  WebView is a UI widget that helps integrate web applications into the native
context of Android apps. It provides powerful mechanisms for bi-directional
interactions between the native-end (Java) and the web-end (JavaScript) of an
Android app. However, these interaction mechanisms are complicated and have
induced various types of bugs. To mitigate the problem, various techniques have
been proposed to detect WebView-induced bugs via dynamic analysis, which
heavily relies on executing tests to explore WebView behaviors. Unfortunately,
these techniques either require manual effort or adopt random test generation
approaches, which are not able to effectively explore diverse WebView
behaviors. In this paper, we study the problem of test generation for WebViews
in Android apps. Effective test generation for WebViews requires identifying
the essential program properties to be covered by the generated tests. To this
end, we propose WebView-specific properties to characterize WebView behaviors,
and devise a cross-language dynamic analysis method to identify these
properties. We develop $\omega$Test, a test generation technique that searches
for event sequences covering the identified WebView-specific properties. An
evaluation on 74 real-world open-/closed-source Android apps shows that
$\omega$Test can cover diverse WebView behaviors and detect WebView-induced
bugs effectively. $\omega$Test detected 36 previously-unknown bugs. From the 22
bugs that we have reported to the app developers, 13 bugs were confirmed, 9 of
which were fixed.
