a large-scale study of eval in R programs

Abstract

Most dynamic languages allow users to turn text into code using various functions, often named <tt>eval</tt>, with language-dependent semantics. The widespread use of these reflective functions hinders static analysis and prevents compilers from performing optimizations. This paper aims to provide a better sense of why programmers use <tt>eval</tt>. Understanding why <tt>eval</tt> is used in practice is key to finding ways to mitigate its negative impact. We have reasons to believe that reflective feature usage is language and application domain-specific; we focus on data science code written in R and compare our results to previous work that analyzed web programming in JavaScript. We analyze 49,296,059 calls to <tt>eval</tt> from 240,327 scripts extracted from 15,401 R packages. We find that <tt>eval</tt> is indeed in widespread use; R’s <tt>eval</tt> is more pervasive and arguably dangerous than what was previously reported for JavaScript.