1

Type Sensitive Application of Mutation Operators for Dynamically

Typed Programs

Leonardo BottaciDepartment of Computer ScienceUniversity of Hull, Hull, UK

2

Mutation of Strongly typed Programs

• Variables and operators in expressions are typed.

• Mutation operators can be applied in a type sensitive manner.

original program mutant program

String s; String s

int i, j; int i, j;

… …

i abs(i), … j

3

Mutation of Weakly Typed Programs

• Variables and operators in expressions are not typed.

• How can mutation operators can be applied in a type sensitive manner?

original program mutant program

var s; var s

var i, j; var i, j;

… …

i abs(i), abs(s) … j… s

4

Basic Idea• Generate mutants dynamically.• Represent mutants of the original

program using a meta-mutant, (mutant schemata, parameterised mutant.)

orig program meta-mutant x = y + z; assign(m(x), arith(m(y), m(z)))

m(x) mutates variable x, e.g. abs(x) , y

arith(y, z) mutates arithmetic operator, e.g. z - y

assign(x, e) mutates assign operator, e.g. x += e, x -= e

5

Meta-mutant for Strongly Typed Program

m(x) { switch(mutantOfx) { none: return x; abs: return abs(x); inc: return x + 1; y: return y; … }}

x is known to be of type int, say, this allowscases to be determined at meta-mutant

generation time.

6

Meta-mutant for Weakly Typed Program

m(x) {

if (none) {

return x;

}

else {

determine, from the value of x, the appropriate mutants

update mutants in mutant table for x

set nextMutant in table

return mutantTable[nextMutant]

}}

7

Object Value Mutations• In JavaScript, members of object are

dynamic.

x = {student: {name: "John", number: "0232"}, grade: 45};

x.student.name = "Jane";

• Mutate the terminal or leaf properties only.– Property deletion, property value

mutation.• Again, discover these properties at

mutant execution time.

8

Variable Replacement Mutations

• To replace variable x with variable y, they should hold values of compatible type.

• m(x) can determine the type of x only.• Hence perform mutation in two phases

– Value mutation phase, e.g. return abs(x)

• Record types of all variables in this phase

– Replacement mutation phase, e.g. return y

• Use types recorded in value mutation phase

9

Summary

• Weakly typed languages are popular, especially for web programming, (e.g. JavaScript).

• In such languages, type errors are not caught by the compiler and so additional testing is required.

• Investigate advantages and disadvantages of mutation testing for weakly typed languages.

• A prototype tool has been developed for mutating JavaScript programs.

10

Issues

• JavaScript programs make use large objects created outside of the program, e.g. browser document objects, - to what extent should these be mutated?

• The JavaScript execution environments, language implementations, vary – good source for mutations.

• How weakly typed are programs in practice?