Proceedings of the 2015 International Symposium on Software Testing and Analysis最新文献_第3页

Reliable testing: detecting state-polluting tests to prevent test dependency 可靠的测试:检测污染状态的测试，以防止测试依赖

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771793

A. Gyori, A. Shi, Farah Hariri, D. Marinov

{"title":"Reliable testing: detecting state-polluting tests to prevent test dependency","authors":"A. Gyori, A. Shi, Farah Hariri, D. Marinov","doi":"10.1145/2771783.2771793","DOIUrl":"https://doi.org/10.1145/2771783.2771793","url":null,"abstract":"Writing reliable test suites for large object-oriented systems is complex and time consuming. One common cause of unreliable test suites are test dependencies that can cause tests to fail unexpectedly, not exposing bugs in the code under test but in the test code itself. Prior research has shown that the main reason for test dependencies is the ``pollution'' of state shared across tests. We propose a technique, called , for finding tests that pollute the shared state. In a nutshell, finds tests that modify some location on the heap shared across tests or on the file system; a subsequent test could fail if it assumes the shared location to have the initial value before the state was modified. To aid in inspecting the pollutions, provides an access path through the heap that leads to the polluted value or the name of the file that was modified. We implemented a prototype tool for Java and evaluated it on NumOfProjects projects, with a total of NumOfTests tests. Diaper reported PollutingTests , and our inspection found that NumOfTPsSpace of those are relevant pollutions that can easily affect other tests.","PeriodicalId":264859,"journal":{"name":"Proceedings of the 2015 International Symposium on Software Testing and Analysis","volume":"242 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121207034","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 78

ConcBugAssist: constraint solving for diagnosis and repair of concurrency bugs ConcBugAssist:用于诊断和修复并发错误的约束求解

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771798

Sepideh Khoshnood, Markus Kusano, Chao Wang

引用次数: 58

DLint: dynamically checking bad coding practices in JavaScript DLint:动态检查JavaScript中的不良编码实践

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771809

Liang Gong, Michael Pradel, Manu Sridharan, Koushik Sen

引用次数: 65

Experience report: an empirical study of PHP security mechanism usage 体验报告:PHP安全机制使用的实证研究

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771787

J. Dahse, Thorsten Holz

{"title":"Experience report: an empirical study of PHP security mechanism usage","authors":"J. Dahse, Thorsten Holz","doi":"10.1145/2771783.2771787","DOIUrl":"https://doi.org/10.1145/2771783.2771787","url":null,"abstract":"The World Wide Web mainly consists of web applications written in weakly typed scripting languages, with PHP being the most popular language in practice. Empirical evidence based on the analysis of vulnerabilities suggests that security is often added as an ad-hoc solution, rather than planning a web application with security in mind during the design phase. Although some best-practice guidelines emerged, no comprehensive security standards are available for developers. Thus, developers often apply their own favorite security mechanisms for data sanitization or validation to prohibit malicious input to a web application. In the context of our development of a new static code analysis tool for vulnerability detection, we studied commonly used input sanitization or validation mechanisms in 25 popular PHP applications. Our analysis of 2.5 million lines of code and over 26 thousand secured data flows provides a comprehensive overview of how developers utilize security mechanisms in practice regarding different markup contexts. In this paper, we discuss these security mechanisms in detail and reveal common pitfalls. For example, we found certain markup contexts and security mechanisms more frequently vulnerable than others. Our empirical study helps researchers, web developers, and tool developers to focus on error-prone markup contexts and security mechanisms in order to detect and mitigate vulnerabilities.","PeriodicalId":264859,"journal":{"name":"Proceedings of the 2015 International Symposium on Software Testing and Analysis","volume":"30 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116279788","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 7

When truth is efficient: analysing concurrency 当事实是有效的:分析并发性

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771790

G. Narayanaswamy

引用次数: 2

Evaluating the usefulness of IR-based fault localization techniques 评估基于红外光谱的故障定位技术的有效性

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771797

Qianqian Wang, Chris Parnin, A. Orso

{"title":"Evaluating the usefulness of IR-based fault localization techniques","authors":"Qianqian Wang, Chris Parnin, A. Orso","doi":"10.1145/2771783.2771797","DOIUrl":"https://doi.org/10.1145/2771783.2771797","url":null,"abstract":"Software debugging is tedious and time consuming. To reduce the manual effort needed for debugging, researchers have proposed a considerable number of techniques to automate the process of fault localization; in particular, techniques based on information retrieval (IR) have drawn increased attention in recent years. Although reportedly effective, these techniques have some potential limitations that may affect their performance. First, their effectiveness is likely to depend heavily on the quality of the bug reports; unfortunately, high-quality bug reports that contain rich information are not always available. Second, these techniques have not been evaluated through studies that involve actual developers, which is less than ideal, as purely analytical evaluations can hardly show the actual usefulness of debugging techniques. The goal of this work is to evaluate the usefulness of IR-based techniques in real-world scenarios. Our investigation shows that bug reports do not always contain rich information, and that low-quality bug reports can considerably affect the effectiveness of these techniques. Our research also shows, through a user study, that high-quality bug reports benefit developers just as much as they benefit IR-based techniques. In fact, the information provided by IR-based techniques when operating on high-quality reports is only helpful to developers in a limited number of cases. And even in these cases, such information only helps developers get to the faulty file quickly, but does not help them in their most time consuming task: understanding and fixing the bug within that file.","PeriodicalId":264859,"journal":{"name":"Proceedings of the 2015 International Symposium on Software Testing and Analysis","volume":"51 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121869969","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 126

Randomized stress-testing of link-time optimizers 链接时间优化器的随机压力测试

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771785

Vu Le, Chengnian Sun, Z. Su

{"title":"Randomized stress-testing of link-time optimizers","authors":"Vu Le, Chengnian Sun, Z. Su","doi":"10.1145/2771783.2771785","DOIUrl":"https://doi.org/10.1145/2771783.2771785","url":null,"abstract":"Link-time optimization (LTO) is an increasingly important and adopted modern optimization technology. It is currently supported by many production compilers, including GCC, LLVM, and Microsoft Visual C/C++. Despite its complexity, but because it is more recent, LTO is relatively less tested compared to the more mature, traditional optimizations. To evaluate and help improve the quality of LTO, we present the first extensive effort to stress-test the LTO components of GCC and LLVM, the two most widely-used production C compilers. In 11 months, we have discovered and reported 37 bugs (12 in GCC; 25 in LLVM). Developers have confirmed 21 of our bugs, and fixed 11 of them. Our core technique is differential testing and realized in the tool Proteus. We leverage existing compiler testing tools (Csmith and Orion) to generate single-file test programs and address two important challenges specific for LTO testing. First, to thoroughly exercise LTO, Proteus automatically transforms a single-file program into multiple compilation units and stochastically assigns each an optimization level. Second, for effective bug reporting, we develop a practical mechanism to reduce LTO bugs involving multiple files. Our results clearly demonstrate Proteus’s utility; we plan to make ours a continuous effort in validating link-time optimizers.","PeriodicalId":264859,"journal":{"name":"Proceedings of the 2015 International Symposium on Software Testing and Analysis","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125622591","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 45

S-looper: automatic summarization for multipath string loops S-looper:自动总结多路径字符串循环

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771815

Xiaofei Xie, Yang Liu, Wei Le, Xiaohong Li, Hongxu Chen

{"title":"S-looper: automatic summarization for multipath string loops","authors":"Xiaofei Xie, Yang Liu, Wei Le, Xiaohong Li, Hongxu Chen","doi":"10.1145/2771783.2771815","DOIUrl":"https://doi.org/10.1145/2771783.2771815","url":null,"abstract":"Loops are important yet most challenging program constructs to analyze for various program analysis tasks. Existing loop analysis techniques mainly handle well loops that contain only integer variables with a single path in the loop body. The key challenge in summarizing a multiple-path loop is that a loop traversal can yield a large number of possibilities due to the different execution orders of these paths located in the loop; when a loop contains a conditional branch related to string content, we potentially need to track every character in the string for loop summarization, which is expensive. In this paper, we propose an approach, named S-Looper, to automatically summarize a type of loops related to a string traversal. This type of loops can contain multiple paths, and the branch conditions in the loop can be related to string content. Our approach is to identify patterns of the string based on the branch conditions along each path in the loop. Based on such patterns, we then generate a loop summary that describes the path conditions of a loop traversal as well as the symbolic values of each variable at the exit of a loop. Combined with vulnerability conditions, we are thus able to generate test inputs that traverse a loop in a specific way and lead to exploitation. Our experiments show that handling such string loops can largely improve the buffer overflow detection capabilities of the existing symbolic analysis tool. We also compared our techniques with KLEE and PEX, and show that we can generate test inputs more effectively and efficiently.","PeriodicalId":264859,"journal":{"name":"Proceedings of the 2015 International Symposium on Software Testing and Analysis","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2015-07-13","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129849162","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 31

Empirical evaluation of pareto efficient multi-objective regression test case prioritisation 帕累托有效多目标回归测试用例优先级的实证评价

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783.2771788

M. Epitropakis, S. Yoo, M. Harman, E. Burke

引用次数: 89

Proceedings of the 2015 International Symposium on Software Testing and Analysis 2015软件测试与分析国际研讨会论文集

Proceedings of the 2015 International Symposium on Software Testing and Analysis Pub Date : 2015-07-13 DOI: 10.1145/2771783

M. Young, Tao Xie

引用次数: 1