Structural coverage of feasible code（AST ’10, May 3-4, 2010, Cape Town, South Africa）

本文的主要思想是：

      通过判断和修剪不可达分支，找到一种新的结构测试技术，以提高程序结构测试的覆盖度和结构测试测量的精确度。为此，我们把动态分析、concolic execution和abstraction refinemen结合起来以克服传统方法的局限性。动态分析监视测试的执行以确定程序状态空间中被覆盖的元素和可达路径，concolic execution计算路径约束以确定如何遍历未被覆盖的路径和元素，并对路径约束进行求解以生成测试这些未覆盖路径的测试用例，Abstraction refinement修剪哪些不满足路径约束的不可达元素。不可达元素的定义：原文 An element is identified as infeasible when all the execution paths that lead to that element are infeasible.

1 Background: Static-dynamic reachability

DASH splits s1 into two new states annotated with complementary refinement predicates, namely the weakest precondition of s2 through the frontier transition (wp) and its negation (!wp)2. All test cases that reach s1 reach also [!wp]s1, while state s2 may be reachable from [wp]s1, but not from [!wp]s1.

2 From reachability to structural coverage

   the obtained coverage cov as cov =|covered|/(|target| − |infeasible|)

3. PROTOTYPE
  We have implemented a prototype tool for branch coverage,Star (Software Testing by Abstraction Refinement),built on top of Crest 4, an automatic test generation tool for C, based on concolic execution. Crest in turns relies on Cil5 for the instrumentation and static analysis of C code,and on the Yices6 SMT solver.Star refines an abstract model that represents the branchesof the program and the flow relations between them. The initial model is extracted from the static control flow graph.Star implements the iterative refinement and coarsening algorithm
presented in Section 4 to determine the feasibility of the branches in the model, and exploits the concolic execution of Crest to investigate the feasibility of frontier transitions.