An experimental evaluation of a symbolic execution system

Girgis, Moheb R.

doi:10.1049/sej.1992.0029

Cited by 22 publications

(22 citation statements)

References 1 publication

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The algorithm searches for test paths that satisfy the all-uses criterion. In the case of programs containing loops, the proposed technique generates paths according to the ZOT-subset criterion: "Each loop in a program is iterated zero, one, and two times in execution" [34].…”

Section: Ga-based Technique For Test Paths Generationmentioning

confidence: 99%

Automatic Data Flow Test Paths Generation using the Genetical Swarm Optimization Technique

Girgis¹,

Ghiduk²,

Abd-elkawy³

2015

IJCA

View full text Add to dashboard Cite

Path testing requires generating all paths through the program to be tested, and finding a set of program inputs that will execute every path. The number of possible paths in programs containing loops is infinite, and so it is very difficult, if not impossible, to test all of them. Path testing can be relaxed by selecting a subset of all executable paths that fulfill a certain path selection criterion and finding test data to cover it. The automatic generation of such test paths leads to more test coverage paths thus resulting in efficient and effective testing strategy. This paper presents a genetical swarm optimization (GSO) based technique, which effectively combines a genetic algorithm (GA) based technique and a particle swarm optimization (PSO) based technique, for automatic generation of a set of test paths that cover the all-uses criterion. Experiments have been carried out to evaluate the effectiveness of the proposed GSO approach in test paths generation compared to the GA and PSO approaches.

show abstract

Section: Ga-based Technique For Test Paths Generationmentioning

confidence: 99%

Automatic Data Flow Test Paths Generation using the Genetical Swarm Optimization Technique

Girgis¹,

Ghiduk²,

Abd-elkawy³

2015

IJCA

View full text Add to dashboard Cite

show abstract

“…In symbolic execution [41,[53][54][55], the state, called a symbolic store , maps variables, not to values, but to symbolic expressions. The expressions are the objects that can occur on the right hand sides of assignment statements (in this paper, it is assumed that these are simply arithmetic expressions).…”

Section: An Overview Of the Approachmentioning

confidence: 99%

ConSUS: a light-weight program conditioner

Danicic

Daoudi

Fox

et al. 2005

Journal of Systems and Software

View full text Add to dashboard Cite

Program conditioning consists of identifying and removing a set of statements which cannot be executed when a condition of interest holds at some point in a program. It has been applied to problems in maintenance, testing, re-use and re-engineering. Program conditioning relies upon both symbolic execution and reasoning about symbolic predicates. Automation of the process therefore requires some form of automated theorem proving. However, the use of a full-power 'heavyweight' theorem prover would impose unrealistic performance constraints. This paper reports on a lightweight approach to theorem proving using the FermaT simplify decision procedure. This is used as a component to ConSUS, a program conditioning system for the Wide Spectrum Language WSL. The paper describes the symbolic execution algorithm used by ConSUS, which prunes as it conditions. The paper also provides empirical evidence that conditioning produces a significant reduction in program size and, although exponential in the worst case, the conditioning system has low degree polynomial behaviour in many cases, thereby making it scalable to unit level applications of program conditioning.

show abstract

“…However, in a more general case, a decision must be 49 made as to which paths to follow: for instance, the loop can be traversed zero times, once and twice as suggested by Girgis [19]. However, it is conceivable that such an approach may miss faults that only arise after a considerable number of iterations (such as an array overflow * ).…”

Section: Loop Handlingmentioning

confidence: 99%

Using symbolic execution to guide test generation

Lee

Morris

Parker

et al. 2005

Softw. Test. Verif. Reliab.

View full text Add to dashboard Cite

SUMMARYAlthough a number of weaknesses of symbolic execution, when used for software testing, have been highlighted in the literature, the recent resurgence of strongly-typed languages has created opportunities for re-examining symbolic execution to determine whether these shortfalls can be overcome. This paper discusses symbolic execution in general and makes two contributions: (a) overcoming one of the key problems, analysing programs with indexed arrays; and (b) describing the incorporation of a symbolic execution module for test case generation into an integrated testing tool. For methods which index arrays, a new approach determines all the possible values of each array index, allowing the generation of equivalence classes for every possible combination of array element aliases. An incremental simplification approach, which converts path expressions to canonical forms in order to identify infeasible paths at the earliest opportunity and thus reduce the analysis time, is also described. Symbolic execution is most effective when included in an integrated test and analysis environment: a component test bench was built with a symbolic execution module integrated into it, providing a toolbox of software component test and code analysis methods aimed at programmers at all levels.

show abstract

An experimental evaluation of a symbolic execution system

Cited by 22 publications

References 1 publication

Automatic Data Flow Test Paths Generation using the Genetical Swarm Optimization Technique

Automatic Data Flow Test Paths Generation using the Genetical Swarm Optimization Technique

ConSUS: a light-weight program conditioner

Using symbolic execution to guide test generation

Contact Info

Product

Resources

About