Int J Performability Eng ›› 2021, Vol. 17 ›› Issue (7): 589-599.doi: 10.23940/ijpe.21.07.p3.589599

Previous Articles     Next Articles

Applying Slicing-based Testability Transformation to Improve Test Data Generation with Symbolic Execution

Hsin-Yu Chiena, Chin-Yu Huanga,b, and Chih-Chiang Fangb   

  1. aInstitue of Information Systems and Applications, National Tsing Hua University, Hsinchu, 300044, Taiwan;
    bDepartment of Computer Science, National Tsing Hua University, Hsinchu, 300044, Taiwan
  • Contact: * E-mail address:

Abstract: Symbolic execution techniques are widely adopted in diverse fields, including software quality analysis, software defect detection and so on. Symbolic execution engines assist people to apply the technique on exploiting and test data generation conveniently. However, symbolic execution is quite hard to scale to large and complicated programs which have massive paths and conditional statements due to path explosion. Moreover, for the development cycle of software systems, the necessity to generate test data frequently and rapidly makes them tough to apply symbolic execution technique on software testing. In this paper, we propose three modes of slicing-based testability transformations to change the semantics of programs while maintaining or improving the code coverage of generated test data by the symbolic execution tool: KLEE. The concept of these testability transformations is in decreasing the execution load of KLEE through shortening execution paths in programs. Our proposed testability transformation Mode 1 (TTM1) slices programs with an automated program slicing tool and takes functions in the program as the slicing criterion. On the other hand, our proposed testability transformations Mode 2 (TTM2) and Mode 3 (TTM3) slice programs manually and limit the max depth of paths in programs to a specific value as the slicing criterion. Experimental results show TTM1 could decrease 4.5% of solver queries while increasing 6.6% of code coverage on average. TTM2 could decrease 7.7% of solver queries while increasing 5.4% of coverage on average. TTM3 could decrease 17.6% of solver queries while increasing 3.6% of coverage on average. It can be observed that though the semantics of programs change due to slicing, the coverage of test data generated by KLEE could maintain the same or even become higher. Our finding also indicates that there is room to design slicing-based testability transformations to improve quality of test generation with symbolic execution.

Key words: symbolic execution, testability transformation, program slicing, KLEE, automated test generation