State merging for concolic testing of event-driven applications

IF 1.5 4区计算机科学 Q3 COMPUTER SCIENCE, SOFTWARE ENGINEERING

Science of Computer Programming Pub Date : 2025-01-17 DOI:10.1016/j.scico.2025.103264

Maarten Vandercammen, Coen De Roover

{"title":"State merging for concolic testing of event-driven applications","authors":"Maarten Vandercammen, Coen De Roover","doi":"10.1016/j.scico.2025.103264","DOIUrl":null,"url":null,"abstract":"<div><div>Symbolic execution has proven itself a successful technique for automatically testing applications. However, it suffers from the <em>state explosion</em> problem, where execution of the program generates an exponential number of execution states that must be explored to fully cover the program. This problem can be mitigated by incorporating <em>state merging</em> into the testing procedure, where execution states that are sufficiently similar are merged together.</div><div>Although state merging has been applied successfully to the testing of sequential applications, testing of event-driven applications brings with it unique challenges. In event-driven programs, the creation of new execution states is driven by both branch conditions encountered by the executor and the various permutations of the application's event sequence, as every event sequence potentially gives rise to a unique set of execution states that are created. This article presents the first description of how state merging can be applied in the context of symbolic execution of event-driven applications.</div><div>Furthermore, although state merging has been described extensively for <em>online</em> symbolic execution, no mechanism has yet explicitly been described for incorporating state merging into <em>offline</em> symbolic execution, such as concolic testing. Online symbolic executors enable forking of the execution state upon reaching a branch condition that depends on symbolic input. Such testers can explore multiple program paths simultaneously. They can hence fork and merge states whenever the opportunity arises. Offline symbolic execution on the other hand, explores each program path separately. The reduced flexibility complicates the application of state merging. This article provides the first explicit overview of how state merging can be incorporated in concolic testing.</div><div>We have implemented this approach to state merging in a concolic tester for event-driven JavaScript applications named <span>StackFul</span>. We evaluate this tester on a limited set of eight small, event-driven JavaScript web applications, and find that, within the scope of these eight applications, state merging successfully alleviates the state explosion problem, resulting in the concolic tester covering a larger part of the application in fewer test iterations.</div></div>","PeriodicalId":49561,"journal":{"name":"Science of Computer Programming","volume":"242 ","pages":"Article 103264"},"PeriodicalIF":1.5000,"publicationDate":"2025-01-17","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":null,"platform":"Semanticscholar","paperid":null,"PeriodicalName":"Science of Computer Programming","FirstCategoryId":"94","ListUrlMain":"https://www.sciencedirect.com/science/article/pii/S0167642325000036","RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"Q3","JCRName":"COMPUTER SCIENCE, SOFTWARE ENGINEERING","Score":null,"Total":0}

引用次数: 0

Abstract

Symbolic execution has proven itself a successful technique for automatically testing applications. However, it suffers from the state explosion problem, where execution of the program generates an exponential number of execution states that must be explored to fully cover the program. This problem can be mitigated by incorporating state merging into the testing procedure, where execution states that are sufficiently similar are merged together.

Although state merging has been applied successfully to the testing of sequential applications, testing of event-driven applications brings with it unique challenges. In event-driven programs, the creation of new execution states is driven by both branch conditions encountered by the executor and the various permutations of the application's event sequence, as every event sequence potentially gives rise to a unique set of execution states that are created. This article presents the first description of how state merging can be applied in the context of symbolic execution of event-driven applications.

Furthermore, although state merging has been described extensively for online symbolic execution, no mechanism has yet explicitly been described for incorporating state merging into offline symbolic execution, such as concolic testing. Online symbolic executors enable forking of the execution state upon reaching a branch condition that depends on symbolic input. Such testers can explore multiple program paths simultaneously. They can hence fork and merge states whenever the opportunity arises. Offline symbolic execution on the other hand, explores each program path separately. The reduced flexibility complicates the application of state merging. This article provides the first explicit overview of how state merging can be incorporated in concolic testing.

We have implemented this approach to state merging in a concolic tester for event-driven JavaScript applications named StackFul. We evaluate this tester on a limited set of eight small, event-driven JavaScript web applications, and find that, within the scope of these eight applications, state merging successfully alleviates the state explosion problem, resulting in the concolic tester covering a larger part of the application in fewer test iterations.

查看原文本刊更多论文

用于事件驱动应用程序的聚合测试的状态合并

符号执行已被证明是自动测试应用程序的一种成功技术。然而，它有状态爆炸问题，程序的执行会产生指数级的执行状态，必须对这些状态进行探索才能完全覆盖程序。这个问题可以通过将状态合并到测试过程中来缓解，在测试过程中，将足够相似的执行状态合并在一起。尽管状态合并已经成功地应用于顺序应用程序的测试，但事件驱动应用程序的测试带来了独特的挑战。在事件驱动的程序中，新的执行状态的创建是由执行程序遇到的分支条件和应用程序事件序列的各种排列驱动的，因为每个事件序列都可能产生所创建的一组唯一的执行状态。本文首次介绍了如何在事件驱动应用程序的符号执行上下文中应用状态合并。此外，尽管对在线符号执行的状态合并进行了广泛的描述，但还没有明确描述将状态合并纳入离线符号执行的机制，例如concolic测试。在线符号执行器允许在达到依赖于符号输入的分支条件时对执行状态进行分叉。这样的测试人员可以同时探索多个程序路径。因此，只要有机会，它们就可以分叉和合并状态。另一方面，脱机符号执行分别探索每个程序路径。灵活性的降低使状态合并的应用变得复杂。本文首次明确概述了如何将状态合并合并到concolic测试中。我们已经在一个名为StackFul的事件驱动JavaScript应用程序的concolic测试器中实现了这种状态合并方法。我们在一组有限的八个小的、事件驱动的JavaScript web应用程序上评估了这个测试器，并发现，在这八个应用程序的范围内，状态合并成功地缓解了状态爆炸问题，从而导致concolic测试器在更少的测试迭代中覆盖了应用程序的更大部分。

本文章由计算机程序翻译，如有差异，请以英文原文为准。

求助全文

约1分钟内获得全文求助全文

来源期刊

Science of Computer Programming 工程技术-计算机：软件工程

CiteScore

3.80

自引率

0.00%

发文量

审稿时长

67 days

期刊介绍： Science of Computer Programming is dedicated to the distribution of research results in the areas of software systems development, use and maintenance, including the software aspects of hardware design. The journal has a wide scope ranging from the many facets of methodological foundations to the details of technical issues andthe aspects of industrial practice. The subjects of interest to SCP cover the entire spectrum of methods for the entire life cycle of software systems, including • Requirements, specification, design, validation, verification, coding, testing, maintenance, metrics and renovation of software; • Design, implementation and evaluation of programming languages; • Programming environments, development tools, visualisation and animation; • Management of the development process; • Human factors in software, software for social interaction, software for social computing; • Cyber physical systems, and software for the interaction between the physical and the machine; • Software aspects of infrastructure services, system administration, and network management.