Abstract:Data-flow testing (DFT) aims to detect potential data interaction anomalies by focusing on the points at which variables receive values and the points at which these values are used. Such test objectives are referred as \emph{def-use pairs}. However, the complexity of DFT still overwhelms the testers in practice. To tackle this problem, we introduce a hybrid testing framework for data-flow based test generation: (1) The core of our framework is symbolic execution (SE), enhanced by a novel guided path exploration strategy to improve testing performance; and (2) we systematically cast DFT as reachability checking in software model checking (SMC) to complement SE, yielding practical DFT that combines the two techniques' strengths. We implemented our framework for C programs on top of the state-of-the-art symbolic execution engine KLEE and instantiated with three different software model checkers. Our evaluation on the 28,354 def-use pairs collected from 33 open-source and industrial program subjects shows (1) our SE-based approach can improve DFT performance by 15$\sim$48% in terms of testing time, compared with existing search strategies; and (2) our combined approach can further reduce testing time by 20.1$\sim$93.6%, and improve data-flow coverage by 27.8$\sim$45.2% by eliminating infeasible test objectives. Compared with the SMC-based approach alone, our combined approach can also reduce testing time by 19.9$\sim$23.8%, and improve data-flow coverage by 7$\sim$10%. This combined approach also enables the cross-checking of each component for reliable and robust testing results. We have made our testing framework and benchmarks publicly available to facilitate future research.

Test Case Generation Assisted by Control Dependence Analysis

Effective code coverage in compositional systematic dynamic testing

A Test Case Auto Generation Algorithm Based On Sensitive Path Of Program With Taint Analysis And Symbolic Execution

State of the art: Dynamic symbolic execution for automated test generation

Directed test suite augmentation via exploiting program dependency.

AN AUTOMATIC GENERATION TOOL FOR UNIT TEST CASE BASED ON DYNAMIC SYMBOLIC EXECUTION

Automated Coverage-Driven Test Data Generation Using Dynamic Symbolic Execution

Assertion-Directed Test Case Generation

Test Data Generation for Derived Types in C Program

Guided test generation for coverage criteria

Reducing Test Cases with Causality Partitions.

Dependence Guided Symbolic Execution.

Dyta: Dynamic Symbolic Execution Guided With Static Verification Results

Effective Test Case Generation via Concolic Execution

JDart-Based Test Cases Generation and Optimization

A Multi-Layer Fault Triggering Framework Based on Evolutionary Strategy Guided Symbolic Execution for Automated Test Case Generation.

Atcase: An Automatic Generation Tool of Test Case for Numerical Program Based on Polynomial Constraint Solving

Test Case Generation for Embedded Software Using Interface Automata and Symbolic Execution

Leveraging Conditional Statement to Generate Acceptance Tests Automatically Via Traceable Sequence Generation

Towards Efficient Data-flow Test Data Generation

Selective Symbolization Based Efficient Symbolic Execution.