Symbolic execution for software testing

Cadar, Cristian; Sen, Koushik

doi:10.1145/2408776.2408795

Cited by 647 publications

(417 citation statements)

References 27 publications

Supporting

Mentioning

413

Contrasting

Unclassified

Order By: Relevance

“…As an impact, the underlying constraint solver may become unable to properly handle the produced constraints. Solving complex constraints in an efficient way is a well-known challenge for symbolic execution in general [10]. This issue is evaluated for our particular context in the discussion part of the paper.…”

Section: 2mentioning

confidence: 99%

“…While different approaches exist towards the automatic generation of test data, symbolic execution [5] has been recognised as a state-of-art technique for so-called white-box structural test data generation [6,7,8,9,10]. In such an approach, the idea is to generate test data that in some way cover a sufficiently large part of the control-flow graph of the code unit under test [4].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Relational symbolic execution of SQL code for unit testing of database programs

Marcozzi

Vanhoof

Hainaut

2015

Science of Computer Programming

View full text Add to dashboard Cite

Symbolic execution is a technique enabling the automatic generation of test inputs that exercise a set of execution paths within a code unit to be tested. If the paths cover a sufficient part of the code under test, the test data offer a representative view of the actual behaviour of this code. This notably enables detecting errors and correcting faults. Relational databases are ubiquitous in software, but symbolic execution of code units that manipulate them remains a non-trivial problem, particularly because of the complex structure of such databases and the complex behaviour of SQL statements. Finding errors in such code units is yet critical, as it can avoid corrupting important data. In this work, we define a symbolic execution translating database manipulation code directly into constraints and integrate it with a more traditional symbolic execution of normal program code. The database tables are represented by relational symbols and the SQL statements by relational constraints over these symbols. An algorithm based on these principles is presented for the symbolic execution of simple Java methods that implement transactional use cases by reading and writing in a relational database, the latter subject to data integrity constraints. The algorithm is integrated in a test generation tool and experimented over sample code. The target language for the constraints produced by the tool is the SMT-Lib standard and the used solver is Microsoft Z3. The results show that the proposed approach enables generating meaningful test data, including valid database content, in reasonable time. In particular, the Z3 solver is shown to be more scalable than the Alloy solver, used in our previous work, for solving relational constraints.

show abstract

Section: 2mentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Relational symbolic execution of SQL code for unit testing of database programs

Marcozzi

Vanhoof

Hainaut

2015

Science of Computer Programming

View full text Add to dashboard Cite

show abstract

“…The techniques developed in this thesis furnish current approaches with the ability to exploit program dependencies (e.g. control and data dependencies), and utilize static analysis techniques together with effective search mechanisms to handle scalability issues, which are a key limiting factor facing current dynamic testing approaches [29], [35], [65].…”

Section: Motivationmentioning

confidence: 99%

“…In practice, the number of symbolic predicates in the program can be extremely large (often infinite), especially in the presence of loops and/or recursions, causing dynamic symbolic execution to encounter combinatorial explosion of the path space. This is the fundamental scalability issue of dynamic symbolic execution-based approaches [29], [35], [65]. [23], CREST has been used by several research groups.…”

Section: Dynamic Symbolic Executionmentioning

confidence: 99%