Improving Coverage of Test Cases Generated by Symbolic PathFinder for Programs with Loops

Symbolic execution is a program analysis technique that is used for many purposes, one of which is test case generation. For loop-free programs, this generates a test set that achieves path coverage. Program loops, however, imply exponential growth of the number of paths in the best case and non-termination in the worst case. In practice, the number of loop unwindings needs to be bounded for analysis. We consider symbolic execution in the context of the tool Symbolic Pathfinder. This tool extends the Java Pathfinder model-checker and relies on its bounded state-space exploration for termination. We present an implementation of k-bounded loop un- winding, which increases the amount of user-control over the symbolic execution of loops. Bounded unwinding can be viewed as a naive way to prune paths through loops. When using symbolic execution for test case generation, branch coverage will likely be lost when paths are naively pruned. In order to improve coverage of branches within a loop body, we present a technique that semi-automatically concretizes variables used in a loop. The basic technique is limited and we therefore present annotations to manually steer symbolic execution towards certain branches, as well as ideas on how the technique can be extended to be more widely applicable.