Strategies for scalable symbolic execution-driven test generation for programs

Abstract

With the advent of advanced program analysis and constraint solving techniques, several test generation tools use variants of symbolic execution. Symbolic techniques have been shown to be very effective in path-based test generation; however, they fail to scale to large programs due to the exponential number of paths to be explored. In this paper, we focus on tackling this path explosion problem and propose search strategies to achieve quick branch coverage under symbolic execution, while exploring only a fraction of paths in the program. We present a reachability-guided strategy that makes use of the reachability graph of the program to explore unvisited portions of the program and a conflict-driven backtracking strategy that utilizes conflict analysis to perform nonchronological backtracking. We present experimental evidence that these strategies can significantly reduce the search space and improve the speed of test generation for programs.

An Exploratory Survey of Hybrid Testing Techniques Involving Symbolic Execution and Fuzzing

“…in [20], the authors propose symbolic execution in binary programs when fuzzing cannot increase the coverage anymore, by focusing on uncovered paths during symbolic execution -which means that effectively only symbolic execution technique is modified, while fuzzing is used in its original form. Similar combinations exist in techniques such as [11,27].…”

An efficient method for detecting concurrency errors in object-oriented programs

“…Various studies have been conducted and are ongoing with respect to test case generation. Many works such as [25][26][27] focus on generating sequential test cases. In contrast, our method creates test cases for concurrent programs.…”