Test Input Generation for Programs with Pointers

Software testing is an essential process to improve software quality in practice. Researchers have proposed several techniques to automate parts of this process. In particular, symbolic execution can be used to automatically generate a set of test inputs that achieves high code coverage. However, most state-of-the-art symbolic execution approaches cannot directly handle programs whose inputs are pointers, as is often the case for C programs. Automatically generating test inputs for pointer manipulating code such as a linked list or balanced tree implementation remains a challenge. Eagerly enumerating all possible heap shapes forfeits the advantages of symbolic execution. Alternatively, for a tester, writing assumptions to express the disjointness of memory regions addressed by input pointers is a tedious and labor-intensive task. This paper proposes a novel solution for this problem: by exploiting type information, disjointness constraints that characterize permissible configurations ...

• Type: Conference
• Year: 2009
• Where: TACAS
• Authors: Dries Vanoverberghe, Nikolai Tillmann, Frank Piessens
• Keywords: Algorithms, State-of-the-art Symbolic Execution, Symbolic Execution, TACAS 2009, Test Inputs