Abstract
Concolic testing is an automated software testing method that combines concrete and symbolic execution to achieve high code coverage and expose bugs in the program under test. During an execution of the program, constraints over the input variables are collected. Then, by changing these constraints in a systematic manner and solving the thereby derived constraint systems, new inputs can be obtained that force the program to execute along yet undiscovered program paths. The performance of the constraint solving step is crucial for the scalability of such an approach. In this paper, we are specifically concerned with solving the constraint systems obtained when employing the concolic testing search strategy known as Generational Search. We implemented several methods for preprocessing and solving the systems using the SMT solvers MathSAT, STP, Yices, and Z3, and evaluated the methods and solvers on constraints generated by the concolic execution engine Crest.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
SMT-COMP (2012), http://smtcomp.sourceforge.net/2012 , (accessed January 31, 2013)
Burnim, J., Sen, K.: Heuristics for Scalable Dynamic Test Generation. In: Proceedings of the 23rd IEEE/ACM International Conference on Automated Software Engineering (ASE 2008), L’Aquila, Italy, September 15-19, pp. 443–446. IEEE (2008)
Cadar, C., Dunbar, D., Engler, D.R.: KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs. In: Draves, R., van Renesse, R. (eds.) Proceedings of the 8th USENIX Symposium on Operating Systems Design and Implementation, OSDI 2008, San Diego, California, USA, December 8-10, pp. 209–224. USENIX Association (2008)
Cadar, C., Ganesh, V., Pawlowski, P.M., Dill, D.L., Engler, D.R.: EXE: Automatically generating inputs of death. In: Juels, A., Wright, R.N., di Vimercati, S.D.C. (eds.) Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS 2006, Alexandria, VA, USA, October 30-November 3, pp. 322–335. ACM (2006)
Cadar, C., Godefroid, P., Khurshid, S., Pasareanu, C.S., Sen, K., Tillmann, N., Visser, W.: Symbolic execution for software testing in practice: preliminary assessment. In: Taylor, R.N., Gall, H., Medvidovic, N. (eds.) Proceedings of the 33rd International Conference on Software Engineering, ICSE 2011, Waikiki, Honolulu, HI, USA, May 21-28, pp. 1066–1071. ACM (2011)
Cormen, T.H., Leiserson, C.E., Rivest, R.L., Stein, C.: Introduction to Algorithms, 3rd edn. The MIT Press (2009)
de Moura, L., Bjørner, N.: Z3: An Efficient SMT Solver. In: Ramakrishnan, C.R., Rehof, J. (eds.) TACAS 2008. LNCS, vol. 4963, pp. 337–340. Springer, Heidelberg (2008)
Dutertre, B., De Moura, L.: The Yices SMT solver 2, 2 (2006), Tool paper at: http://yices.csl.sri.com/tool-paper.pdf
Ganesh, V., Dill, D.L.: A Decision Procedure for Bit-Vectors and Arrays. In: Damm, W., Hermanns, H. (eds.) CAV 2007. LNCS, vol. 4590, pp. 519–531. Springer, Heidelberg (2007)
Godefroid, P., Klarlund, N., Sen, K.: DART: Directed Automated Random Testing. In: Sarkar, V., Hall, M.W. (eds.) Proceedings of the ACM SIGPLAN 2005 Conference on Programming Language Design and Implementation, Chicago, IL, USA, June 12-15, pp. 213–223. ACM (2005)
Godefroid, P., Levin, M.Y., Molnar, D.A.: Automated Whitebox Fuzz Testing. In: Proceedings of the Network and Distributed System Security Symposium, NDSS 2008, San Diego, California, USA, February 10-13. The Internet Society (2008)
Griggio, A.: A Practical Approach to Satisability Modulo Linear Integer Arithmetic. JSAT 8(1/2), 1–27 (2012)
Holzer, A., Schallhart, C., Tautschnig, M., Veith, H.: Query-Driven Program Testing. In: Jones, N.D., Müller-Olm, M. (eds.) VMCAI 2009. LNCS, vol. 5403, pp. 151–166. Springer, Heidelberg (2009)
Pötzl, D.: Achieving High Coverage and Finding Bugs in Sequential and Concurrent Software. Master’s thesis, Vienna University of Technology (2012)
Sen, K., Marinov, D., Agha, G.: CUTE: A concolic unit testing engine for C. In: Wermelinger, M., Gall, H. (eds.) Proceedings of the 10th European Software Engineering Conference held jointly with 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering, Lisbon, Portugal, September 5-9, pp. 263–272. ACM (2005)
Williams, N., Marre, B., Mouy, P., Roger, M.: PathCrawler: Automatic Generation of Path Tests by Combining Static and Dynamic Analysis. In: Dal Cin, M., Kaâniche, M., Pataricza, A. (eds.) EDCC 2005. LNCS, vol. 3463, pp. 281–292. Springer, Heidelberg (2005)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2013 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Pötzl, D., Holzer, A. (2013). Solving Constraints for Generational Search. In: Veanes, M., Viganò, L. (eds) Tests and Proofs. TAP 2013. Lecture Notes in Computer Science, vol 7942. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-38916-0_12
Download citation
DOI: https://doi.org/10.1007/978-3-642-38916-0_12
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-38915-3
Online ISBN: 978-3-642-38916-0
eBook Packages: Computer ScienceComputer Science (R0)