一句话:将变异建模为 AST 上受种子控制的游走,生成组合式变异序列,以暴露深层语义漂移。
现有变异测试引擎通常穷举应用变异算子来注入故障,这造成一个隐性盲点:琐碎的语法改动与复杂的语义漂移被同等对待,既浪费计算资源在易捕获问题上,也难以评估测试套件能否发现真正危险的细微缺陷。本文提出 Argus,在穷举式语法扰动之外引入有意的语义探索。其核心创新是把变异建模为受种子控制的 AST 位置游走,从而生成组合式变异序列(即由相互依赖的编辑构成的结构化链或树),模拟复杂回归而非孤立的琐碎变化。Argus 通过三个机制实现该思路:(1) 由语法覆盖与语义属性共同引导变异;(2) 依赖感知地导向关键 API;(3) 提供交互式查看器展示逐步轨迹与变异路径。由此开发者可解释并复现复杂变异路径,获得对测试套件检测深层语义漂移能力的透明评估。
Mutation testing evaluates test suite quality by injecting intentional faults into source code to verify if tests detect them. Existing engines typically generate mutants by exhaustively applying mutation operators. This creates an implicit blind spot where trivial syntax changes and complex semantic drifts are treated as equally significant. This lack of prioritization wastes computational resources on "easy-to-catch" issues. As a result, the assessment often fails to show whether the test suite is actually capable of catching the most dangerous, subtle bugs that actually matter. We present Argus, a mutation engine that enhances exhaustive syntactic perturbation with intentional semantic exploration. Our key innovation is modeling mutation as a seed-controlled walk over AST locations, enabling the generation of compositional mutation sequences (i.e., structured chains or trees of dependent edits) that simulate complex regressions rather than isolated, trivial shifts. Argus implements this through three core mechanisms: (1) mutations guided by syntax coverage and semantic properties in tandem, (2) dependency-aware steering toward critical APIs, and (3) an interactive viewer for step-wise traces and mutation trajectories. By allowing developers to interpret and reproduce complex mutation paths, Argus provides a transparent assessment of a test suite's capability to detect deep semantic drifts that existing tools overlook.