Augmented dynamic symbolic execution

  • Authors:
  • Konrad Jamrozik;Gordon Fraser;Nikolai Tillmann;Jonathan De Halleux

  • Affiliations:
  • Saarland University, Germany;University of Sheffield, UK;Microsoft Research, USA;Microsoft Research, USA

  • Venue:
  • Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

Dynamic symbolic execution (DSE) can efficiently explore all simple paths through a program, reliably determining whether there are any program crashes or violations of assertions or code contracts. However, if such automated oracles do not exist, the traditional approach is to present the developer a small and representative set of tests in order to let him/her determine their correctness. Customer feedback on Microsoft's Pex tool revealed that users expect different values and also more values than those produced by Pex, which threatens the applicability of DSE in a scenario without automated oracles. Indeed, even though all paths might be covered by DSE, the resulting tests are usually not sensitive enough to make a good regression test suite. In this paper, we present augmented dynamic symbolic execution, which aims to produce representative test sets by augmenting path conditions with additional conditions that enforce target criteria such as boundary or mutation adequacy, or logical coverage criteria.