Towards exhaustive branch coverage with PathCrawler

TL;DR

This paper explores methods to improve concolic testing for achieving exhaustive branch coverage, addressing the challenge of unreachable branches and demonstrating promising results on real code examples.

Contribution

It proposes new strategies to enhance concolic test generation for exhaustive branch coverage and compares their effectiveness on real-world code.

Findings

Strategies improve coverage efficiency

Promising results on real code examples

Addresses unreachable branch identification

Abstract

Branch coverage of source code is a very widely used test criterion. Moreover, branch coverage is a similar problem to line coverage, MC/DC and the coverage of assertion violations, certain runtime errors and various other types of test objective. Indeed, establishing that a large number of test objectives are unreachable, or conversely, providing the test inputs which reach them, is at the heart of many verification tasks. However, automatic test generation for exhaustive branch coverage remains an elusive goal: many modern tools obtain high coverage scores without being able to provide an explanation for why some branches are not covered, such as a demonstration that they are unreachable. Concolic test generation offers the promise of exhaustive coverage but covers paths more efficiently than branches. In this paper, I explain why, and propose different strategies to improve its performance on exhaustive branch coverage. A comparison of these strategies on examples of real code shows promising results.