Method and system for generating a computer program test suite using dynamic symbolic execution
First Claim
1. A method using a computer for generating a test suite for a computer program, the computer program comprising program statements and program variables, including at least one input statement having one or more input variables, grouped into code blocks and stored in a program database, the test suite comprising sets of inputs, each of the sets of inputs corresponding to each of the input statements, comprising the steps of:
- reading the program statements corresponding to a candidate code block from the program database;
representing each of the input variables for each input statement and each of the program variables in symbolic form as a symbolic memory value and transforming each program statement dependent on such an input variable into a symbolic expression;
creating a trial set of inputs for each of the input statements by finding a solution to the symbolic expression comprising actual input values corresponding to each symbolic memory value using dynamic symbolic exeuction;
performing an execution run of the computer program using the trial set of inputs and analyzing results obtained from the execution run for coverage of the candidate code block; and
storing the trial set of inputs into the test suite if coverage of the candidate code block was obtained.
1 Assignment
0 Petitions
Accused Products
Abstract
A method and system for generating a test suite for a computer program. The computer program comprises program statements and program variables, including at least one input statement having one or more input variables, that are grouped into code blocks and stored in a program database. The test suite comprises sets of inputs. Each of the sets of inputs corresponds to each of the input statements. The program statements corresponding to a candidate code block are read from the program database. Each of the input variables for each input statement and each of the program variables are represented in symbolic form as a symbolic memory value and transforming each program statement dependent on such an input variable into a symbolic expression. A trial set of inputs for each of the input statements is created by finding a solution to the symbolic expression comprising actual input values corresponding to each symbolic memory value using dynamic symbolic exeuction. An execution run of the computer program is performed using the trial set of inputs and analyzing results obtained from the execution run for coverage of the candidate code block. The trial set of inputs are stored into the test suite if coverage of the candidate code block was obtained.
163 Citations
19 Claims
-
1. A method using a computer for generating a test suite for a computer program, the computer program comprising program statements and program variables, including at least one input statement having one or more input variables, grouped into code blocks and stored in a program database, the test suite comprising sets of inputs, each of the sets of inputs corresponding to each of the input statements, comprising the steps of:
-
reading the program statements corresponding to a candidate code block from the program database; representing each of the input variables for each input statement and each of the program variables in symbolic form as a symbolic memory value and transforming each program statement dependent on such an input variable into a symbolic expression; creating a trial set of inputs for each of the input statements by finding a solution to the symbolic expression comprising actual input values corresponding to each symbolic memory value using dynamic symbolic exeuction; performing an execution run of the computer program using the trial set of inputs and analyzing results obtained from the execution run for coverage of the candidate code block; and storing the trial set of inputs into the test suite if coverage of the candidate code block was obtained. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9)
-
-
10. A system for generating a test suite for a computer program, the computer program comprising program statements and program variables, including at least one input statement having one or more input variables, grouped into code blocks and stored in a program database, the test suite comprising sets of inputs, each of the sets of inputs corresponding to each of the input statements, comprising:
-
means for reading the program statements corresponding to a candidate code block from the program database; means for representing each of the input variables for each input statement and each of the program variables in symbolic form as a symbolic memory value and means for transforming each program statement dependent on such an input variable into a symbolic expression; means for creating a trial set of inputs for each of the input statements by finding a solution to the symbolic expression comprising actual input values corresponding to each symbolic memory value using dynamic symbolic execution; means for performing an execution run of the computer program using the trial set of inputs and means for analyzing results obtained from the execution run for coverage of the candidate code block; and means for storing the trial set of inputs into the test suite if coverage of the candidate code block was obtained.
-
-
11. A method using a computer for creating a symbolic expression using dynamic symbolic execution for use in generating a test suite for a computer program, the computer program comprising program instructions and program variables, including input variables, the program instructions represented as nodes organized into a hierarchical parse tree, the program variables and input variables represented in symbolic form as symbolic memory values in nodes organized into a symbolic memory, comprising the steps of:
-
reading a node for representing a program instruction from the parse tree; obtaining symbolic memory values for each such program variable and each such input variable used by the program instruction from the symbolic memory; and symbolically interpreting the program instruction using the symbolic memory values instead of actual values for each such program variable and each such input variable used by the program instruction to create the symbolic expression. - View Dependent Claims (12, 13, 14, 15, 16, 17, 18, 19)
-
Specification