A survey of new trends in symbolic execution for software testing and analysis

Abstract

Symbolic execution is a well-known program analysis technique which represents program inputs with symbolic values instead of concrete, initialized, data and executes the program by manipulating program expressions involving the symbolic values. Symbolic execution has been proposed over three decades ago but recently it has found renewed interest in the research community, due in part to the progress in decision procedures, availability of powerful computers and new algorithmic developments. We provide here a survey of some of the new research trends in symbolic execution, with particular emphasis on applications to test generation and program analysis. We first describe an approach that handles complex programming constructs such as input recursive data structures, arrays, as well as multithreading. Furthermore, we describe recent hybrid techniques that combine concrete and symbolic execution to overcome some of the inherent limitations of symbolic execution, such as handling native code or availability of decision procedures for the application domain. We follow with a discussion of techniques that can be used to limit the (possibly infinite) number of symbolic configurations that need to be analyzed for the symbolic execution of looping programs. Finally, we give a short survey of interesting new applications, such as predictive testing, invariant inference,

Goal-oriented dynamic test generation

“…A number of automated test input generation techniques have been extensively explored, developed, and applied in academia, research labs, and industry. These techniques include random testing [3], symbolic execution [112], dynamic symbolic execution [29], search-based testing [87], and the chaining approach [52]. Noticeably, recent years have the development of techniques that have been applied to test industrial-scale software systems and which have uncovered many serious subtle bugs and security vulnerability defects in the Windows [66] and Linux [93] operating systems, saving millions of dollars [15].…”

“…These techniques include random testing [3], symbolic execution [112], dynamic symbolic execution [26], [62], [124], search-based testing [87], and the chaining approach [52]. The theoretical foundation of dynamic symbolic execution and the chaining approach is separately presented in chapters 3 and 4, respectively.…”

“…Symbolic execution has a variety number of applications in program testing and analysis, for example automated test input generation [25], [112], test sequence generation [130], [140], proving program properties [13], [46], [53], [111], and static detection of runtime errors [18], [30], [36], [50], [127]. A well-known symbolic execution tool is Symbolic Java PathFinder (SPF) [6], [109], which is part of the JPF due to the combinatorial explosion problem of the program path space.…”

“…Testing automation can be enhanced by automating the process of generating test inputs. Over the last three decades, techniques have been proposed to achieve this goal, ranging from random testing [3], symbolic execution [112], dynamic symbolic execution [26], [62], [124], search-based testing [87], and the chaining approach [52].…”

Relational symbolic execution of SQL code for unit testing of database programs

“…While different approaches exist towards the automatic generation of test data, symbolic execution [5] has been recognised as a state-of-art technique for so-called white-box structural test data generation [6,7,8,9,10]. In such an approach, the idea is to generate test data that in some way cover a sufficiently large part of the control-flow graph of the code unit under test [4].…”