Your browser does not support JavaScript!
http://iet.metastore.ingenta.com
1887

Lazy symbolic execution for test data generation

Lazy symbolic execution for test data generation

For access to this article, please select a purchase option:

Buy article PDF
£12.50
(plus tax if applicable)
Add to cart
Buy Knowledge Pack
10 articles for £75.00
(plus taxes if applicable)
Add to cart

IET members benefit from discounts to all IET publications and free access to E&T Magazine. If you are an IET member, log in to your account and the discounts will automatically be applied.

Learn more about IET membership 

Recommend Title Publication to library

You must fill out fields marked with: *

Librarian details
Name:*
Email:*
Your details
Name:*
Email:*
Department:*
Why are you recommending this title?
Select reason:
 
 
 
 
 
IET Software — Recommend this title to your library

Thank you

Your recommendation has been sent to your librarian.

  • Author(s): M.X. Lin 1, 2 ; Y.L. Chen 1, 3 ; K. Yu 1, 3 ; G.S. Wu 4
    • View affiliations
    • Affiliations: 1: State Key Laboratory of Software Development Environment, Beihang University, People's Republic of China
      2: School of Mechanical Engineering and Automation, Beihang University, People's Republic of China
      3: School of Computer Science and Engineering, Beihang University, People's Republic of China
      4: School of Software Engineering, Beijing University of Posts and Telecommunications, People's Republic of China
  • Source: Volume 5, Issue 2, April 2011, p. 132 – 141
    DOI:  10.1049/iet-sen.2010.0029 , Print ISSN 1751-8806, Online ISSN 1751-8814
© The Institution of Engineering and Technology
Published

In the context of test data generation, symbolic execution gets more attention as computing power increases continuously. Experiments show that test generation tools based on symbolic execution can get high coverage and find bugs on real applications. However, symbolic execution still has limitations in handling some complex program structures such as pointers, arrays and library functions. To address the problem, this study proposes a technique called lazy symbolic execution, which combines symbolic execution with a lazy evaluation strategy. The authors approach is motivated by the observation that some program structures can be reasoned about symbolically and the others have to be evaluated concretely. Traditional symbolic execution can cope with the former well, whereas lazy symbolic evaluation is used to handle the latter. However, lazy symbolic evaluation introduces intermediate variables into path constraints. To eliminate those variables, concrete values for some input variables are first obtained by constraint solving or searching processes. Then, the given path is executed again using inputs consisting of concrete and symbolic values. The procedure is repeated until all intermediate variables are wiped out. The authors have implemented a prototype tool and performed some experiments. The empirical results show the effectiveness of their approach.

Inspec keywords: formal verification; program testing

Other keywords: lazy symbolic execution; complex program structure; test data generation

Subjects: Formal methods; Diagnostic, testing, debugging and evaluating systems

References

    1. 1)
      • N.D. Jones , C.K. Gomard , P. Sestoft . (1993) Partial evaluation and automatic program generation.
    2. 2)
    3. 3)
    4. 4)
      • Khurshid, S., Pasareanu, C.S., Visser, W.: `Generalized symbolic execution for model checking and testing', Proc. Ninth Int. Conf. on Tools and Algorithms for the Construction and Analysis of Systems, Berlin, 2003, (LNCS, 2619), p. 553–568.
    5. 5)
      • Elkarablieh, B., Godefroid, P., Levin, M.Y.: `Precise pointer reasoning for dynamic test generation', Proc. 18th Int. Symp. on Software Testing and Analysis, ISSTA ’09, 2009, New York, NY, USA, p. 129–140.
    6. 6)
      • Khurshid, S., Suen, Y.L.: `Generalizing symbolic execution to library classes', Proc. Sixth ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools and Engineering, 2005, New York, NY, USA, p. 103–110.
    7. 7)
      • Godefroid, P.: `Compositional dynamic test generation', Proc. 34th Annual ACM SIGPLAN-SIGACT Symp. on Principles of Programming Languages, 2007, New York, NY, USA, p. 47–54.
    8. 8)
    9. 9)
    10. 10)
      • Xie, T., Tillmann, N., de Halleux, P., Schulte, W.: `Fitness-guided path exploration in dynamic symbolic execution', MSR-TR-2008-123, Technical report, September 2008.
    11. 11)
    12. 12)
      • Anand, S., Pasareanu, C.S., Visser, W.: `Symbolic execution with abstract subsumption checking', Proc. 13th Int. SPIN Workshop on Model Checking of Software, Berlin, 2006, (LNCS, 3925), p. 163–181.
    13. 13)
      • Kannan, Y., Sen, K.: `Universal symbolic execution and its application to likely data structure invariant generation', Proc. 2008 Int. Symp. on Software Testing and Analysis, 2008, New York, NY, USA, p. 283–294.
    14. 14)
      • Hedley, D., Hennell, M.A.: `The causes and effects of infeasible paths in computer programs', Proc. Eighth Int. Conf. on Software Engineering, ICSE ’85, 1985, Los Alamitos, CA, USA, p. 259–266.
    15. 15)
    16. 16)
      • Cadar, C., Dunbar, D., Engler, D.R.: `KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs', Proc. Eighth USENIX Symp. on Operating Systems Design and Implementation, OSDI 2008, 8–10 December 2008, San Diego, California, USA, p. 209–224.
    17. 17)
      • Edvardsson, J.: `A survey on automatic test data generation', Proc. Second Conf. on Computer Science and Engineering, 1999, p. 21–28.
    18. 18)
      • http://lpsolve.sourceforge.net/5.5/.
    19. 19)
    20. 20)
      • Gupta, N., Mathur, A.P., Soffa, M.L.: `Automated test data generation using an iterative relaxation method', Proc. Sixth Int. Symp. on Foundations of Software Engineering, 1998, New York, NY, USA, p. 231–244.
    21. 21)
      • Majumdar, R., Sen, K.: `Hybrid concolic testing', Proc. Twenty ninth Int. Conf. on Software Engineering, IEEE Computer Society, 2007, Washington, DC, USA, p. 416–426.
    22. 22)
      • Zhang, J.: `Specification analysis and test data generation by solving boolean combinations of numeric constraints', Proc. First Asia-Pacific Conf. on Quality Software, IEEE Computer Society, 2000, p. 267–274.
    23. 23)
      • Cadar, C., Engler, D.R.: `Execution generated test cases: how to make systems code crash itself', Proc. 12th Int. SPIN Workshop on Model Checking of Software, 2005, Berlin, p. 2–23, (LNCS, 3639).
    24. 24)
      • McMinn, P., Holcombe, M.: `The state problem for evolutionary testing', Proc. Genetic and Evolutionary Computation Conf. Berlin, 2003, (LNCS, 2724), p. 2488–2498.
    25. 25)
    26. 26)
    27. 27)
    28. 28)
    29. 29)
      • Godefroid, P., Klarlund, N., Sen, K.: `Dart: directed automated random testing', Proc. 2005 ACM SIGPLAN Conf. on Programming Language Design and Implementation, 2005, New York, NY, USA, p. 213–223.
http://iet.metastore.ingenta.com/content/journals/10.1049/iet-sen.2010.0029
Loading

Related content

content/journals/10.1049/iet-sen.2010.0029
pub_keyword,iet_inspecKeyword,pub_concept
6
6
Loading
Print this page
This is a required field
Please enter a valid email address