Citation Context

...e and do not interact with the running environment at all. They either cannot handle programs that make use of the environment or require a complete working model. More recent work in test generation =-=[16, 26, 36]-=- does allow external interactions, but forces them to use entirely concrete procedure call arguments, which limits the behaviors they can explore: a concrete external call will do exactly what it did,...

Citation Context

... we must address the defect triage problem (see Section 4), which is common in static program analysis and blackbox fuzzing, but has not been faced until now in the context of dynamic test generation =-=[16, 7, 31, 24, 22, 18]-=-. Another novelty of our approach is that we test larger applications than previously done in dynamic test generation [16, 7, 31]. We have implemented this approach in SAGE, short for Scalable, Automa...

Citation Context

...roved dynamically, by exploiting feedback information collected as the tests are executed. For instance, Sen and coauthors have built on top of the cited DART approach, a notion of “concolic testing” =-=[75]-=-, which is the combination of concrete (random) testing with symbolic execution. The concrete and symbolic executions are run in parallel and “help” each other. Instead, Pacheco and coauthors [67] ran...

Citation Context

...a inputs. 1 Introduction Software testing is the primary technique used in the software industry to improve reliability, safety, security, and robustness of software. Our research on concolic testing =-=[1, 6, 4]-=- shows that we can combine random testing and symbolic testing of a program to provide a scalable tool for automatically generating test cases, which improves test coverage and avoids redundant test c...

Citation Context

..., explore trigger-based behavior [12, 45], and detect emulators [58]. 4) Test Case Generation. Taint analysis and forward symbolic execution are used to automatically generate inputs to test programs =-=[17, 19, 36, 57]-=-, and can generate inputs that cause two implementations of the same protocol to behave differently [10, 17]. Given the large number and variety of application domains, one would imagine that implemen...

Citation Context

...are Hampi with another string solver. Hampi’s source code, documentation, and the experimental data are available at http://people.csail.mit. edu/akiezun/hampi. 1. INTRODUCTION Many automatic testing =-=[7, 20, 36, 42]-=-, analysis [22], and verification [9, 10] techniques for programs can be effectively reduced to a constraint-generation phase followed by a constraint-solving phase. This separation of concerns often ...

Citation Context

..., 42, 47, 49, 50, 74, 88, 89], work with programs that do not manipulate recursive linked data structures [29, 81], or use finitization to check correctness properties within a bounded analysis scope =-=[15, 20, 38, 70, 77, 78]-=-. While systems exist that can specify, and in principle even potentially verify, the full range of desired data structure correctness properties [3,7,53,82], to the best of our knowledge no previous ...