Interleaving static and dynamic analyses to generate path tests for C functions

1
Interleaving static and dynamic analyses
togenerate path tests for C functions

• Nicky Williams, Bruno Marre, Patricia Mouy

2
Objective

• automation of the test process for fast,
  rigorous, systematic testing of rapidly evolving
  software and a quantifiable increase in
  confidence
• test input generation must be automated
• and it is possible !

3
Structural test-case generation a new approach

• Others
• aim make generation more automatic
• criteria branch/user-defined
• coverage existing tests / spec. test-case
• gt test objective in CFG
• static
  dynamic
• symbolic execution execute
  case
• gt path predicate path covered
• constraint solving heuristical
  optimisation
• problems
• loops, alias number of
  executions
• complexity
  termination

• PathCrawler
• aim fully automatic
• criteria all-paths
• dynamic
• execute case
• path covered
• static
• gt path predicate
• rest input domain
• constraint solving
• combines the advantages of static and dynamic
  approaches

4
PathCrawler path-test generator

• Inputs source code and definition domain of
  program
• Output tests covering 100 feasible execution
  k-paths
• An original approach
• instead of CFG, iteratively construct execution
  path tree
• only analyse individual feasible (complete) paths
  with unrolled loops (can take aliases into
  account)
• use the structure of covered paths to search
  efficiently for the next test-case using
  constraint logic programming
• Application imperative languages, sequential
  software
• prototype for C
• status imprecision current treatment
  floats
• cast, union, not treated yet

5
PathCrawler input domains

D0 program definition domain
6
PathCrawler input domains

D0 program definition domain
case1
7
PathCrawler input domains

D0 program definition domain
case1
path1
D1
8
PathCrawler input domains

D0 program definition domain
case1
path1
case2
D1
9
PathCrawler input domains

D0 program definition domain
D2
path2
case1
path1
case2
D1
10
PathCrawler input domains

D0 program definition domain
D2
path2
case1
path1
case2
D1
case3
11
PathCrawler process

12
Future directions

• (PhD Patricia Mouy) making use of specifications
  to
• avoid combinatorial explosion due to function
  calls
• automatically generate an oracle if user cannot
  supply it
• structurally cover functional domains to detect
  missing paths
• Combining path testing and static analysis to
  measure Worst Case Execution Time
• Path testing of reactive systems
• Fault location from intersections of faulty paths
• Partial proof