On-the-fly generation of structural tests for C functions

We propose a method for the automatic generation of structural tests satisfying the all-paths criterion. The control flow graph is not constructed at the start of the test generation process, but discovered "on-the-fly". The source code is instrumented so as to recover the symbolic execution path each time that the program under test is executed. This code is first executed using inputs arbitrarily selected from the input domain. The resulting symbolic path is transformed into a path predicate by projection of the conditions onto the input variables. The next test is obtained by using constraint logic programming to find new input values outside the domain of the path which is already covered. The instrumented code is then executed on this test and so on, until all feasible paths have been covered We thus only analyse paths which we know to be feasible and loops are only treated in their unrolled form. As a result, instead of a more global analysis of the source code which may be approximate, we perform an accurate local analysis for each path. The problems of variable renaming and the treatment of aliases, as well as the complexity of the expressions treated, are considerably reduced, thereby facilitating the detection of unsatisfiable constraints. Our approach is applicable to all imperative languages and is currently being implemented for C.