一句话：提出 WebView 特有属性与跨语言动态分析方法，并据此生成覆盖多样化 WebView 行为的测试，发现 36 个新缺陷。
Android WebView 支持原生端（Java）与网页端（JavaScript）的双向交互，但这些交互机制复杂，容易引入各类缺陷。已有动态分析技术依赖执行测试来探索 WebView 行为，然而要么需要人工编写测试，要么采用随机测试生成，难以有效覆盖多样的 WebView 行为。本文研究 Android 应用 WebView 的测试生成问题，指出有效测试生成的关键在于识别生成测试所应覆盖的核心程序属性。为此，作者提出刻画 WebView 行为的 WebView 特有属性（properties），并设计跨语言动态分析方法来自动识别这些属性；进而实现测试生成技术 ωTest，通过搜索能够覆盖所识别属性的 Android UI 事件序列来生成测试。在 74 个真实开源与闭源 Android 应用上的评估表明，ωTest 能够覆盖多样的 WebView 行为并有效检测 WebView 引发的缺陷：共发现 36 个此前未知的缺陷，向开发者报告的 22 个中 13 个被确认，其中 9 个已修复。
WebView is a UI widget that helps integrate web applications into the native context of Android apps. It provides powerful mechanisms for bi-directional interactions between the native-end (Java) and the web-end (JavaScript) of an Android app. However, these interaction mechanisms are complicated and have induced various types of bugs. To mitigate the problem, various techniques have been proposed to detect WebView-induced bugs via dynamic analysis, which heavily relies on executing tests to explore WebView behaviors. Unfortunately, these techniques either require manual effort or adopt random test generation approaches, which are not able to effectively explore diverse WebView behaviors. In this paper, we study the problem of test generation for WebViews in Android apps. Effective test generation for WebViews requires identifying the essential program properties to be covered by the generated tests. To this end, we propose WebView-specific properties to characterize WebView behaviors, and devise a cross-language dynamic analysis method to identify these properties. We develop ωTest, a test generation technique that searches for event sequences covering the identified WebView-specific properties. An evaluation on 74 real-world open-/closed-source Android apps shows that ωTest can cover diverse WebView behaviors and detect WebView-induced bugs effectively. ωTest detected 36 previously-unknown bugs. From the 22 bugs that we have reported to the app developers, 13 bugs were confirmed, 9 of which were fixed.