Software in the wild exhibits various dynamic and nondeterministic behaviors, such as runtime invocation from dynamic language features and randomness from probabilistic algorithms. These behaviors complicate software testing because they require meaningful inputs for invocation, introduce additional branching decisions at runtime, and produce divergent outcomes for identical inputs.

To address these challenges, we propose an effective and efficient testing framework that leverages commonality analysis. This paper presents our preliminary research, which leverages input commonalities to explore dynamic behaviors in modern Java software, to demonstrate the utility of our framework. Specifically, we introduce SynToken, a two-fold testing tool that aims to improve (1) the reachability of runtime invocation sites and (2) testing efficiency. First, to address the challenge that existing string mutation operators cannot easily synthesize meaningful inputs for runtime invocation, SynToken constructs a token tree to prioritize tokens that are likely to be used for invocation based on common vocabularies such as prefixes or suffixes. Second, to address the challenge that branching decisions and execution paths are not deterministic, SynToken enhances traditional branch coverage guided fuzzing by monitoring invocation behaviors based on class hierarchies and call graphs.

We preliminarily evaluated SynToken on 71 open-source subjects. SynToken accelerated test generation by up to 10 × with tree-based input prioritization. The string substitution based input mutation enabled SynToken to generate all loadable targets within two minutes for each subject and replicated 280 injected bugs.

In the future, we plan to extend our test generation framework for dynamic behaviors to include nondeterministic behaviors. Nondeterminism often stems from probabilities and randomization, causing programs to branch into multiple outcomes despite identical inputs. We want to systematically explore as many of these outcomes as possible. Leveraging the insight from SynToken that there exist common patterns such as shared prefixes, we plan to define constraints to enable early termination when identical execution trace prefixes are detected, allowing us to improve testing efficiency while covering diverse execution paths.