JEST：两台JavaScript发动机的N+1版本差动测试和规格
JEST: N+1-version Differential Testing of Both JavaScript Engines and Specification
摘要：
现代编程遵循持续集成（CI）和持续部署（CD）方法，而不是传统的瀑布模型。即使是现代程序设计语言的开发也使用CI/CD方法来快速提供新的语言功能并适应新的开发环境。与传统方法不同，在现代CI/CD方法中，语言规范不再是语言语义的预言机，因为规范及其实现可以共同进化。在这种情况下，规范和实现都可能有bug，保证它们的正确性是非常重要的。在本文中，我们提出了一种新的N+1版本差分测试来解决这个问题。与传统的差分测试不同，我们的方法包括三个步骤：1）根据给定的语言规范自动合成由语法和语义引导的程序，2）通过将断言注入到合成的程序以检查它们的最终程序状态来生成一致性测试，3）通过对多个实现执行一致性测试来检测规范和实现中的错误，以及4）使用统计信息定位规范上的错误。我们实现了我们的方法，通过JEST的JavaScript程序设计语言，它执行N+1版本的差异测试现代JavaScript引擎和ECMAScript，语言规范描述的语法和语义的自然语言的JavaScript。我们使用四个JavaScript引擎评估了JEST，这些引擎支持所有现代JavaScript语言功能和最新版本的ECMAScript（ES 11，2020）。JEST自动合成了1,700个程序，覆盖了ES 11的97.78%的语法和87.70%的语义。使用断言注入，它在四个引擎中检测到44个引擎错误，在ES 11中检测到27个规范错误。
英文摘要：
Modern programming follows the continuous integration (CI) and continuous deployment (CD) approach rather than the traditional waterfall model. Even the development of modern programming languages uses the CI/CD approach to swiftly provide new language features and to adapt to new development environments. Unlike in the conventional approach, in the modern CI/CD approach, a language specification is no more the oracle of the language semantics because both the specification and its implementations can co-evolve. In this setting, both the specification and implementations may have bugs, and guaranteeing their correctness is non-trivial. In this paper, we propose a novel N+1-version differential testing to resolve the problem. Unlike the traditional differential testing, our approach consists of three steps: 1) to automatically synthesize programs guided by the syntax and semantics from a given language specification, 2) to generate conformance tests by injecting assertions to the synthesized programs to check their final program states, 3) to detect bugs in the specification and implementations via executing the conformance tests on multiple implementations, and 4) to localize bugs on the specification using statistical information. We actualize our approach for the JavaScript programming language via JEST, which performs N+1-version differential testing for modern JavaScript engines and ECMAScript, the language specification describing the syntax and semantics of JavaScript in a natural language. We evaluated JEST with four JavaScript engines that support all modern JavaScript language features and the latest version of ECMAScript (ES11, 2020). JEST automatically synthesized 1,700 programs that covered 97.78% of syntax and 87.70% of semantics from ES11. Using the assertion-injection, it detected 44 engine bugs in four engines and 27 specification bugs in ES11.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
