# Concolic Testing Heap-Manipulating Programs

## TL;DR

This paper introduces CSF, a novel concolic testing engine for heap-manipulating programs using separation logic, which efficiently generates high-coverage valid test inputs and can integrate with precondition inference tools.

## Contribution

The paper presents the first concolic testing engine for heap programs based on separation logic, addressing challenges in encoding and solving complex heap constraints.

## Key findings

- CSF achieves high coverage on challenging heap programs.
- CSF efficiently generates valid test inputs.
- Potential integration with precondition inference reduces user effort.

## Abstract

Concolic testing is a test generation technique which works effectively by integrating random testing generation and symbolic execution. Existing concolic testing engines focus on numeric programs. Heap-manipulating programs make extensive use of complex heap objects like trees and lists. Testing such programs is challenging due to multiple reasons. Firstly, test inputs for such program are required to satisfy non-trivial constraints which must be specified precisely. Secondly, precisely encoding and solving path conditions in such programs are challenging and often expensive. In this work, we propose the first concolic testing engine called CSF for heap-manipulating programs based on separation logic. CSF effectively combines specification-based testing and concolic execution for test input generation. It is evaluated on a set of challenging heap-manipulating programs. The results show that CSF generates valid test inputs with high coverage efficiently. Furthermore, we show that CSF can be potentially used in combination with precondition inference tools to reduce the user effort.