An Efficient Black-Box Support of Advanced Coverage Criteria for Klee

TL;DR

This paper introduces Klee4labels, an optimized black-box extension to the Klee testing tool, enabling efficient support for advanced coverage criteria like multiple conditions and boundary testing, with publicly available implementation.

Contribution

It presents the first integration of advanced coverage criteria support into Klee in a fully black-box manner, improving test generation efficiency for complex criteria.

Findings

Klee4labels enhances coverage for advanced testing criteria.

The tool shows significant improvements on benchmark tests.

It is publicly available for wider use.

Abstract

Dynamic symbolic execution (DSE) is a powerful test generation approach based on an exploration of the path space of the program under test. Well-adapted for path coverage, this approach is however less efficient for conditions, decisions, advanced coverage criteria (such as multiple conditions, weak mutations, boundary testing) or user-provided test objectives. While theoretical solutions to adapt DSE to a large set of criteria have been proposed, they have never been integrated into publicly available testing tools. This paper presents a first integration of an optimized test generation strategy for advanced coverage criteria into a popular open-source testing tool based on DSE, namely, Klee. The integration is performed in a fully black-box manner, and can therefore inspire an easy integration into other similar tools. The resulting version of the tool, named Klee4labels, is publicly available. We present the design of the proposed technique and evaluate it on several benchmarks. Our results confirm the benefits of the proposed tool for advanced coverage criteria.