Targeted test input generation using symbolic-concrete backward execution

Abstract

Knowing inputs that cover a specific branch or statement in a program is useful for debugging and regression testing. Symbolic backward execution (SBE) is a natural approach to find such targeted inputs. However, SBE struggles with complicated arithmetic, external method calls, and datadependent loops that occur in many real-world programs. We propose symcretic execution, a novel combination of SBE and concrete forward execution that can efficiently find targeted inputs despite these challenges. An evaluation of our approach on a range of test cases shows that symcretic execution finds inputs in more cases than concolic testing tools while exploring fewer path segments. Integration of our approach will allow test generation tools to fill coverage gaps and static bug detectors to verify candidate bugs with concrete test cases.

A Survey of Symbolic Execution Techniques

“…Symbolic backward execution (SBE) [26,40] is a variant of symbolic execution in which the exploration proceeds from a target point to an entry point of a program. The analysis is thus performed in the reverse direction than in canonical (forward) symbolic execution.…”

“…However, concolic walk does not rely on the solver for obtaining all the concrete inputs needed to evaluate complex constraints, and implements search heuristics that guide the walk on the polytope toward promising regions. [40] describes symcretic execution, a novel combination of symbolic backward execution (SBE) (Section 2) and forward symbolic execution. The main idea is to divide exploration into two phases.…”

Compositional Symbolic Execution Using Fine-Grained Summaries

“…Thummalapenta et al [5] discuss method sequence generation for object-oriented testing, which implements the idea of back-tracing in method call chains. Dinges and Agha [6] describe symcretic execution, the first attempt of combining concrete execution with backward reasoning. They use forward heuristic search when BSE cannot reason about particular parts of the code.…”

“…The current trend of the development of symbolic execution has seen several features, including: interchangeable modes [24], [13], [6], doubled direction [4], [6], and alternative state representation [25]. There is also extensive research specifically into symbolic execution of loops [14], [17], [26], [27], [28].…”

“…2) Analysis and discussion of program characteristics that affect the effectiveness of fine-grained summaries, as well as 3 specific summarisation strategies. 3) Combination of CSE and backwards symbolic execution (BSE) [4], [5], [6], and a demonstration that the fine-grained summarisation can improve the path explosion resistance of BSE.…”