Abstract
Dynamic symbolic execution has been shown to be an effective technique for automated test input generation. When applied to large-scale and complex programs, its scalability however is limited due to the combinatorial explosion of the path space. We propose to take advantage of data flow analysis to better perform dynamic symbolic execution in the context of generating test inputs for maximum structural coverage. In particular, we utilize the chaining mechanism to (1) extract precise guidance to direct dynamic symbolic execution towards exploring uncovered code elements and (2) meanwhile significantly optimize the path exploration process. Preliminary experiments conducted to evaluate the performance of the proposed approach have shown very encouraging results.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Aho, A.V., Lam, M.S., Sethi, R., Ullman, J.D.: Compilers: Principles, Techniques, and Tools, 2nd edn. Addison Wesley (2008)
Baluda, M., Braione, P., Denaro, G., Pezze, M.: Enhancing structural software coverage by incrementally computing branch executability. Software Quality Journal 19(4), 725–751 (2011)
Boyer, R.S., Elspas, B., Levitt, K.N.: SELECT–a formal system for testing and debugging programs by symbolic execution. In: Proceedings of the International Conference on Reliable Software, pp. 234–245. ACM, New York (1975)
Binkley, D.W., Harman, M., Lakhotia, K.: FlagRemover: a testability transformation for transforming loop-assigned flags. ACM Transactions on Software Engineering and Methodology 20(3) (2011)
Bird, D., Munoz, C.: Automatic generation of random self-checking test cases. IBM Systems Journal 22(3), 229–245 (1983)
British Standards Institute. BS 7925-1 Vocabulary of Terms in Software Testing (1998)
Burnim, J., Sen, K.: Heuristics for scalable dynamic test generation. In: Proceedings of the 23rd IEEE/ACM International Conference on Automated Software Engineering, pp. 443–446. IEEE Computer Society, Washington, DC (2008)
Cadar, C., Dunbar, D., Engler, D.: KLEE: Unassisted and automatic generation of high-coverage tests for complex systems programs. In: Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation. USENIX Association, Berkeley (2008)
Cadar, C., Godefroid, P., Khurshid, S., Păsăreanu, C.S., Sen, K., Tillmann, N., Visser, W.: Symbolic execution for software testing in practice: preliminary assessment. In: Proceedings of the 33rd International Conference on Software Engineering, pp. 1066–1071. ACM, New York (2011)
Clarke, L.A.: A system to generate test data and symbolically execute programs. IEEE Transactions on Software Engineering 2(3), 215–222 (1976)
Do, T.A., Fong, A.C.M., Pears, R.: Scalable automated test generation using coverage guidance and random search. In: Proceedings of the 7th International Workshop on Automation of Software Test, pp. 71–75 (2012)
Ferguson, R., Korel, B.: The chaining approach for software test data generation. ACM Transactions on Software Engineering and Methodology 5(1), 63–86 (1996)
Godefroid, P., Klarlund, N., Sen, K.: DART: directed automated random testing. In: Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 213–223. ACM, New York (2005)
Horwitz, S., Reps, T., Binkley, D.: Interprocedural slicing using dependence graphs. In: Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation, pp. 35–46. ACM, New York (1988)
King, J.C.: Symbolic execution and program testing. Communications of the ACM 19(7), 385–394 (1976)
McMinn, P.: Search-based software test data generation: a survey. Software Testing, Verification & Reliability 14(2), 105–156 (2004)
McMinn, P., Holcombe, M.: Evolutionary Testing Using an Extended Chaining Approach. Evolutionary Computation 14(1), 41–64 (2006)
Offut, J., Hayes, J.: A Semantic Model of Program Faults. In: Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 195–200. ACM, New York (1996)
Pacheco, C.: Directed Random Testing. PhDDissertation, MIT Department of Electrical Engineering and Computer Science, Cambridge, Massachusetts (2009)
RTCA, Inc.: Document RTCA/DO-178B. U.S. Department of Transportation, Federal Aviation Administration, Washington, D.C (1993)
Sen, K., Marinov, D., Agha, G.: CUTE: a concolic unit testing engine for C. In: ESEC/FSE-13, pp. 263–272. ACM, New York (2005)
Tillmann, N., de Halleux, J.: Pex–white box test generation for.NET. In: Beckert, B., Hähnle, R. (eds.) TAP 2008. LNCS, vol. 4966, pp. 134–153. Springer, Heidelberg (2008)
Visser, W., Păsăreanu, C.S., Khurshid, S.: Test input generation with Java PathFinder. In: Proceedings of the ACM SIGSOFT International Symposium on Software Testing and Analysis, pp. 97–107. ACM, New York (2004)
Weiser, M.: Program slicing. In: Proceedings of the 5th International Conference on Software Engineering, pp. 439–449. IEEE Press, Piscataway (1981)
Xie, T., Tillmann, N., Halleux, P.D., Schulte, W.: Fitness-guided path exploration in dynamic symbolic execution. In: Proceedings of the IEEE/IFIP International Conference on Dependable Systems and Networks, pp. 359–368 (2009)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Do, T., Fong, A.C.M., Pears, R. (2013). Dynamic Symbolic Execution Guided by Data Dependency Analysis for High Structural Coverage. In: Maciaszek, L.A., Filipe, J. (eds) Evaluation of Novel Approaches to Software Engineering. ENASE 2012. Communications in Computer and Information Science, vol 410. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-45422-6_1
Download citation
DOI: https://doi.org/10.1007/978-3-642-45422-6_1
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-45421-9
Online ISBN: 978-3-642-45422-6
eBook Packages: Computer ScienceComputer Science (R0)