TypeScript Compiler Bug Detection Based on Syntax and Type Mutation
Author:
Affiliation:

Clc Number:

TP311

Fund Project:

  • Article
  • |
  • Figures
  • |
  • Metrics
  • |
  • Reference
  • |
  • Related
  • |
  • Cited by
  • |
  • Materials
  • |
  • Comments
    Abstract:

    As a superset of JavaScript, TypeScript provides a rich set of features, such as static type support and object-oriented programming capabilities. It is widely adopted by many mainstream frameworks such as Angular, Vue, and React, and has become a core technology for building large-scale applications. Its compiler is responsible for compiling TypeScript codes into standard JavaScript codes. However, the TypeScript compiler itself may contain bugs, resulting in unexpected errors in the generated JavaScript code. Although numerous studies have been conducted on JavaScript engine testing, there has been no systematic study dedicated to testing the TypeScript compiler. Existing JavaScript engine testing methods have difficulty in generating a large number of TypeScript programs with specific types and effectively mutating these types, thus making it difficult to detect bugs related to complex type systems in the TypeScript compiler. To this end, a TypeScript compiler testing framework based on syntax and type mutation TscFuzz is proposed. To obtain a large number of seed programs containing specific types of TypeScript, TscFuzz designs a set of prompts tailored to the unique type system of TypeScript compared to JavaScript, with the large language model (LLM) guided to generate a series of programs featuring these specific types. Next, a set of type-specific mutation operators are designed to conduct targeted testing on the type system of TypeScript via type mutation. Finally, based on differential testing of the cross-version strategy, TscFuzz compares the outputs of different versions of the TypeScript compiler to detect bugs. Additionally, Node.js is employed to verify the semantic correctness of the JavaScript programs output by the compiler. Experimental results demonstrate that TscFuzz detects five bugs within 72 hours, two and three bugs more than the baseline methods DIE and FuzzJIT, respectively. The bug detection effect of TscFuzz is significantly better than that of the baseline methods. Meanwhile, after three months of testing, TscFuzz successfully identifies 12 real TypeScript bugs, eight of which have been confirmed and seven have been repaired.

    Reference
    Related
    Cited by
Get Citation

任志磊,高越,周志德,敖伟,江贺.基于语法和类型变异的TypeScript编译器缺陷检测.软件学报,,():1-21

Copy
Share
Article Metrics
  • Abstract:
  • PDF:
  • HTML:
  • Cited by:
History
  • Received:May 13,2025
  • Revised:September 23,2025
  • Adopted:
  • Online: February 04,2026
  • Published:
You are the firstVisitors
Copyright: Institute of Software, Chinese Academy of Sciences Beijing ICP No. 05046678-4
Address:4# South Fourth Street, Zhong Guan Cun, Beijing 100190,Postal Code:100190
Phone:010-62562563 Fax:010-62562533 Email:jos@iscas.ac.cn
Technical Support:Beijing Qinyun Technology Development Co., Ltd.

Beijing Public Network Security No. 11040202500063