Abstract:The process of achieving high structural coverage of the pro- gram under test can be automated using Dynamic Sym- bolic Execution (DSE), which generates test inputs to it- eratively explore paths of the program under test. When applied on real-world applications, DSE faces various chal- lenges in generating test inputs to achieve high structural coverage. Among issues related to these challenges, our preliminary study identified two main types of issues: (1) object-creation issues (OCI), where DSE fails to generate method-call sequences to produce desirable object states; (2) external-method-call issues (EMCI), where symbolic val- ues are passed as arguments to third-party library methods that are not instrumented by DSE. Automatically solving these two main types of issues is challenging, since the explo- ration space of generating method-call sequences for desir- able object states is usually too huge, and instrumenting all third-party libraries can cause explosion of the exploration space. However, when provided with informative informa- tion of issues, users can effectively assist DSE to achieve high structural coverage. In this paper, we propose a gen- eral approach, called Covana, to identify issues faced by DSE via analyzing runtime information, and filter out irrelevant issues using residual structural coverage. We provide two techniques to instantiate our general approach to identify OCIs and EMCIs. To show the effectiveness of Covana, we conduct evaluations on two open source projects. Our re- sults show that Covana effectively identifies 155 OCIs, and 43 EMCIs. Moreover, Covana effectively reduces 296 irrel- evant issues out of 451 OCIs and 1567 irrelevant issues out of 1610 EMCIs produced by a straightforward approach.

Visualizing Path Exploration to Assist Problem Diagnosis for Structural Test Generation

Effective code coverage in compositional systematic dynamic testing

Fitness-guided Path Exploration in Dynamic Symbolic Execution

Engineering Seminar ( WiSe 2020 / 21 ) Search Strategies in Concolic Testing Description

Dependence Guided Symbolic Execution.

Steering Symbolic Execution to Less Traveled Paths

Characteristic Studies of Loop Problems for Structural Test Generation Via Symbolic Execution

Guided path exploration for regression test generation

Halleux. Issue analysis for residual structural coverage in dynamic symbolic execution

Multi-Pass Targeted Dynamic Symbolic Execution

Design and Implementation of a Dynamic Symbolic Execution Tool for Windows Executables.

Precise Identification Of Problems For Structural Test Generation

Directed test suite augmentation via exploiting program dependency.

Loop Transparency for Scalable Dynamic Symbolic Execution

Dyta: Dynamic Symbolic Execution Guided With Static Verification Results

Towards Symbolic Pointers Reasoning in Dynamic Symbolic Execution

Database state generation via dynamic symbolic execution for coverage criteria.

Covana: Precise Identification Of Problems In Pex

Guided Test Generation for Database Applications Via Synthesized Database Interactions.

Dynamic Symbolic Execution Method Oriented to Critical Operation

Targeted Control-flow Transformations for Mitigating Path Explosion in Dynamic Symbolic Execution