Towards exhaustive branch coverage with PathCrawler
This work addresses a specific problem in software verification for developers and testers, offering incremental improvements to existing methods.
The paper tackles the challenge of achieving exhaustive branch coverage in automatic test generation, where existing tools often fail to explain uncovered branches. It proposes strategies to improve concolic test generation for this goal, showing promising results on real code examples.
Branch coverage of source code is a very widely used test criterion. Moreover, branch coverage is a similar problem to line coverage, MC/DC and the coverage of assertion violations, certain runtime errors and various other types of test objective. Indeed, establishing that a large number of test objectives are unreachable, or conversely, providing the test inputs which reach them, is at the heart of many verification tasks. However, automatic test generation for exhaustive branch coverage remains an elusive goal: many modern tools obtain high coverage scores without being able to provide an explanation for why some branches are not covered, such as a demonstration that they are unreachable. Concolic test generation offers the promise of exhaustive coverage but covers paths more efficiently than branches. In this paper, I explain why, and propose different strategies to improve its performance on exhaustive branch coverage. A comparison of these strategies on examples of real code shows promising results.