ASTReNet Workshop

1
ASTReNet Workshop

• Automated Test Data Generation
• Bogdan Korel
• Department of Computer Science
• Illinois Institute of Technology
• Chicago, IL USA

2
Summary

• Introduction to test data generation
• Application of test data generation
• Test data generation methods
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach
• Data dependence oriented test generation
• Conclusions

3
Test Data Generation Problem

• Given a target
• Goal find a program input on which the target
  is executed

4
Application of Test Data Generation

• Code-based (white-box) testing
• Identification of program properties
• Specification-based testing
• Testing specification conformance

5
Application of Test Data Generation

• Code-based (white-box) testing
• There exists many code-based testing coverage
  techniques
• Statement testing
• Branch testing
• Path testing
• Data flow testing
• Multiple-condition testing
• .

6
Application of Test Data Generation

• Testers are interested in finding program inputs
  to execute never-executed elements, e.g.,
• Statements
• Branches
• Paths
• Data flows
• Multiple-conditions
• .

7
Test Data Generation Problem
Find input x on which the target statement is
executed!!
program
Target statement
8
Application of Test Data Generation

• Identification of program properties
• Programmers may be interested in program
  properties inside or outside of the program
• These properties are expressed as assertions that
  describe relationships between program variables.
• Assertion (max lt min)

9
Application of Test Data Generation
Find input x on which Assertion A is satisfied!!
program
Assertion A
10
Application of Test Data Generation

• Specification-based testing
• Equivalence class partitioning
• Input equivalence partitioning
• Output equivalence partitioning

11
Application of Test Data Generation

• Specification-based testing
• Equivalence class partitioning
• Input equivalence partitioning
• Output equivalence partitioning

12
Application of Test Data Generation
Find input x on which y101
program
Test y101
output y
13
Test Data Generation Problem

• Given a target
• Goal find a program input on which the target
  is executed

14
Target

• A statement
• A branch
• A path
• A data flow
• A multiple condition
• An assertion
• A specific output value

15
Automated Test Data Generation

• It may be very hard to find manually program
  inputs to execute the target
• We are interested in automated test data
  generation

16
Test data generators

• Test generators can automatically find program
  inputs (test data) on which the target is
  executed
• A test case generator automatically generates
  test data from
• Source code
• Specification

17
Test Data Generators

• Two types of test generators
• Code-based test generators
• Specification-based test generators

18
Test Data Generators

• Two types of test generators
• Code-based test generators
• Specification-based test generators

19
Classical Test Data Generation Problem

• Given a target statement
• Goal find a program input on which the target
  statement is executed

20
Test Data Generation Problem
Find input x on which the target statement is
executed!!
program
Target statement
21
Automated Test Data Generation

• The problem of finding such input is an
  un-decidable problem
• It is not possible to design an algorithm that
  can solve the test generation problem for any
  program.
• It is not possible to build a Test Generator that
  can find a program input on which a target is
  executed for any program.

22
Automated Test Data Generation

• All test generation algorithms are heuristic
  algorithms
• They can frequently generate test data for which
  a selected target is executed,
• but
• These algorithms cannot guarantee to generate an
  input (test) to execute a selected target for any
  program.

23
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

24
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

25
Random Test Generation

• Test data (inputs) are generated randomly

26
Random Test Generation
Find input x on which the target statement is
executed!!
Target statement
27
Random Test Generation
execute program on any input
Randomly generated inputs
28
Random Test Generation

• Advantages
• The approach is easy to develop for any program
• Major failures may be detected (e.g., crashes)
  during the search (generation)
• Disadvantages
• Effectiveness??
• To increase the effectiveness semi-random methods
  are used, but they have to be developed manually

29
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

30
Path-Oriented Test Generation
Target statement S
Select path P to target statement S
Find input to execute path P
no
An input to execute path P and target statement S
yes
Input found?
31
Path-Oriented Test Generation
1. Select a path
2. Find input to execute the path
Failure!!
1. Select another path
32
Path-Oriented Test Generation
1. Select a path
2. Find input to execute the path
Failure!!
1. Select another path
2. Find input to execute the path
33
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

34
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

35
Path-Oriented Test Generation
Target statement S
Select path P to target statement S
Symbolically execute program for path P
Solve equalities and inequalities
no
Solution is an input to execute path P and target
statement S
yes
Solution found?
36
Symbolic execution

• Regular program execution is based on specific
  input data
• Symbolic execution
• program is executed using only symbols
• during symbolic execution input symbols rather
  than input data are used
• program is symbolically executed along the
  selected path

37
Example

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

38
Path selection

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

39
Path selection

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

1 input (a,n) 2 maxa1 3 mina1 4 i2
5 while (iltn) 6 if (maxltai) 8 if
(mingtai) 10 ii1 5 while (iltn) 11 output(m
in,max)
40
Path selection

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6 if (maxltai)
• 8 if (mingtai)
• 10 ii1
• 5 while (iltn)
• 11 output(min,max)

41
Symbolic execution
input symbols a0, n0

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6 if (maxltai)
• 8 if (mingtai)
• 10 ii1
• 5 while (iltn)
• 11 output(min,max)

aa0, nn0 maxa01 mina01 i2 (2ltn0) (a01
lta02) (a01gta02) i213 (3ltn0) output(a01
, a01)
42
Symbolic execution
input symbols a0, n0

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6 if (maxltai)
• 8 if (mingtai)
• 10 ii1
• 5 while (iltn)
• 11 output(min,max)

aa0, nn0 maxa01 mina01 i2 (2ltn0) (a01
lta02) (a01gta02) i213 (3ltn0) output(a01
, a01)
43
Symbolic execution
input symbols a0, n0

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6 if (maxltai)
• 8 if (mingtai)
• 10 ii1
• 5 while (iltn)
• 11 output(min,max)

aa0, nn0 maxa01 mina01 i2 (2ltn0) (a01
lta02) (a01gta02) i213 (3ltn0) output(a01
, a01)
T
F
F
F
44
Symbolic execution
input symbols a0, n0
(2ltn0) (a01lta02) (a01gta02) (3ltn0)
T
F
F
F
45
Symbolic execution
input symbols a0, n0
(2ltn0) (a01lta02) (a01gta02) (3ltn0)
T
F
F
F
SOLVE IT!!
46
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

47
Execution-Oriented Test Generation

• Based on actual program execution
• It solves problems (sub-goals) along the selected
  path as they occur to reach the target statement

48
Execution-Oriented Test Generation
int F(x)
yx4
target statement
F
T
ylt1
F
T
ylt2
z0
T
F
z1
ygt7
find value of x on which target statement is
executed
z2
z3
return z
49
Execution-Oriented Test Generation
int F(x)
find a new value of x to execute False branch
Initial input
yx4
x -57
F
T
ylt1
F
T
ylt2
z0
T
F
z1
ygt7
z2
z3
return z
50
Execution-Oriented Test Generation
int F(x)
find a new value of x to execute False branch
Initial input
yx4
x -57
F
T
ylt1
F
T
ylt2
z0
T
F
z1
ygt7
z2
z3
return z
51
Execution-Oriented Test Generation

• A predicate of the conditional statement is used
  to construct a fitness function
• The fitness function is used by the search engine

52
Execution-Oriented Test Generation

• A predicate
• y lt 1
• is currently True
• but we want to be False, i.e., y ? 1
• A fitness function
• G 1- y
• Find a new input x on which
• G ? 0

53
Execution-Oriented Test Generation
int F(x)
Initial input
G1-y
yx4
x -57
F
T
ylt1
G 54
F
T
ylt2
z0
T
F
z1
ygt7
z2
z3
return z
54
Execution-Oriented Test Generation

• There are many searching algorithms that can be
  used to find a new program input based on the
  fitness function
• Hill-climbing algorithm
• Simulated annealing
• Evolutionary algorithm

55
Execution-Oriented Test Generators

• Hill-climbing algorithm
• Exploratory moves
• To determine the direction of search
• Increase input variable by small ?
• Decrease input variable by small ?
• Pattern moves
• Based on the identified direction
  increase/decrease input variable by a big step

56
Execution-Oriented Test Generators
G1-y
exploratory moves
x
-57
-58
43
-56
-7
direction of search
57
Execution-Oriented Test Generation
int F(x)
find a new value of x to execute False branch
Input
yx4
x 43
F
T
ylt1
F
T
ylt2
z0
T
F
z1
ygt7
z2
z3
return z
58
Execution-Oriented Test Generation
int F(x)
find a new value of x to execute False branch
Initial input
yx4
x 43
F
T
ylt1
F
T
ylt2
z0
T
F
z1
ygt7
z2
z3
return z
59
Execution-Oriented Test Generators

• The shape of a fitness function is unknown
• Problems with local minimum

60
Execution-Oriented Test Generators
G
exploratory moves
fitness function
x
-57
-58
-56
direction of search
61
Execution-Oriented Test Generators
G
exploratory moves
fitness function
local minimum
x
-57
-58
-56
direction of search
62
Execution-Oriented Test Generators

• The shape of a fitness function is unknown
• Problems with local minimum

• Repeat search for different initial inputs
• Evolutionary algorithms

63
Execution-Oriented Test Generators
G
initially generated inputs
this initial input will lead to the solution
x
64
Path-Oriented Test Generation

• Problems
• Selected paths are frequently non-executable
• It is considered a restrictive in the presence of
  loops
• A lot of search effort is wasted on
  non-executable paths

65
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

66
Goal-Oriented Test Generation

• Paths are not selected
• Based on actual program execution
• A control graph of the program is used
• It solves problems (sub-goals) as they occur to
  reach the target statement

67
Goal-Oriented Test Generation
target statement
68
Goal-Oriented Test Generation
execute program on any input
Success input found!!!
69
Goal-Oriented Test Generation
execute program on any input
70
Goal-Oriented Test Generation
execute program on any input
71
Goal-Oriented Test Generation
execute program on any input
problem node
this execution may lead to the target
this execution does not lead to the target
72
Goal-Oriented Test Generators
execute program on any input
problem node
We want to find a new program input so execution
follows this branch
73
Goal-Oriented Test Generators
execute program on any input
problem node
We want to find a new program input so execution
follows this branch
74
Goal-Oriented Test Generation

• A predicate of the conditional statement is used
  to construct a fitness function
• The fitness function is used by the search engine

75
Sample program and its control graph
en
1

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

2
3
4
5
6
7
8
9
10
11
ex
76
Goal-Oriented Test Generation
en
1

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

2
3
4
5
6
7
8
9
10
11
ex
77
Goal-Oriented Test Generation
en
1

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

2
3
4
5
6
7
8
9
10
11
ex
78
Goal-Oriented Test Generation
en
1
2
3
4
5
6
7
8
9
10
11
ex
79
Goal-Oriented Test Generation
en
1
2
3
4
5
6
7
8
9
10
11
ex
80
Goal-Oriented Test Generation

• Branch classification
• OK branches
• Critical branches
• Semi-critical branches

81
Goal-Oriented Test Generation
target
82
Goal-Oriented Test Generation
OK branch
acyclic path
target
83
Goal-Oriented Test Generation
critical branch
there is no path to the target
target
84
Goal-Oriented Test Generation
Semi-critical branch
acyclic path
target
no acyclic path to target
85
Goal-Oriented Test Generation
en
1
2
3
4
5
6
7
8
9
10
11
ex
86
Goal-Oriented Test Generation
en
OK branch
1
critical branch
2
semi-critical branch
3
4
5
6
7
8
9
10
11
ex
87
Goal-Oriented Test Generation

• OK branch
• Continue execution
• Critical branch
• Stop execution
• Search for new input to execute an alternative
  branch
• If the search fails, the search failure is
  declared
• Semi-critical branch
• Stop execution
• Search for new input to execute an alternative
  branch
• If the search fails, continue execution through
  the semi-critical branch

88
Goal-Oriented Test Generation
en
OK branch
1
critical branch
2
semi-critical branch
3
4
5
6
7
8
9
10
11
ex
89
Goal-Oriented Test Generation

• The goal-oriented approach may significantly
  increase chances of finding inputs as compared to
  path-oriented methods
• A control graph of the program is only used
  during the search
• For some programs using a control graph may not
  be sufficient to find a solution (an input to
  execute the target statement)

90
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

91
Chaining Approach

• The chaining approach is an extension of the
  goal-oriented approach
• The chaining approach uses
• Control flow graph
• Data flow (data dependence) information

92
Data flow (data dependence) concepts

• A definition of variable v is a statement that
  assigns a value to variable v
• v15
• input (v)
• An use of variable v is a statement (or
  predicate) that uses (references) variable v
• yv1
• print(v)
• if (vlt0)
• vv1

93
Data flow (data dependence) concepts

• There exists a data flow (data dependence)
  between statement S1 and S2 if
• S1 is a definition of variable v
• S2 is an use of variable v
• There exists a path in the program from S1 to S2
  along which v is not modified

94
Data flow (data dependence) concepts
S1 v
S2 yv1
95
Sample program and its control graph
en
1

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) maxai
• 8,9 if (mingtai) minai
• 10 ii1
• 11 output(min,max)

2
3
4
5
6
7
8
9
10
11
ex
96
Sample data flows w.r.t. variable max
en
1

• 1 input (a,n)
• 2 maxa1
• 3 mina1
• 4 i2
• 5 while (iltn)
• 6,7 if (maxltai) then maxai
• 8,9 if (mingtai) then minai
• 10 ii1
• 11 output(min,max)

2
3
4
5
6
7
8
9
10
11
ex
97
Chaining Approach
Goal-oriented search fails at a critical branch
98
Chaining Approach
Goal-oriented search fails at a critical branch
99
Chaining Approach

• The goal-oriented approach may fail because
• A fitness function cannot be constructed from a
  predicate, e.g., when Booelan flags are used
• if (flag)
• A control flow graph alone is not sufficient to
  find a new input to executed an alternative
  branch to a critical branch

100
Chaining Approach
The chaining approach uses data flows (data
dependences) to identify such statements
Which statements influence the predicate?
The chaining approach uses data dependences to
identify such statements
101
Chaining Approach
p
vgt0
target
102
Chaining Approach
v..
S2
v..
v..
S1
S3
p
vgt0
target
103
Chaining Approach

• A chain is a sequence of statements.

104
Chaining Approach
Variable v should not be modified between S1 and p
105
Sample program
en

• 1 input (a,x)
• 2 flag1
• 3 i1
• 4 while (ilt10)
• 5,6 if (ailtgtx) flag0
• 7 ii1
• 8,9 if (flag) target

1
2
3
4
5
6
7
8
9
ex
106
Sample program
en

• 1 input (a,x)
• 2 flag1
• 3 i1
• 4 while (ilt10)
• 5,6 if (ailtgtx) flag0
• 7 ii1
• 8,9 if (flag) target

1
2
3
4
5
6
7
problem statement
8
9
ex
107
Sample program
en

• 1 input (a,x)
• 2 flag1
• 3 i1
• 4 while (ilt10)
• 5,6 if (ailtgtx) flag0
• 7 ii1
• 8,9 if (flag) target

1
2
3
4
5
6
7
8
9
ex
108
Chaining Approach

• Possible chains

109
Chaining Approach
Branch classification
110
Sample program
en

• 1 input (a,x)
• 2 flag1
• 3 i1
• 4 while (ilt10)
• 5,6 if (ailtgtx) flag0
• 7 ii1
• 8,9 if (flag) target

1
2
3
4
5
6
7
8
9
ex
111
Sample program
en

• 1 input (a,x)
• 2 flag1
• 3 i1
• 4 while (ilt10)
• 5,6 if (ailtgtx) flag0
• 7 ii1
• 8,9 if (flag) target

1
2
3
4
5
6
7
8
9
ex
112
Sample program
en

• 1 input (a,x)
• 2 flag1
• 3 i1
• 4 while (ilt10)
• 5,6 if (ailtgtx) flag0
• 7 ii1
• 8,9 if (flag) target

OK branch
1
critical branch
2
semi-critical branch
3
4
5
6
7
8
9
ex
113
Chaining Approach
Chain expansion
a new problem statement may be encountered
between S1 and p
114
Chaining Approach
Chain expansion
v
v
p1
en
S1
p
target
a new problem statement may be encountered
between S1 and p
115
Chaining Approach
Chain expansion
v
v
p1
en
S1
p
target
Suppose there are data dependences
between statement A1 and p1 statement A2 and p1
with respect to variable x
116
Chaining Approach
v
v
p1
en
S1
p
target
Chain expansion
v
v,x
v
p1
en
S1
p
target
A1
x
v,x
v
p1
en
A2
p
target
S1
117
Chaining Approach

• It may significantly increase chances of finding
  inputs over the goal-oriented approach
• It can partially alleviate problems associated
  with programs with flags
• It relies on direct data dependences related to
  problem statements
• The search depends on the sequence of problems
  statements that are identified during the search
• The chaining approach does not have a global
  view of dependences in the program

118
Test Data Generation Methods

• Random test generation
• Path-oriented test generation
• Symbolic execution oriented test generation
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach of test generation
• Data dependence based test generation
• Simulated annealing
• Evolutionary algorithms

119
Data Dependence Based Generation

• The data dependence based test generation is an
  extension of the chaining approach
• The data dependence based test generation uses a
  data dependence graph rather than individual data
  dependences during the search

120
1 void F(int A, int C) int i, j, top,
f_exit 2 i1 3 j 1 4 top 0
5 f_exit0 6 while (Cjlt5) 7 j j 1
8 if (Cj 1) 9 i i 1 10
if (Ai gt 0) 11,12 top
top 1 ARtop Ai 13
if (Cj 2) 14 if (topgt0) 15,16
write(ARtop) top top - 1
17 if (Cj3) 18,19 if (topgt100)
write(1) 20 else write(0)
//endwhile
121
1 void F(int A, int C) int i, j, top,
f_exit 2 i1 3 j 1 4 top 0
5 f_exit0 6 while (Cjlt5) 7 j j 1
8 if (Cj 1) 9 i i 1 10
if (Ai gt 0) 11,12 top
top 1 ARtop Ai 13
if (Cj 2) 14 if (topgt0) 15,16
write(ARtop) top top - 1
17 if (Cj3) 18,19 if (topgt100)
write(1) 20 else write(0)
//endwhile
target statement
122
1 void F(int A, int C) int i, j, top,
f_exit 2 i1 3 j 1 4 top 0
5 f_exit0 6 while (Cjlt5) 7 j j 1
8 if (Cj 1) 9 i i 1 10
if (Ai gt 0) 11,12 top
top 1 ARtop Ai 13
if (Cj 2) 14 if (topgt0) 15,16
write(ARtop) top top - 1
17 if (Cj3) 18,19 if (topgt100)
write(1) 20 else write(0)
//endwhile
problem statement
123
1 void F(int A, int C) int i, j, top,
f_exit 2 i1 3 j 1 4 top 0
5 f_exit0 6 while (Cjlt5) 7 j j 1
8 if (Cj 1) 9 i i 1 10
if (Ai gt 0) 11,12 top
top 1 ARtop Ai 13
if (Cj 2) 14 if (topgt0) 15,16
write(ARtop) top top - 1
17 if (Cj3) 18,19 if (topgt100)
write(1) 20 else write(0)
//endwhile
124
1 void F(int A, int C) int i, j, top,
f_exit 2 i1 3 j 1 4 top 0
5 f_exit0 6 while (Cjlt5) 7 j j 1
8 if (Cj 1) 9 i i 1 10
if (Ai gt 0) 11,12 top
top 1 ARtop Ai 13
if (Cj 2) 14 if (topgt0) 15,16
write(ARtop) top top - 1
17 if (Cj3) 18,19 if (topgt100)
write(1) 20 else write(0)
//endwhile
125
Data Dependence Based Generation
4
11
16
18
Data-dependence graph
126
Data Dependence Based Generation
4
11
16
18
Chaining approach
127
Data Dependence Based Generation
4
11
16
18
Data-dependence graph
128
Data Dependence Based Generation

• The data dependence based test generation
  identifies and explores different paths in the
  data-dependence graph leading to the problem
  statement
• This approach tries to identify data-dependence
  paths for which the fitness function evaluates to
  the target value

129
Data Dependence Based Generation
4
11
16
18
130
Data Dependence Based Generation
4
11
16
18
en, 4, 11, 18
131
Data Dependence Based Generation
132
Data Dependence Based Generation
4
11
16
18
en, 4, 11, 16, 11, 18
133
Data Dependence Based Generation

• Many different paths (chains) can be generated
  from the data dependence graph for exploration
• P1 en, 4, 18
• P2 en, 4, 11, 18
• P3 en, 4, 16, 18
• P4 en, 4, 11, 16, 18
• P5 en, 4, 16, 11, 18

134
Data Dependence Based Generation

• It may be expensive to explore all these paths
  (chains) in the original program
• We are looking for paths for which the fitness
  function evaluates to the target value

135
1 void F(int A, int C) int i, j, top,
f_exit 2 i1 3 j 1 4 top 0
5 f_exit0 6 while (Cjlt5) 7 j j 1
8 if (Cj 1) 9 i i 1 10
if (Ai gt 0) 11,12 top
top 1 ARtop Ai 13
if (Cj 2) 14 if (topgt0) 15,16
write(ARtop) top top - 1
17 if (Cj3) 18,19 if (topgt100)
write(1) 20 else write(0)
//endwhile
136
Data Dependence Based Generation

• The idea is to explore these paths not in the
  original program
• but
• in a transformed program in which it should be
  much easier to determine whether the fitness
  function may evaluate to the target value

137
Data Dependence Based Generation

• Testability transformation
• A data dependence graph is used to construct a
  corresponding (transformed)
• The transformed program is used to identify paths
  for which the fitness function evaluates to the
  target value
• These promising paths are then used on the
  original program to find the solution

138
Data Dependence Based Generation

• The input to the transformed program are
• A data-dependence path (chain)
• The output of the transformed program is the
  value of the fitness function

139
Data Dependence Based Generation
4
11
16
18
140
float TransFunc(int PathSize, int S, int R)
int i, j, top 2 i1 3 while (iltPathSize)
4 switch (Si) 5 case 4 top 0 //
4 6 break 7 case 11 top top 1 // 11
8 for (j1jltRij) top top 1 9
break 10 case 16 top top - 1 //
16 11 for (j1jltRij) top top -
1 12 break 13 14
i 15 16 return 100-top //computation of
the fitness function at node 18
141
Data Dependence Based Generation
4
11
16
18
en, 4, 11, 18
142
Data Dependence Based Generation

• PathSize2
• S(4,11)
• R(?,?)
• GTransFunc(PathSize, S, R)
• Find R(?,?) such that G ? 0
• Solution R(1,101)

143
Data Dependence Based Generation

• The solution can be found by exploring a very
  small number of data dependence paths

144
Conclusions

• Test data generation methods
• Execution-oriented test generation
• Goal-oriented test generation
• Chaining approach
• Data dependence oriented test generation
• These methods depend on
• A fitness function
• A control flow graph
• Data dependences/data dependence graph

145
Conclusions

• Research challenges
• Programs with flags
• Programs for which a fitness function cannot be
  constructed
• Programs with many constraints
• Search in the presence of local minimum
• Comprehensive experimental study comparing the
  existing methods

146
Questions?