Feasible test path selection by principal slicing

IEEE Transactions on Software Engineering, 2016

Structural coverage metrics, and in particular branch coverage, are popular approaches to measure the thoroughness of test suites. Unfortunately, the presence of elements that are not executable in the program under test and the difficulty of generating test cases for rare conditions impact on the effectiveness of the coverage obtained with current approaches. In this paper, we propose a new approach that combines symbolic execution and symbolic reachability analysis to improve the effectiveness of branch testing. Our approach embraces the ideal definition of branch coverage as the percentage of executable branches traversed with the test suite, and proposes a new bidirectional symbolic analysis for both testing rare execution conditions and eliminating infeasible branches from the set of test objectives. The approach is centered on a model of the analyzed execution space. The model identifies the frontier between symbolic execution and symbolic reachability analysis, to guide the alternation and the progress of bidirectional analysis towards the coverage targets. The experimental results presented in the paper indicate that the proposed approach can both find test inputs that exercise rare execution conditions that are not identified with state-of-the-art approaches and eliminate many infeasible branches from the coverage measurement. It can thus produce a modified branch coverage metric that indicates the amount of feasible branches covered during testing, and helps team leaders and developers in estimating the amount of not-yet-covered feasible branches. The approach proposed in this paper suffers less than the other approaches from particular cases that may trap the analysis in unbounded loops.

2004

This paper 1 presents a new approach for automated test data generation of imperative programs containing integer, boolean and/or oat variables. A test program (with procedure calls) is represented by a n I nterprocedural Control Flow Graph (ICFG). The classical testing criteria (statement, branch, and path coverage), widely used in unit testing, are extended to the ICFG. Path coverage is the core of our approach. Given a speci ed path of the ICFG, a path constraint is derived and solved to obtain a test case. The constraint solving is carried out based on a consistency notion. For statement (and branch) coverage, paths reaching a speci ed node or branch are dynamically constructed. The search f o r suitable paths is guided by the interprocedural control dependences of the program. The search is also pruned by our consistency lter. Finally, test data are generated by the application of the proposed path coverage algorithm. The COTTAGE system, a 13,000 Java lines software, implements our approach for C programs. For each generated test data, the system also automatically generates an instrumented C program, allowing the user to verify the correctness of the test data. Experimental results, including complex numerical programs from 29], demonstrate the feasibility of the method and the e ciency of the COTTAGE system, as well as its versatility and exibility to di erent classes of problems (integer and/or oat variables arrays, procedures, path coverage, statement c o verage).

2015 2nd International Conference on Knowledge-Based Engineering and Innovation (KBEI), 2015

In this paper, we have developed an approach to generate test data for path coverage based testing. The main challenge of this kind testing lies in its ability to build efficiently such a test suite in order to minimize the number of rejects. We address this problem with a novel divide-and-conquer approach based on adaptive random testing strategy. Our approach takes as input the constraints of an executable path and computes a tight over-approximation of their associated sub-domain by using a dynamic domain partitioning approach. We implemented this approach and got experimental results that show the practical benefits compared to existing approaches. Our method generates less invalid inputs and is capable of obtaining the sub-domain of many complex constraints.

Proceedings of the 27th Annual ACM Symposium on Applied Computing - SAC '12, 2012

Recent research proposed efficient methods for software verification combining static and dynamic analysis, where static analysis reports possible runtime errors (some of which may be false alarms) and test generation confirms or rejects them. However, test generation may time out on real-sized programs before confirming some alarms as real bugs or rejecting some others as unreachable.

The main applications of program slicing include various software engineering activities such as program understanding, debugging, testing, program maintenance, complexity measurement and so on. Program slicing is a feasible method to restrict the focus of a task to specific subcomponents of a program. It can also be used to extract the statements of a program that are relevant to a given computation. Applying slicing technique to software architectures can benefit software development in two main ways. The first one concerns maintenance of a componentbased software. By using slicing tools on an architectural description, we can determine which components might be affected when a given component is modified. Second, architectural reuse can be facilitated. While reuse of code is important, reuse of software design and patterns are expected to offer greater productivity benefits and reliability enhancements.

1998

Software maintainers are faced with the task of regression testing: retesting a program after a modification. The goal of regression testing is to ensure that bug fixes and new functionality do not adversely affect the correct functionality inherited from the original program. Regression testing often involves running a large program on a large number of test cases; thus, it can be expensive in terms of both human and machine time. Many approaches for reducing the cost of regression testing have been proposed.

Software Practice and Experience, 1999

Test data generation is one of the most technically challenging steps of testing software, but most commercial systems currently incorporate very little automation for this step. This paper presents results from a project that is trying to find ways to incorporate test data generation into practical test processes. The results include a new procedure for automatically generating test data that incorporates ideas from symbolic evaluation, constraint-based testing, and dynamic test data generation. It takes an initial set of values for each input, and dynamically \pushes" the values through the control-flow graph of the program, modifying the sets of values as branches in the program are taken. The result is usually a set of values for each input parameter that has the property that any choice from the sets will cause the path to be traversed. This procedure uses new analysis techniques, offers improvements over previous research results in constraint-based testing, and combines several steps into one coherent process. The dynamic nature of this procedure yields several benefits. Moving through the control flow graph dynamically allows path constraints to be resolved immediately, which is more efficient both in space and time, and more often successful than constraint-based testing. This new procedure also incorporates an intelligent search technique based on bisection. The dynamic nature of this procedure also allows certain improvements to be made in the handling of arrays, loops, and expressions; language features that are traditionally difficult to handle in test data generation systems. The paper presents the test data generation procedure, examples to explain the working of the procedure, and results from a proof-of-concept implementation.

TURKISH JOURNAL OF ELECTRICAL ENGINEERING & COMPUTER SCIENCES

Path-oriented random testing aims at generating a uniformly distributed sequence of test data from a program input domain space to traverse a desired execution path of the program. To this aim, this article proposes a new algorithm to refine a program inputs domain space from invalid subdomains not covering the path. The validity of the subdomains is checked by a constraint propagation method against the path constraints (PCs). The proposed algorithm uses a divideand-conquer technique to iteratively split the inputs domain into subdomains and each time refutes those subdomains that are inconsistent with the PCs. The remaining shrunken subdomains provide all possible test data covering the desired path. Obviously, the more accurate the input domain is, the more effective test data will result. Experiments show the proposed method outperformed other related methods on a set of classical benchmark programs.

Proceedings. 19th International Conference on Automated Software Engineering, 2004., 2004

We propose a novel method, called PathCrawler, for the automatic generation of structural tests satisfying the all-paths criterion or its k-path variant. The source code is instrumented so as to recover the symbolic execution path each time that the program under test is executed. This code is first executed using inputs arbitrarily selected from the input domain. The resulting symbolic path is transformed into a path predicate by projection of the conditions onto the input variables. The next test is obtained by using constraint logic programming to find new input values outside the domain of the path which is already covered. The instrumented code is then executed on this test and so on, until all feasible paths have been covered. Our method combines static and dynamic analysis in a way that avoids the disadvantages of both. It is currently being implemented for the C language.

Scientific Programming, 2019

Program slicing is a technique to extract the part of a program (the slice) that influences or is influenced by a set of variables at a given point (the slicing criterion). Computing minimal slices is undecidable in the general case, and obtaining the minimal slice of a given program is normally computationally prohibitive even for very small programs. Therefore, no matter what program slicer we use, in general, we cannot be sure that our slices are minimal. This is probably the fundamental reason why no benchmark collection of minimal program slices exists. In this work, we present a method to automatically produce quasi-minimal slices. Using our method, we have produced a suite of quasi-minimal slices for Erlang that we have later manually proved they are minimal. We explain the process of constructing the suite, the methodology and tools that were used, and the results obtained. The suite comes with a collection of Erlang benchmarks together with different slicing criteria and th...