JST: An automatic test generation tool for industrial Java applications with strings

Ghosh, Indradeep; Shafiei, Nastaran; Li, Guodong; Chiang, Wei‐Fan

doi:10.1109/icse.2013.6606649

Cited by 30 publications

(43 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Finally, we intersect this automaton with the one accepting all words of length 2 to get the final automaton. Due to space constraint we will skip the details of implementing the new operations, which we extend from [16,9].…”

Section: Enhancement With Automaton Based Modelmentioning

confidence: 99%

“…combinations of numeric constraints, string constraints, and RegExp constraints). An interested reader may refer to [9] for more discussions. Moreover, even for the supported features, they often use iterations or brute-force enumerations, hence harming the performance.…”

Section: Introductionmentioning

confidence: 99%

“…While there are some external string solvers [2,20,8,18,15,9] available, none of them meets our need to obtain a good balance between efficiency, accuracy, and comprehensiveness. Roughly, existing solvers can be divided into two categories: (1) bit-vector (BV) based methods, which model a string with a fixedlength bit-vector; and (2) automaton based methods, which model a string with an automaton.…”

Section: Introductionmentioning

confidence: 99%

“…Automaton based model [16,21,18,20,11,9]. A string is modeled by an automaton which accepts all possible values of this string.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

PASS: String Solving with Parameterized Array and Interval Automaton

Ghosh

2013

Hardware and Software: Verification and Testing

Self Cite

View full text Add to dashboard Cite

Abstract. The problem of solving string constraints together with numeric constraints has received increasing interest recently. Existing methods use either bit-vectors or automata (or their combination) to model strings, and reduce string constraints to bit-vector constraints or automaton operations, which are then solved in the respective domain. Unfortunately, they often fail to achieve a good balance between efficiency, accuracy, and comprehensiveness. In this paper we illustrate a new technique that uses parameterized arrays as the main data structure to model strings, and converts string constraints into quantified expressions that are solved through quantifier elimination. We present an efficient and sound quantifier elimination algorithm. In addition, we use an automaton model to handle regular expressions and reason about string values faster. Our method does not need to enumerate string lengths (as bit-vector based methods do), or concrete string values (as automaton based methods do). Hence, it can achieve much better accuracy and efficiency. In particular, it can identify unsatisfiable cases quickly. Our solver (named PASS) supports most of the popular string operations, including string comparisons, string-numeric conversions, and regular expressions. Experimental results demonstrate the advantages of our method.

show abstract

Section: Enhancement With Automaton Based Modelmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

“…Automaton based model [16,21,18,20,11,9]. A string is modeled by an automaton which accepts all possible values of this string.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

PASS: String Solving with Parameterized Array and Interval Automaton

Ghosh

2013

Hardware and Software: Verification and Testing

Self Cite

View full text Add to dashboard Cite

show abstract

“…The result, however, is only a weak connection between string lengths and other numerical constraints. Other solvers that combine automata and numerical reasoning [1,43,81] are able to strengthen this connection to varying degrees.…”

Section: Unbounded-length String Variablesmentioning

confidence: 99%

Other things besides number: Abstraction, constraint propagation, and string variable types

Scott

2016

Constraints

View full text Add to dashboard Cite

Constraint programming (CP) is a technology in which a combinatorial problem is modeled declaratively as a conjunction of constraints, each of which captures some of the combinatorial substructure of the problem. Constraints are more than a modeling convenience: every constraint is partially implemented by an inference algorithm, called a propagator, that rules out some but not necessarily all infeasible candidate values of one or more unknowns in the scope of the constraint. Interleaving propagation with systematic search leads to a powerful and complete solution method, combining a high degree of re-usability with natural, high-level modeling.A propagator can be characterized as a sound approximation of a constraint on an abstraction of sets of candidate values; propagators that share an abstraction are similar in the strength of the inference they perform when identifying infeasible candidate values. In this thesis, we consider abstractions of sets of candidate values that may be described by an elegant mathematical formalism, the Galois connection. We develop a theoretical framework from the correspondence between Galois connections and propagators, unifying two disparate views of the abstractionpropagation connection, namely the oft-overlooked distinction between representational and computational over-approximations. Our framework yields compact definitions of propagator strength, even in complicated cases (i.e., involving several types, or unknowns with internal structure); it also yields a method for the principled derivation of propagators from constraint definitions.We apply this framework to the extension of an existing CP solver to constraints over strings, that is, words of finite length. We define, via a Galois connection, an over-approximation for bounded-length strings, and demonstrate two different methods for implementing this overapproximation in a CP solver. First we use the Galois connection to derive a boundedlength string representation as an aggregation of existing scalar types; propagators for this representation are obtained by manual derivation, or automated synthesis, or a combination. Then we implement a string variable type, motivating design choices with knowledge gained from the construction of the over-approximation. The resulting CP solver extension not only substantially eases modeling for combinatorial string problems, but also leads to substantial efficiency improvements over prior CP methods.

show abstract

Lazy Symbolic Execution through Abstraction and Sub-space Search

Ghosh

2013

Hardware and Software: Verification and Testing

Self Cite

View full text Add to dashboard Cite

Abstract. We present an approach to address a main performance bottleneck in symbolic execution. Despite a powerful method to produce test cases with high coverage, symbolic execution often suffers from the problem of exploring a huge number of paths without (1) significantly increasing the coverage, and (2) going deep enough to hit hot spots. The situation becomes worse for modern programming languages such as C/C++ which extensively use library calls and shared code. In this paper we use a novel "lazy" execution approach to evaluate functions, library calls, and other entities commonly used in a high level language. Specifically, the symbolic executor uses high level abstractions and subspace search to control and guide symbolic execution so that only necessary paths are visited to produce valid test cases. This method is able to avoid exploring many useless or duplicate paths. Experimental results show that it can help solve path constraints and produce test cases in much less time. For many programs, it can improve the performance by several orders of magnitude while maintaining the same source code coverage.

show abstract

JST: An automatic test generation tool for industrial Java applications with strings

Cited by 30 publications

References 23 publications

PASS: String Solving with Parameterized Array and Interval Automaton

PASS: String Solving with Parameterized Array and Interval Automaton

Other things besides number: Abstraction, constraint propagation, and string variable types

Lazy Symbolic Execution through Abstraction and Sub-space Search

Contact Info

Product

Resources

About