基于语法和类型变异的TypeScript编译器缺陷检测
CSTR:
作者:
作者单位:

作者简介:

通讯作者:

中图分类号:

TP311

基金项目:

国家自然科学基金(62132020, 62032004); 国家自然科学基金青年科学基金(62302077); 中央高校基本科研业务费专项资金(DUT24LAB126)


TypeScript Compiler Bug Detection Based on Syntax and Type Mutation
Author:
Affiliation:

Fund Project:

  • 摘要
  • |
  • 图/表
  • |
  • 访问统计
  • |
  • 参考文献
  • |
  • 相似文献
  • |
  • 引证文献
  • |
  • 资源附件
  • |
  • 文章评论
    摘要:

    TypeScript作为JavaScript的超集, 提供了静态类型支持和面向对象等多种特性, 被Angular、Vue、React等众多主流框架广泛采用, 成为构建大型应用的核心技术之一. 其编译器负责将TypeScript代码编译为标准的JavaScript代码. 然而, TypeScript编译器本身可能存在缺陷, 导致生成的JavaScript代码包含难以预料的错误. 尽管在JavaScript引擎测试方面已有诸多研究, 但尚未有针对TypeScript编译器的系统性测试研究. 现有的JavaScript引擎测试方法既难以生成大量包含TypeScript特定类型的程序, 也无法有效变异这些类型, 导致难以检测TypeScript编译器中与复杂类型系统相关的缺陷. 为此, 提出一种基于语法和类型变异的TypeScript编译器测试框架TscFuzz. 为了获取大量包含TypeScript特定类型的种子程序, TscFuzz针对TypeScript相较于JavaScript的特殊类型设计了一组提示词, 并引导大语言模型生成一系列包含特定类型的程序. 然后, 设计了一组类型特定的变异算子, 旨在通过类型变异对TypScript的类型系统进行针对性的测试. 最后, TscFuzz基于交叉版本策略的差分测试, 比较不同版本的TypeScript编译器的输出结果来检测其缺陷, 并通过Node.js验证编译器输出JavaScript程序的语义正确性. 实验结果显示, TscFuzz在72 h内发现了5个缺陷, 比基线方法DIE和FuzzJIT分别多检测了2个和3个bug. TscFuzz的故障检测效果显著优于基线方法. 同时, 经过3个月的测试, TscFuzz发现了12个真实的TypeScript缺陷, 其中8个已被开发者确认, 7个已被修复.

    Abstract:

    As a superset of JavaScript, TypeScript provides a rich set of features, such as static type support and object-oriented programming capabilities. It is widely adopted by many mainstream frameworks such as Angular, Vue, and React, and has become a core technology for building large-scale applications. Its compiler is responsible for compiling TypeScript codes into standard JavaScript codes. However, the TypeScript compiler itself may contain bugs, resulting in unexpected errors in the generated JavaScript code. Although numerous studies have been conducted on JavaScript engine testing, there has been no systematic study dedicated to testing the TypeScript compiler. Existing JavaScript engine testing methods have difficulty in generating a large number of TypeScript programs with specific types and effectively mutating these types, thus making it difficult to detect bugs related to complex type systems in the TypeScript compiler. To this end, a TypeScript compiler testing framework based on syntax and type mutation TscFuzz is proposed. To obtain a large number of seed programs containing specific types of TypeScript, TscFuzz designs a set of prompts tailored to the unique type system of TypeScript compared to JavaScript, with the large language model (LLM) guided to generate a series of programs featuring these specific types. Next, a set of type-specific mutation operators are designed to conduct targeted testing on the type system of TypeScript via type mutation. Finally, based on differential testing of the cross-version strategy, TscFuzz compares the outputs of different versions of the TypeScript compiler to detect bugs. Additionally, Node.js is employed to verify the semantic correctness of the JavaScript programs output by the compiler. Experimental results demonstrate that TscFuzz detects five bugs within 72 hours, two and three bugs more than the baseline methods DIE and FuzzJIT, respectively. The bug detection effect of TscFuzz is significantly better than that of the baseline methods. Meanwhile, after three months of testing, TscFuzz successfully identifies 12 real TypeScript bugs, eight of which have been confirmed and seven have been repaired.

    参考文献
    相似文献
    引证文献
引用本文

任志磊,高越,周志德,敖伟,江贺.基于语法和类型变异的TypeScript编译器缺陷检测.软件学报,,():1-21

复制
相关视频

分享
文章指标
  • 点击次数:
  • 下载次数:
  • HTML阅读次数:
  • 引用次数:
历史
  • 收稿日期:2025-05-13
  • 最后修改日期:2025-09-23
  • 录用日期:
  • 在线发布日期: 2026-02-04
  • 出版日期:
文章二维码
您是第位访问者
版权所有:中国科学院软件研究所 京ICP备05046678号-3
地址:北京市海淀区中关村南四街4号,邮政编码:100190
电话:010-62562563 传真:010-62562533 Email:jos@iscas.ac.cn
技术支持:北京勤云科技发展有限公司

京公网安备 11040202500063号