Rust is an emerging systems programming language that aims to reduce the trade-off between safety and performance with a type system that constrains pointer operations, preventing bugs such as use-after-free. However, these constraints may be too strict for programming tasks such as implementing cyclic data structures, requiring the programmer to temporarily suspend the checks using the unsafe keyword. Rust libraries wrap unsafe code blocks and expose higher-level APIs; these APIs need to be extensively tested to prevent memory-safety bugs from being induced by unexpected API call sequences or inputs. While prior works have attempted to test Rust APIs, significant challenges remain: they fail to support common Rust features, such as polymorphism, traits, and higher-order functions, or require the analyst to pick a smaller subset of APIs.

We propose Crabtree, a testing tool for Rust APIs that employs automatic library test synthesis that natively supports Rust traits. Our tool improves upon the test synthesis algorithms of prior works by combining synthesis and fuzzing through a coverage-guided search algorithm that intelligently grows test programs and input corpus towards higher coverage. To the best of our knowledge, our tool is the first to generate well-typed tests for libraries that make use of higher-order trait functions. Evaluation of Crabtree on 30 libraries found four memory-safety bugs, all of which were accepted by the respective authors.