A CIL Tutorial - Department of Computer Science - ETH Zürich

Chapter 15
Automated Test Generation
In this tutorial we will use CIL to instrument programs with calls to an SMT solver such that
running annotated functions will generate a high-coverage set of test inputs for those functions. For
example, if a function denition is annotated as follows:
void (autotest foo)(int input a, int input b) {...}
then a set of (a,b) pairs will be generated such that as many conditionals in foo as possible have
both true and false branches taken when run over the set of pairs.
This approach works as follows. The autotest functions are instrumented such that they
run both concretely (as usual) and symbolically (in terms of inputs) when called. When run
symbolically, the autotest runtime builds a conjunction of true conditionals for each executed
branch. This conjunction is called the path condition. If we were to send this path condition to our
SMT solver, it would generate a model that would drive the program down the same path, taking
the same branches, and generating the same path condition. However, if we change the sense of
one of the conjuncts in the path condition, the SMT solver will generate a model that should drive
the program down a dierent path, in particular taking the branch corresponding to the conjunct
whose sense was was changed in a dierent direction than before.
Consider the example autotest function in Figure 15.1. Using random a's and b's, it would be
dicult to cause the the true branch of either of the conditionals to be taken. Suppose, however,
that we run the function concretely with the call foo(0,0), and also run the program symbolically
in terms of inputs a0 and b0.
The symbolic execution generates the path condition given by Figure 15.2. If we negate one of
the disequalities, for example if we replace (d != 700) with (d == 700), and ask an SMT solver
to give a model (that is, an assignment of the free variables a0 and b0) that causes the modied
path condition to be true, then we will have obtained inputs to foo that cause the second branch
to be taken. This process is repeated until as many conditionals as possible in foo have had both
branches taken by the set of generated inputs.
125