Symbolic Execution During Test Data Generation and Augmentation Top Paper Review Zhiyi Zhang

Background Test data generation的三种方法 Random Object-oriented Path-oriented Path-oriented最有效的一种方法 Symbolic execution

Paper List How we get there: a context-guided search strategy in concolic testing(FSE) Using Test Case Reduction and Prioritization to Improve Symbolic Execution(ISSTA) Property Differencing for Incremental Checking(ICSE) Solving complex path conditions through heuristic search on induced polytopes(FSE) The Strength of Random Search on Automated Program Repair (ICSE) Leveraging existing tests in automated test generation for web applications(ASE) Are mutants a valid substitute for real faults in software testing?(FSE) Coverage Is Not Strongly Correlated with Test Suite Effectiveness(ICSE) Code Coverage for Suite Evaluation by Developers (ICSE)

Paper List Symbolic execution (1)How we get there: a context-guided search strategy in concolic testing(FSE) (2)Using Test Case Reduction and Prioritization to Improve Symbolic Execution(ISSTA) (3)Property Differencing for Incremental Checking(ICSE) (4)Solving complex path conditions through heuristic search on induced polytopes(FSE)

Details (1)How we get there: a context-guided search strategy in concolic testing 目的：为了解决符号执行中的路径爆炸问题，根据路径内容提前判定不可行路径。

Details

Detail

K-context of b: as a sequence of k preceding branches in an execution path Dominator: if every path from the entry node to node n must go through node d

Details (2)Using Test Case Reduction and Prioritization to Improve Symbolic Execution 目的：目前有效的符号执行是从已有的测试用例集开始的，将已有测试用例约减和排序然后在继续符号执行可以提升符号执行的效率。

Idea 目前的符号执行代价还是很大，因此几篇论文都是针对能提升符号执行效率。 约束求解占据符号执行中很大一部分资源，因此，对约束求解进行优化也可提升符号执行效率。 目前的约束求解优化并不考虑程序结构及上下文，因此可以从这个点切入。比如incremental和测试用例扩增方面。

Paper List Searching strategy (1)The Strength of Random Search on Automated Program Repair (ICSE)

Details (1)The Strength of Random Search on Automated Program Repair (ICSE) 目的：目前GenProg和Par是两个有效的基于遗传算法的自动程序修复工具，它们的有效到底是基于优异的变异算子还是基于遗传算法？

Details RSRepair与GenProg和Par比较 1，修复程序的成功率 2，修复程序程序所需要的candidate patches的数目

Idea 符号执行一个重要的问题就是路径爆炸问题，因此提出了很多种路径搜索方法。 KLEE中有DFS和random两种方法，在同样的时间下，random搜索产生的测试用例个数远远多于DFS产生的测试用例个数。测试用例集的质量首先跟测试用例数目相关。

Paper List Test Case Augmentation (1)Leveraging existing tests in automated test generation for web applications(ASE) 目的：在web app中结合人工测试用例的优点和自动化的生成。

Paper List Test suite measurement (1)Are mutants a valid substitute for real faults in software testing?(FSE) (2)Coverage Is Not Strongly Correlated with Test Suite Effectiveness(ICSE) (3)Code Coverage for Suite Evaluation by Developers (ICSE)

Idea Mutation和coverage还是有不同作用的，比如在错误定位方面，还是coverage更好。 直接对这两种方法进行比较（mobile app上）。

变异工具

Thanks