/
CONCOLIC TESTING Pınar Sağlam CONCOLIC TESTING Pınar Sağlam

CONCOLIC TESTING Pınar Sağlam - PowerPoint Presentation

elitered
elitered . @elitered
Follow
343 views
Uploaded On 2020-08-27

CONCOLIC TESTING Pınar Sağlam - PPT Presentation

Elided to examples only Example typedef struct cell int v struct cell next cell int fint v return 2v 1 int testme cell p int x if x gt 0 if p NULL ID: 804328

cell int null symbolic int cell symbolic null concrete execution struct return state abort testme cute typedef approach constraints

Share:

Link:

Embed:

Download Presentation from below link

Download The PPT/PDF document "CONCOLIC TESTING Pınar Sağlam" is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.


Presentation Transcript

Slide1

CONCOLIC TESTING

Pınar Sağlam

Elided to examples only

Slide2

Example

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Random Test Driver:

random memory graph

reachable from p

random value for x

Probability of reaching

abort( )

is

extremely low

Slide3

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

p

, x=236

NULL

Slide4

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

p

, x=236

NULL

Slide5

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p=p

0

, x=x

0

p

, x=236

NULL

Slide6

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p=p

0

, x=x

0

p

, x=236

NULL

!(p

0

!=NULL)

Slide7

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p=p

0

, x=x

0

p

, x=236

NULL

p

0

=NULL

solve: x

0

>0 and p

0

NULL

Slide8

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p=p

0

, x=x

0

p

, x=236

NULL

p

0

=NULL

solve: x

0

>0 and p

0

NULL

x

0

=236, p

0

634

NULL

Slide9

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

Slide10

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

x

0

>0

Slide11

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

x

0

>0

p

0

NULL

Slide12

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

x

0

>0

p

0

NULL

2x

0

+1

v

0

Slide13

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

x

0

>0

p

0

NULL

2x

0

+1

v

0

Slide14

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

x

0

>0

p

0

NULL

2x

0

+1

v

0

solve: x

0

>0 and p

0

NULL and 2x

0

+1

=

v

0

Slide15

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=236

NULL

634

x

0

>0

p

0

NULL

2x

0

+1

v

0

solve: x

0

>0 and p

0

NULL and 2x

0

+1

=

v

0

x

0

=1, p

0

3

NULL

Slide16

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

NULL

3

Slide17

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

NULL

3

x

0

>0

Slide18

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

NULL

3

x

0

>0

p

0

NULL

Slide19

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

NULL

3

x

0

>0

p

0

NULL

2x

0

+1

=

v

0

Slide20

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

NULL

3

x

0

>0

p

0

NULL

2x

0

+1

=

v

0

n

0

p

0

Slide21

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

NULL

3

x

0

>0

p

0

NULL

2x

0

+1

=

v

0

n

0

p

0

Slide22

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

solve: x

0

>0 and p

0

NULL and 2x

0

+1=v

0

and n

0=p0.

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n

0

p

, x=1

NULL

3

x

0

>0

p

0

NULL

2x

0

+1

=

v

0

n

0

p

0

Slide23

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

solve: x

0

>0 and p

0

NULL and 2x

0

+1=v

0

and n

0=p0x0=1, p0

3

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n

0

p

, x=1

NULL

3

x

0

>0

p

0

NULL

2x

0

+1

=

v

0

n

0

p

0

Slide24

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n0

p

, x=1

3

Slide25

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p=p

0

, x=x

0

,

p->v =v

0

, p->next=n0

p

, x=1

3

Slide26

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p

0

NULL

p=p

0

, x=x

0,p->v =v

0

,

p->next=n

0

p

, x=1

3

Slide27

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p

0

NULL

2x

0

+1

=v0

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n

0

p

, x=1

3

Slide28

CUTE Approach

typedef struct cell {

int v;

struct cell *next;

} cell;int f(int v) { return 2*v + 1;}int testme(cell *p, int x) { if (x > 0) if (p != NULL) if (f(x) == p->v) if (p->next == p) abort(); return 0;}

Concrete Execution

Symbolic Execution

concrete state

symbolic state

constraints

x

0

>0

p

0

NULL

2x

0

+1

=v0

n

0

=

p

0

p=p

0

, x=x

0

,

p->v =v

0

,

p->next=n

0

p

, x=1

3

Program Error

Slide29

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driver

Slide30

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9take then branch with constraint

x*x*x+ 3*x*x+9

!= y

Slide31

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9take then branch with constraint

x*x*x+ 3*x*x+9 != y

solve x*x*x+ 3*x*x+9 = y

to take

else branchDon’t know how to solve !!

Stuck ?

Slide32

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9take then branch with constraint

x*x*x+ 3*x*x+9 != y

solve x*x*x+ 3*x*x+9 = y

to take

else branchDon’t know how to solve !!

Stuck ?NO : CUTE handles this smartly

Slide33

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driver

Slide34

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9cannot handle symbolic value of z

Slide35

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9cannot handle symbolic value of zmake

symbolic z = 9

and proceed

Slide36

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9symbolic z = x*x*x + 3*x*x+9cannot handle symbolic value of zmake

symbolic z = 9

and proceed

take

then branch with constraint 9 != y

Slide37

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9

symbolic z = x*x*x + 3*x*x+9

cannot handle symbolic value of

z

make

symbolic z = 9 and proceedtake then branch with constraint

9 != ysolve 9 = y to take else branchexecute next run with

x = -3 and y= 9got error (reaches abort)

Slide38

Simultaneous Symbolic & Concrete Execution

void

again_test_me

(int x,int y){

z = x*x*x + 3*x*x + 9; if(z != y){ printf(“Good branch”); } else { printf(“Bad branch”); abort(); }} Let initially x = -3 and y = 7 generated by random test-driverconcrete z = 9

symbolic z = x*x*x + 3*x*x+9

cannot handle symbolic value of

z

make

symbolic z = 9 and proceedtake then branch with constraint

9 != ysolve 9 = y to take else branchexecute next run with

x = -3 and y= 9got error (reaches abort)

Replace

symbolic expression by

concrete value when symbolic expression becomes unmanageable (i.e. non-linear)