FloPSy - Search-Based Floating Point Constraint Solving for Symbolic Execution

Abstract

Recently there has been an upsurge of interest in both, Search-Based Software Testing (SBST), and Dynamic Symbolic Execution (DSE). Each of these two approaches has complementary strengths and weaknesses, making it a natural choice to explore the degree to which the strengths of one can be exploited to offset the weakness of the other. This paper introduces an augmented version of DSE that uses a SBST-based approach to handling floating point computations, which are known to be problematic for vanilla DSE. The approach has been implemented as a plug in for the Microsoft Pex DSE testing tool. The paper presents results from both, standard evaluation benchmarks, and two open source programs.

Goal-oriented dynamic test generation

“…Furthermore, the use of fitness functions provides suitable measurement for targeting particular code elements of testing. These features of searchbased testing have been exploited to improve dynamic symbolic execution toward achieving high structural coverage by guiding path exploration [141] and by solving floating point computations [84].…”

“…For instance, replacing the YICES solver [47] with Z3 [89] would allow CREST to handle non-linear multiplication, division, and modular operations [144]. Other research might involve using search-based testing approaches to deal with floating point data type variables [84]. And for pointers and function pointers, we could even implement pointer solvers to analyze programs where input can be pointers [124], which go beyond the capability of current SMT solvers.…”

Boosting Search Based Testing by Using Constraint Based Testing

“…Several approaches have been proposed to use CBT or combine it with SBT in order to solve some input test generation problems, but they apply CBT on a complete version of the UUT [7,9,10]. All these approaches are limited by the size and the complexity of the UUT, and the fact that the input test generation problem is undecidable (reachability problem).…”

“…To solve constraints over floating point, the CBT tool PEX [19] has been extended by using FloPSy [9] which is a SBT approach that solves floating point constraints. FloPSy deals with a specific issue by using SBT to help CBT in solving constraints over floating point.…”

“…Constraint Based Testing (CBT) and Search Based Testing (SBT) have become the dominant approaches to test case generation, because they achieve high code coverage. Over the last decade, theses two approaches have been extensively explored [3,5,9,10,14,18,19].…”