Android apps are GUI-based event-driven software and have become ubiquitous in recent years. Obviously, functional correctness is critical for an app's success. However, in addition to crash bugs, non-crashing functional bugs (in short as "non-crashing bugs" in this work) like inadvertent function failures, silent user data lost and incorrect display information are prevalent, even in popular, well-tested apps. These non-crashing functional bugs are usually caused by program logic errors and manifest themselves on the graphic user interfaces (GUIs). In practice, such bugs pose significant challenges in effectively detecting them because (1) current practices heavily rely on expensive, small-scale manual validation (the lack of automation); and (2) modern fully automated testing has been limited to crash bugs (the lack of test oracles). This paper fills this gap by introducing independent view fuzzing, a novel, fully automated approach for detecting non-crashing functional bugs in Android apps. Inspired by metamorphic testing, our key insight is to leverage the commonly-held independent view property of Android apps to manufacture property-preserving mutant tests from a set of seed tests that validate certain app properties. The mutated tests help exercise the tested apps under additional, adverse conditions. Any property violations indicate likely functional bugs for further manual confirmation. We have realized our approach as an automated, end-to-end functional fuzzing tool, Genie. Given an app, (1) Genie automatically detects non-crashing bugs without requiring human-provided tests and oracles (thus fully automated); and (2) the detected non-crashing bugs are diverse (thus general and not limited to specific functional properties), which set Genie apart from prior work.
翻译:Android 应用程序是基于 GUI 的事件驱动软件, 近些年来这些非崩溃功能错误通常由程序逻辑错误造成, 并在图形用户界面( GUI ) 上表现出来。 在实践中, 功能正确性在有效检测这些错误方面构成了重大挑战, 因为(1) 目前的做法严重依赖昂贵的、小规模的手动验证( 缺乏自动化);(2) 现代完全自动测试仅限于崩溃错误( 缺乏测试或触摸器) 。 本文通过引入独立的观点模糊、 新型和完全自动化的方法来填补这一空白( 检测安集成软件中的非崩溃功能错误 ) 。 ( ) 由程序逻辑错误和图形用户界面( GUIs ) 显示自己。 实际上, 这些错误在有效检测它们方面构成了巨大的挑战, 因为(1) 目前的做法严重依赖昂贵的、小规模的手动验证( 缺乏自动化); (2) 现代的完全自动测试限于崩溃错误( 缺乏测试任何工具) 。