Symbolic execution and automatic test case generation for JavaScript programs

摘要

A method includes, by one or more computing devices, determining JavaScript statements to be evaluated, parsing the JavaScript statements, translating the JavaScript statements into Java bytecodes and JavaScript-specific instructions, executing the Java bytecodes in a Java execution engine, calling a JavaScript run-time engine from the Java execution engine, handling one or more semantic operations associated with the JavaScript-specific instructions through use of the JavaScript run-time engine, and providing return values to the Java execution engine. The statements are configured for execution on a computing device. The set of Java bytecodes and JavaScript-specific instructions is configured to conduct symbolic execution of one or more portions of the JavaScript statements. The symbolic execution is configured to evaluate the JavaScript statements.

主权项

1. A method comprising, by one or more computing devices:
determining JavaScript statements to be evaluated, the JavaScript statements configured for execution on a computing device; parsing the JavaScript statements; translating the JavaScript statements into a set of Java bytecodes and JavaScript-specific instructions configured to conduct symbolic execution of one or more portions of the JavaScript statements; determining a document object model reference in the JavaScript statements; determining a set of instructions representing the document object model; modifying the set of instructions to include information from the document object model reference; executing the Java bytecodes in a Java execution engine; adding the modified set of instructions to the set of Java bytecodes and JavaScript-specific instructions upon access of the document object model reference by the Java execution engine; calling a JavaScript run-time engine from the Java execution engine; handling one or more semantic operations associated with the JavaScript-specific instructions through use of the JavaScript run-time engine; and providing return values to the Java execution engine; wherein the symbolic execution includes evaluating the JavaScript statements by maintaining a symbolic value of the translated JavaScript-specific instructions in the translated Java bytecodes while the JavaScript run-time engine handles semantic operations associated with the translated JavaScript specific instructions.