一句话：提出LLM辅助的WebAssembly运行时差分测试框架，用规范知识指导变异，覆盖解码、验证与执行三阶段。
WebAssembly（Wasm）运行时负责执行 Wasm 程序，其正确性对 Wasm 执行的功能与安全至关重要。然而现有 Wasm 测试框架难以生成同时有效测试解码、验证和执行三阶段的测试用例。本文提出 LWDIFF，一个面向 Wasm 运行时的差分测试框架：它利用大语言模型从 Wasm 语言规范中抽取被先前工作忽视的知识，并基于这些知识设计多种新型变异算子，生成具有多样特征、可覆盖三个运行时阶段的测试用例。作者将 LWDIFF 应用于八个 Wasm 运行时，并与当前最优测试器比较。结果表明，LWDIFF 获得最高分支覆盖率并发现最多缺陷，共在八个运行时中确认 31 个 bug，其中 25 个此前未被发现。
WebAssembly (Wasm) runtimes execute Wasm programs, a popular low-level language for efficiently executing high-level languages in browsers, with broad applications across diverse domains. The correctness of those runtimes is critical for both functionality and security of Wasm execution, motivating testing approaches that target Wasm runtimes specifically. However, existing Wasm testing frameworks fail to generate test cases that effectively test all three phases of runtime, i.e., decoding, validation, and execution. To address this research gap, we propose a new differential testing framework for Wasm runtimes, which leverages knowledge from the Wasm language specification that prior techniques overlooked, enhancing comprehensive testing of runtime functionality. Specifically, we first use a large language model to extract that knowledge from the specification. We use that knowledge in the context of multiple novel mutation operators that generate test cases with diverse features to test all three runtime phases. We evaluate LWDIFF by applying it to eight Wasm runtimes. Compared with the state-of-the-art Wasm testers, LWDIFF achieves the highest branch coverage and identifies the largest number of bugs. In total, LWDIFF discovers 31 bugs across eight runtimes, all of which are confirmed, with 25 of them previously undiscovered.
DOI 原文 ·
@inproceedings{paperbot8796,
title = {LWDIFF: an LLM-Assisted Differential Testing Framework for Webassembly Runtimes},
author = {Shiyao Zhou and Jincheng Wang and He Ye and Hao Zhou and Claire Le Goues and Xiapu Luo},
booktitle = {ICSE},
year = {2025},
doi = {10.1109/icse55347.2025.00233}
}