Path-oriented test data generation using symbolic execution and constraint solving techniques

Abstract

Automatic test data generation is a challenging task in software engineering research. This paper studies a path-oriented approach to the problem, which is based on the combination of symbolic execution and constraint solving. Methods for representing expressions and path conditions are discussed. An implemented toolkit is described with some examples. The toolkit transforms an input program (possibly embedded with assertions) to an extended finite state machine and then performs depth-first or breadth-first search on it. The goal is to find values for input variables such that a terminal state can be reached. If successful, input test data are found (which might reveal a bug in the program).