一句话：提出 Crabtree，结合覆盖与类型引导的合成与模糊测试，为 Rust 库 API 自动生成支持 trait 和高阶函数的测试用例。
Rust 的 unsafe 代码常被库封装并以高层 API 暴露，需要测试其因异常调用序列或输入触发的内存安全缺陷。已有自动测试方法难以处理多态、trait 和高阶函数，且可扩展性有限。Crabtree 将测试合成与模糊测试结合，通过覆盖率和类型引导的搜索算法，逐步增长测试程序与输入语料，从而覆盖更多代码，并能原生支持 Rust trait 与高阶函数，生成良类型的测试。在 30 个库上的评估发现四个此前未报告的内存安全缺陷，均被相应作者接受。
Rust type system constrains pointer operations, preventing bugs such as use-after-free. However, these constraints may be too strict for programming tasks such as implementing cyclic data structures. For such tasks, programmers can temporarily suspend checks using the unsafe keyword. Rust libraries wrap unsafe code blocks and expose higher-level APIs. They need to be extensively tested to uncover memory-safety bugs that can only be triggered by unexpected API call sequences or inputs. While prior works have attempted to automatically test Rust library APIs, they fail to test APIs with common Rust features, such as polymorphism, traits, and higher-order functions, or they have scalability issues and can only generate tests for a small number of combined APIs. We propose Crabtree, a testing tool for Rust library APIs that can automatically synthesize test cases with native support for Rust traits and higher-order functions. Our tool improves upon the test synthesis algorithms of prior works by combining synthesis and fuzzing through a coverage- and type-guided search algorithm that intelligently grows test programs and input corpus towards testing more code. To the best of our knowledge, our tool is the first to generate well-typed tests for libraries that make use of higher-order trait functions. Evaluation of Crabtree on 30 libraries found four previously unreported memory-safety bugs, all of which were accepted by the respective authors.
@article{TakashimaCM0P24,
title = {Crabtree: Rust API Test Synthesis Guided by Coverage and Type},
author = {Yoshiki Takashima and Chanhee Cho and Ruben Martins and Limin Jia and Corina S. Păsăreanu},
journal = {Proceedings of the ACM on Programming Languages},
volume = {8},
number = {OOPSLA2},
year = {2024},
doi = {10.1145/3689733}
}