Achieving High Coverage for Floating-point Code via Unconstrained Programming (Extended Version)
This provides a novel solution for software testers and developers dealing with floating-point code, which is often difficult to test due to constraints, though it is incremental as it builds on optimization techniques.
The paper tackles the challenge of testing floating-point code by transforming it into an unconstrained optimization problem, where minimizing a derived representing function generates test inputs that guarantee new branch coverage. The tool CoverMe achieved an average of 90.8% branch coverage in 6.9 seconds on Sun's C math library, outperforming random testing, AFL, and Austin.
Achieving high code coverage is essential in testing, which gives us confidence in code quality. Testing floating-point code usually requires painstaking efforts in handling floating-point constraints, e.g., in symbolic execution. This paper turns the challenge of testing floating-point code into the opportunity of applying unconstrained programming --- the mathematical solution for calculating function minimum points over the entire search space. Our core insight is to derive a representing function from the floating-point program, any of whose minimum points is a test input guaranteed to exercise a new branch of the tested program. This guarantee allows us to achieve high coverage of the floating-point program by repeatedly minimizing the representing function. We have realized this approach in a tool called CoverMe and conducted an extensive evaluation of it on Sun's C math library. Our evaluation results show that CoverMe achieves, on average, 90.8% branch coverage in 6.9 seconds, drastically outperforming our compared tools: (1) Random testing, (2) AFL, a highly optimized, robust fuzzer released by Google, and (3) Austin, a state-of-the-art coverage-based testing tool designed to support floating-point code.