Test-case generation and bug-finding through symbolic execution

  • Authors:

  • W. H. K. Bester;C. P. Inggs;W. C. Visser

  • Affiliations:

  • Stellenbosch University, Matieland, South Africa;Stellenbosch University, Matieland, South Africa;Stellenbosch University, Matieland, South Africa

  • Venue:
  • Proceedings of the South African Institute for Computer Scientists and Information Technologists Conference
  • Year:
  • 2012

Quantified Score

Hi-index 0.00

Visualization

Abstract

In this paper we present Artemis, a tool to analyse Java bytecode and discover run-time errors. Artemis uses the method of symbolic execution to perform path-sensitive analysis on compiled Java classes, in the process building up constraints under which errors like null pointer dereferences and division-by-zero errors can occur. During the analysis, many warnings for possible errors may occur, but not all paths leading to these warnings are feasible. Artemis uses an external decision procedure---a constraint solver---to decide the feasibility of paths, and only if a path is feasible does it generate a JUnit test case for that path. It signals the possibility of a real error only if a test case manages to detect an expected exception during an actual run by the JUnit core. Artemis allows control of the analysis in two important ways: (1) The depth to which method calls descend can be bounded, and (2) so can the number of times branch statements are executed over symbolic values. We performed an evaluation of a small set of non-trivial benchmarking tests, averaging 450 lines of code, and we concluded that using a call depth of one and branch bound of two is optimal for the discovery of bugs. Although Artemis was written as a Java-only solution, it was constructed so that the various components connect via interfaces. Therefore it is easy to extend, and we plan to explore, amongst others, different constraint solvers in the future.