UninitializedPropertyAccessException: lateinit property mutator not initialized in MioAlgorithm when using --sqli true

[AnubhavDash]

Description: While performing black-box fuzzing on a large REST API (178 endpoints), EvoMaster version 5.0.2 crashed abruptly within the first 1% of the search budget. The crash is specific to the combination of the MIO algorithm and the experimental sqli security flag. It appears the search engine attempts to call getMutatator() on a sub-population before the initialization lifecycle has completed.

Environment (Host):

• OS: Linux DESKTOP-NBB6VS2 (WSL2 / Debian 13 Trixie)

• Kernel: 6.6.87.2-microsoft-standard-WSL2

• CPU: Intel(R) Core(TM) i3-1005G1 CPU @ 1.20GHz (4 cores / 2 per socket)

• RAM: 2.8Gi Total / ~260Mi Available at time of crash (High swap usage observed)

• Docker Version: 29.2.1, build a5c7197

• Node.js Version: v24.13.0 (Running SUT on host)

EvoMaster Configuration:

• Version: 5.0.2 (Docker Image: webfuzzing/evomaster:latest)

• Mode: Black-box

• Algorithm: MIO

• Flags: --sqli true, --security true, --generateMongoData true, --heuristicsForSQL true, --maxTestSize 20

• Command Used:

docker run --add-host=host.docker.internal:host-gateway \
  -v "$(pwd)/generated_tests":/generated_tests \
  -v "$(pwd)/swagger-json.json":/swagger-json.json \
  webfuzzing/evomaster \
  --blackBox true \
  --maxTime 24h \
  --prematureStop 2h \
  --bbSwaggerUrl file:///swagger-json.json \
  --bbTargetUrl http://host.docker.internal:3000 \
  --header0 "Authorization: Bearer <TOKEN>" \
  --outputFormat JS_JEST \
  --algorithm MIO \
  --generateMongoData true \
  --heuristicsForSQL true \
  --maxTestSize 20 \
  --security true \
  --sqli true

Steps to Reproduce:

1. Provide a large OpenAPI 3.0.0 schema (178 operations) containing DTOs with missing items attributes (e.g., KycLevelDto).

2. Run EvoMaster in Black-Box mode via Docker.

3. Configure the command to use --algorithm MIO and the experimental --sqli true flag.

4. Start the search and observe the crash shortly after initialization.

Stacktrace:

kotlin.UninitializedPropertyAccessException: lateinit property mutator has not been initialized

        at org.evomaster.core.search.service.SearchAlgorithm.getMutatator(SearchAlgorithm.kt:51)

        at org.evomaster.core.search.algorithms.MioAlgorithm.searchOnce(MioAlgorithm.kt:48)

        at org.evomaster.core.search.service.SearchAlgorithm.search(SearchAlgorithm.kt:77)

        at org.evomaster.core.Main$Companion.run(Main.kt:823)

        at org.evomaster.core.Main$Companion.runAndPostProcess(Main.kt:254

        at org.evomaster.core.Main$Companion.initAndRun(Main.kt:231)

        at org.evomaster.core.Main$Companion.main(Main.kt:135)

        at org.evomaster.core.Main.main(Main.kt)

Additional Context: The logs show several 401 Unauthorized warnings and schema validation errors attribute components.schemas.X.items is missing immediately before the crash. It seems the search algorithm attempts to access the mutator property during a searchOnce call before the lifecycle initialization has completed for the MIO sub-populations. Although the system had low free physical memory (78Mi), the presence of a 4Gi swap file and the specific Kotlin exception (lateinit error) strongly suggest a logic/lifecycle bug rather than a simple OOM.

[arcuri82]

Hi @AnubhavDash ,

thanks for taking the time to report this issue.

The problem is that the option --algorithm MIO is incompatible with --blackBox true.
We do have input validation, but not for all cases (like this one).
We need to fix it (ie, crash immediately with a meaningful error message to help users).

If you are a first time user of EvoMaster, it is strongly recommended to only use the options marked as Important Command-Line Options in the documentation.

If you remove --algorithm MIO, it should work. Also, it is not recommended to use experimental options such as --sqli true (you should have got a warning in the logs), as those might just be work-in-progress features, not stable yet for use.