Elided to examples only Example typedef struct cell int v struct cell next cell int fint v return 2v 1 int testme cell p int x if x gt 0 if p NULL ID: 804328
Download The PPT/PDF document "CONCOLIC TESTING Pınar Sağlam" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.
Slide1
CONCOLIC TESTING
Pınar Sağlam
Elided to examples only
Slide2Example
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Random Test Driver:
random memory graph
reachable from p
random value for x
Probability of reaching
abort( )
is
extremely low
Slide3CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
p
, x=236
NULL
Slide4CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
p
, x=236
NULL
Slide5CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p=p
0
, x=x
0
p
, x=236
NULL
Slide6CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p=p
0
, x=x
0
p
, x=236
NULL
!(p
0
!=NULL)
Slide7CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p=p
0
, x=x
0
p
, x=236
NULL
p
0
=NULL
solve: x
0
>0 and p
0
NULL
Slide8CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p=p
0
, x=x
0
p
, x=236
NULL
p
0
=NULL
solve: x
0
>0 and p
0
NULL
x
0
=236, p
0
634
NULL
Slide9CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
Slide10CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
x
0
>0
Slide11CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
x
0
>0
p
0
NULL
Slide12CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
x
0
>0
p
0
NULL
2x
0
+1
v
0
Slide13CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
x
0
>0
p
0
NULL
2x
0
+1
v
0
Slide14CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
x
0
>0
p
0
NULL
2x
0
+1
v
0
solve: x
0
>0 and p
0
NULL and 2x
0
+1
=
v
0
Slide15CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=236
NULL
634
x
0
>0
p
0
NULL
2x
0
+1
v
0
solve: x
0
>0 and p
0
NULL and 2x
0
+1
=
v
0
x
0
=1, p
0
3
NULL
Slide16CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
NULL
3
Slide17CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
NULL
3
x
0
>0
Slide18CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
NULL
3
x
0
>0
p
0
NULL
Slide19CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
NULL
3
x
0
>0
p
0
NULL
2x
0
+1
=
v
0
Slide20CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
NULL
3
x
0
>0
p
0
NULL
2x
0
+1
=
v
0
n
0
p
0
Slide21CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
NULL
3
x
0
>0
p
0
NULL
2x
0
+1
=
v
0
n
0
p
0
Slide22CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
solve: x
0
>0 and p
0
NULL and 2x
0
+1=v
0
and n
0=p0.
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n
0
p
, x=1
NULL
3
x
0
>0
p
0
NULL
2x
0
+1
=
v
0
n
0
p
0
Slide23CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
solve: x
0
>0 and p
0
NULL and 2x
0
+1=v
0
and n
0=p0x0=1, p0
3
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n
0
p
, x=1
NULL
3
x
0
>0
p
0
NULL
2x
0
+1
=
v
0
n
0
p
0
Slide24CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n0
p
, x=1
3
Slide25CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p=p
0
, x=x
0
,
p->v =v
0
, p->next=n0
p
, x=1
3
Slide26CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p
0
NULL
p=p
0
, x=x
0,p->v =v
0
,
p->next=n
0
p
, x=1
3
Slide27CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p
0
NULL
2x
0
+1
=v0
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n
0
p
, x=1
3
Slide28CUTE Approach
typedef struct cell {
int v;
struct cell *next;
} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}
Concrete Execution
Symbolic Execution
concrete state
symbolic state
constraints
x
0
>0
p
0
NULL
2x
0
+1
=v0
n
0
=
p
0
p=p
0
, x=x
0
,
p->v =v
0
,
p->next=n
0
p
, x=1
3
Program Error
Slide29Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driver
Slide30Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9take then branch with constraint
x*x*x+ 3*x*x+9
!= y
Slide31Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9take then branch with constraint
x*x*x+ 3*x*x+9 != y
solve x*x*x+ 3*x*x+9 = y
to take
else branchDon’t know how to solve !!
Stuck ?
Slide32Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9take then branch with constraint
x*x*x+ 3*x*x+9 != y
solve x*x*x+ 3*x*x+9 = y
to take
else branchDon’t know how to solve !!
Stuck ?NO : CUTE handles this smartly
Slide33Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driver
Slide34Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9cannot handle symbolic value of z
Slide35Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9cannot handle symbolic value of zmake
symbolic z = 9
and proceed
Slide36Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9cannot handle symbolic value of zmake
symbolic z = 9
and proceed
take
then branch with constraint 9 != y
Slide37Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9
symbolic z = x*x*x + 3*x*x+9
cannot handle symbolic value of
z
make
symbolic z = 9 and proceedtake then branch with constraint
9 != ysolve 9 = y to take else branchexecute next run with
x = -3 and y= 9got error (reaches abort)
Slide38Simultaneous Symbolic & Concrete Execution
void
again_test_me
(int x,int y){
z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9
symbolic z = x*x*x + 3*x*x+9
cannot handle symbolic value of
z
make
symbolic z = 9 and proceedtake then branch with constraint
9 != ysolve 9 = y to take else branchexecute next run with
x = -3 and y= 9got error (reaches abort)
Replace
symbolic expression by
concrete value when symbolic expression becomes unmanageable (i.e. non-linear)