Test Case Reduction, Prioritization, and Selection for Symbolic Execution

Graduation date: 2015Software testing is of critical importance for the success of software projects. Current inefficient testing methods often still take up half or more of a software project's budget. Automatic test data generation is the most promising way to lower the software testing cost. Manually creating testing data is expensive and often needs deep domain knowledge. Therefore, both industry and academia are always highly interested in automatic approaches to generating test data.\ud \ud Symbolic execution has been one of the most promising and exciting areas of automated testing research for many years now. In principle, symbolic execution "runs" a program, replacing concrete inputs with symbolic variables that represent all possible values. When a program branches, the execution takes both paths (if they are feasible under current constraints) and a set of path conditions on symbolic variables is modified for each path to record the new constraints on the symbolic values. \ud \ud However, scaling symbolic execution to large programs or programs with complex inputs remains difficult due to path explosion and complex constraints, as well as external method calls. Additionally, creating an effective test structure with symbolic inputs can be difficult. A popular symbolic execution strategy in practice is to perform symbolic execution not "from scratch" but based on existing test cases. This dissertation explores the idea that the effectiveness of this approach to symbolic execution can be enhanced by (1) reducing the size of seed test cases, (2) prioritizing seed test cases to maximize exploration efficiency, and (3) selecting a subset tests for symbolic execution without specifying the number of tests. The proposed test case reduction strategy is based on a recently introduced generalization of delta-debugging, and our prioritization and selection techniques include novel methods that, for this purpose, can outperform some traditional regression testing algorithms. Our results show that applying these methods can significantly improve the effectiveness of symbolic execution based on existing test cases