Abstract:As a superset of JavaScript, TypeScript provides a rich set of features, such as static type support and object-oriented programming capabilities. It is widely adopted by many mainstream frameworks such as Angular, Vue, and React, and has become a core technology for building large-scale applications. Its compiler is responsible for compiling TypeScript codes into standard JavaScript codes. However, the TypeScript compiler itself may contain bugs, resulting in unexpected errors in the generated JavaScript code. Although numerous studies have been conducted on JavaScript engine testing, there has been no systematic study dedicated to testing the TypeScript compiler. Existing JavaScript engine testing methods have difficulty in generating a large number of TypeScript programs with specific types and effectively mutating these types, thus making it difficult to detect bugs related to complex type systems in the TypeScript compiler. To this end, a TypeScript compiler testing framework based on syntax and type mutation TscFuzz is proposed. To obtain a large number of seed programs containing specific types of TypeScript, TscFuzz designs a set of prompts tailored to the unique type system of TypeScript compared to JavaScript, with the large language model (LLM) guided to generate a series of programs featuring these specific types. Next, a set of type-specific mutation operators are designed to conduct targeted testing on the type system of TypeScript via type mutation. Finally, based on differential testing of the cross-version strategy, TscFuzz compares the outputs of different versions of the TypeScript compiler to detect bugs. Additionally, Node.js is employed to verify the semantic correctness of the JavaScript programs output by the compiler. Experimental results demonstrate that TscFuzz detects five bugs within 72 hours, two and three bugs more than the baseline methods DIE and FuzzJIT, respectively. The bug detection effect of TscFuzz is significantly better than that of the baseline methods. Meanwhile, after three months of testing, TscFuzz successfully identifies 12 real TypeScript bugs, eight of which have been confirmed and seven have been repaired.