Presentation Proposal: Towards Efficient Data-flow Test Data Generation Using KLEE

TL;DR

This paper presents a guided symbolic execution approach integrated with KLEE to improve data-flow test data generation, aiming to enhance practical adoption of data-flow testing in software testing.

Contribution

It introduces a novel guided symbolic execution method for data-flow testing and implements it on KLEE, demonstrating improved efficiency and potential for industrial application.

Findings

Effective data-flow coverage achieved on 30 benchmark programs.

Significant improvement in path exploration efficiency.

Potential integration with industrial testing tools like SmartUnit.

Abstract

Dataflow coverage, one of the white-box testing criteria, focuses on the relations between variable definitions and their uses.Several empirical studies have proved data-flow testing is more effective than control-flow testing. However, data-flow testing still cannot find its adoption in practice, due to the lack of effective tool support. To this end, we propose a guided symbolic execution approach to efficiently search for program paths to satisfy data-flow coverage criteria. We implemented this approach on KLEE and evaluated with 30 program subjects which are constructed by the subjects used in previous data-flow testing literature, SIR, SV-COMP benchmarks. Moreover, we are planning to integrate the data-flow testing technique into the new proposed symbolic execution engine, SmartUnit, which is a cloud-based unit testing service for industrial software, supporting coverage-based testing. It has successfully helped several well-known corporations and institutions in China to adopt coverage-based testing in practice, totally tested more than one million lines of real code from industry.