Multi-agent Assisted Automatic Test Generation for Java JSON Libraries

TL;DR

This paper introduces JsonATG, a multi-agent automatic test generation system tailored for Java JSON libraries, leveraging historical bug data and specialized mutation rules to improve bug detection and code coverage.

Contribution

The paper presents a novel multi-agent ATG system that enhances test generation for Java JSON libraries by incorporating domain-specific mutation rules and bug information.

Findings

JsonATG achieves higher coverage than state-of-the-art LLM-based methods.

Reported 59 bugs in fastjson with a $25 budget, 47 confirmed, 28 fixed.

Generated tests found critical functional bugs and improved quality assurance.

Abstract

JSON is a widely used format for data exchange between applications. In the Java ecosystem, JSON libraries serve as fundamental toolkits for processing JSON data, powering real-world applications such as web services, Android apps, or data management systems. However, without effective quality assurance methods such as automatic test generation (ATG), developers risk introducing subtle data inconsistency bugs, compatibility issues, and even security vulnerabilities. These flaws can affect billions of end users and potentially cause severe financial losses. Recently, large language models (LLMs) have shown strong potential in enhancing ATG. However, existing LLM-based methods like TitanFuzz and YanHui lack specialization in the JSON domain. For Java JSON libraries (JJLs), effective test cases should capture the constraints between formatted data and application programs, leaving critical aspects of quality assurance unaddressed. To fill this gap, we propose JsonATG, a multi-agent ATG system that generates diverse bug-triggering tests for JJLs. With historical bug information as seeds, JsonATG introduces a code summarization agent and a test validation agent into the generation pipeline to produce new and valid test cases. It applies agent-generated program mutation rules tailored specifically for the structural and semantic characteristics of JJLs, such as data streaming operations, serialization formats, and data-binding patterns. The generated tests are further refined through post-processing to ensure syntactic and semantic correctness. Our experiments show that JsonATG achieves higher coverage than two state-of-the-art LLM-based test generation methods on the widely used JSON library. With a \$25 budget, we reported 59 bugs (including non-crashing functional bugs) in fastjson, of which 47 were confirmed and 28 have already been fixed.