JP6330490B2 - Test case generation program, test case generation apparatus, and test case generation method - Google Patents

Description

  The present invention relates to a test case generation program, a test case generation device, and a test case generation method.

  Conventionally, an operation for executing a computer program and confirming whether or not it operates correctly has been performed.

  In order to execute a program test, a test case including input data (test data) and expected results is required. A set of test cases to be executed in the test is referred to as a test case set here. In the test, it is necessary to prepare a test case set to cover all the viewpoints to be confirmed.

  Here, we focus on the white box test of the program. In the white box test, a test case is prepared and the test is executed so as to cover instructions, branches, or execution paths in the program according to the code coverage index.

  The preparation of test cases, especially the creation of input data, is often done manually and requires a lot of effort. As a method for solving this labor, a test data generation technique based on symbolic execution has been attracting attention in recent years.

  As a technique for improving the efficiency of symbolic execution, for example, techniques described in Patent Document 1 and Patent Document 2 are known.

Japanese Unexamined Patent Publication No. 2011-191985 JP 2013-143067 A

  In symbolic execution, the range of paths to be searched and executed in order to generate a path condition is widened, and there is a concern of causing a so-called combination explosion that cannot be handled with practical time and space complexity. In order to suppress combinational explosions, it is desirable to improve the efficiency of symbolic execution.

  An object of the present invention is to realize the efficiency of symbolic execution in generating a test case of a program by symbolic execution.

In one aspect, an index value that is a symbol variable representing the position of each of a plurality of elements constituting an array and an unselected index value that is not excluded is selected, and the index value is selected from the selection target. Further, by executing symbolically the target program, a path condition representing a path that branches depending on the element corresponding to the selected index value is generated. Further, the generated path condition and test data passing through the path represented by the generated path condition are output as test cases. In addition, the index value included in the selection target, the index value corresponding to the same element as the element that generated the path condition satisfies the index equivalent condition that excludes the constraint derived from the index value from the generated path condition Determine if it is possible. Further, a satisfiable index value is excluded from the selection target.

  As one aspect, in the generation of a test case of a program by symbolic execution, the efficiency of symbolic execution can be realized.

It is a block diagram which shows schematic structure of an example of the test case production | generation apparatus of this embodiment. It is a figure which shows the specific example of the program (TargetClass.method1) used as the symbolic execution object of this embodiment. FIG. 3 is a flowchart showing the flow of the program shown in FIG. 2. It is a figure for demonstrating the production | generation of the test case by the test case production | generation apparatus of this embodiment. It is a figure showing the execution space of the program shown in FIG. 2 in the symbolic execution by the test case production | generation apparatus of this embodiment. It is a figure for demonstrating the specific example of the test case produced | generated with the test case production | generation apparatus of this embodiment. It is a block diagram which shows schematic structure of an example of the test case production | generation apparatus of a present Example. It is a block diagram which shows schematic structure of the computer which functions as a test case production | generation apparatus. It is a figure which shows the specific example of the program (TargetClass.method1) used as the symbolic execution object based on a present Example. FIG. 10 is a flowchart showing the flow of the program shown in FIG. 9. It is a flowchart which shows an example of the test case production | generation process performed with a test case production | generation apparatus. It is a figure for demonstrating the specific example of the test case produced | generated with the test case production | generation apparatus of a present Example. It is a flowchart which shows an example of the symbolic execution process performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 1 performed with the test case production | generation apparatus of a present Example. It is a flowchart which shows an example of the branch selection process performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 2 performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 3 performed with the test case production | generation apparatus of a present Example. It is a figure explaining other examples of the same element index information. It is a figure for demonstrating the procedure 4 performed with the test case production | generation apparatus of a present Example. It is a flowchart which shows an example of the information update process performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 5 performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 6 performed with the test case production | generation apparatus of a present Example. It is a flowchart which shows an example of the backtrack destination determination process performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 7 performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 4 (2nd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 5 (2nd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 6 (2nd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 7 (2nd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 4 (3rd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 5 (3rd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 6 (3rd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 7 (3rd time) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 4 (4th) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 5 (4th) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 6 (4th) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the procedure 7 (4th) performed with the test case production | generation apparatus of a present Example. It is a figure for demonstrating the example of symbolic execution in case the some array access exists on the same path. It is a figure for demonstrating the method of the symbolic execution of a comparative example. It is a figure showing the execution space of the program shown in FIG. 2 in the symbolic execution by the test case production | generation apparatus of a comparative example.

  Hereinafter, an example of the disclosed technique will be described in detail with reference to the drawings.

  First, an outline of an example of the disclosed technique will be described. FIG. 1 is a block diagram illustrating a schematic configuration of an example of a test case generation device 10 according to the present embodiment. As illustrated in FIG. 1, the test case generation device 10 includes a symbolic execution unit 12, an index access detection unit 14, and an index selection unit 16. Further, the test case generation apparatus 10 includes an identical element index information generation unit 18, an identical element determination unit 20, an index equivalent condition generation unit 22, and an index equivalence determination unit 24.

  The test case generation apparatus 10 of the present embodiment has a function of performing symbolic execution using an index representing the position of a plurality of elements constituting an array as a symbol variable.

  Symbolic execution is a technique that does not embody variables in a program but executes them with special values called symbol values. A variable that holds this symbol value is called a symbol variable.

  In symbolic execution, when a symbol variable is used for a determination condition such as a branch, each pattern when the determination condition is satisfied and when the determination condition is not satisfied is comprehensively executed. In this case, in order to execute the current pattern, that is, in order to satisfy and not satisfy the determination condition, the condition that the symbol value must satisfy is held. A condition that a symbol value must satisfy is called a path condition. The path condition is held for each execution path executed by symbolic execution. If there is no symbol value that satisfies a certain path condition, the execution path that holds the path condition is not executable and can be excluded from the test target. For an execution path that holds a satisfying path condition, test data can be generated by regarding the satisfaction value of the path condition as test data. The path condition satisfied by each test data indicates what execution path the test data has passed through, and gives a certain meaning to the test data.

  Basic items regarding symbolic execution are described in non-patent documents Tetsuo Tamai, Koichi Fukunaga, “Symbol Execution System”, Information Processing, pp.18-28, etc. Further, as a symbolic execution engine for a Java (registered trademark) program, Java (registered trademark) PathFinder or the like is disclosed at http://babelfish.arc.nasa.gov/trac/jpf. Further, as a known example of the symbolic execution technique, a technique described in JP 2009-087355 A can be cited. For this reason, detailed description of basic matters related to symbolic execution is omitted here.

  The symbolic execution unit 12, which is an example of the execution unit of the disclosed technology, has a function of performing symbolic execution on a program 11 that is a symbolic execution target (hereinafter, “target program”). Further, the symbolic execution unit 12 has a function of generating and outputting a test case 33 including the test data regarding the symbol variable and the path condition 26. Specifically, the symbolic execution unit 12 performs symbolic execution and generates a path condition 26 representing a path through which an element (symbol value) corresponding to the index value selected by the index selection unit 16 passes. Further, the symbolic execution unit 12 outputs a test case 33 including the test data that satisfies the generated path condition 26 and the path condition.

  In symbolic execution, it is necessary to express path conditions related to array access in a form that can be handled by the constraint solver. The conditional expressions that can be handled by the constraint solver are related to primitives such as numerical values and character strings, or data types equivalent thereto, and cannot handle conditional expressions whose data type is a general object type (Object type) such as instanceof. Therefore, the symbolic execution unit 12 generates a path condition 26 whose data type is an int type.

  The index access detection unit 14 has a function of detecting whether an instruction executed by the symbolic execution unit 12 is an access instruction to an element constituting an array having a symbol variable as an index. The index access detection unit 14 is an example of a detection unit according to the disclosed technique.

  The index selection unit 16, which is an example of the selection unit of the disclosed technique, has a function of selecting an index value that continues the subsequent processing of the current instruction from among the index values. The symbolic execution unit 12 generates a path condition 26 corresponding to the selected index value. Therefore, specifically, the index selection unit 16 has a function of selecting an index value for generating a path condition by the symbolic execution unit 12 and outputting it to the symbolic execution unit 12. More specifically, the index selection unit 16 generates index selection information 28 that is information indicating a selected index value and an unselected index value. An unselected index value of the index selection information 28 is an index value selection target. The index selection unit 16 has a function of selecting an unselected index value from the generated index selection information 28 and outputting it to the symbolic execution unit 12.

  The same element determination unit 20 has a function of determining whether or not elements existing in an array when executing an instruction are the same.

  The same element index information generation unit 18 has a function of generating the same element index information 30 in which index values storing the same element are collected in response to an access instruction having an array using a symbol variable as an index. Specifically, the same element index information generation unit 18 generates the same element index information 30 based on the determination result of the same element determination unit 20. The same element index information generation unit 18 is an example of a generation unit of the disclosed technology.

  The index equivalent condition generation unit 22 has a function of generating an index equivalent condition 32 from a corresponding path condition with respect to an execution path including an array access instruction using a symbol variable as an index. Specifically, the index equivalent condition 32 is obtained by excluding the constraint expression derived from the index value selected from the path condition 26 generated by the symbolic execution unit 12. That is, the index equivalent condition 32 is a condition for having the same element and having the same index value through the same path.

  The index equivalence determination unit 24 has a function of determining whether or not an unselected index value corresponding to the same element as the index value element used in the symbolic execution unit 12 can satisfy the index equivalence condition 32. Specifically, based on the same element index information 30, the same element as the index value element used in the symbolic execution unit 12 is detected and determined. In addition, the index equivalence determination unit 24 has a function of excluding the determined index value from the unselected index values in the index selection information 28 when it is determined that the index value can satisfy the index equivalence condition 32. That is, the index equivalence determination unit 24 has a function of excluding index values that can satisfy the index equivalence condition 32 from the index values to be selected. Specifically, the index equivalence determination unit 24 updates the index value to be excluded from the selection target by changing the index selection information 28 from unselected to selected.

  As described above, since the index equivalence determining unit 24 updates the index value to change from unselected to selected, the index value is excluded from the selection target. There is no choice. For this reason, the symbolic execution unit 12 does not generate path conditions for the thinned index values (execution of subsequent processing).

  The operation of the test case generation device 10 will be described. As a specific example, a case where the test case generation apparatus 10 performs symbolic execution on TargetClass.method1 to generate a test case 33 will be described. FIG. 2 shows a specific example of the program (TargetClass.method1). FIG. 3 is a flowchart showing the flow of the program shown in FIG. The numbers in the symbols of the flowchart shown in FIG. 3 correspond to program lines. Further, FIG. 4 shows a diagram for explaining test case generation by the test case generation apparatus 10.

  The test case generation apparatus 10 executes symbolic execution of the program (TargetClass.method1) shown in FIGS. In TargetClass.method1, idx is specified as a symbol variable. If the symbol value for this idx is α, the symbolic execution searches the execution space shown in FIG.

  After starting symbolic execution, the symbolic execution unit 12 executes the instruction on the 06th line of the program. Here, since there is no operation related to the symbol variable, no branch is generated in the execution space, and the symbolic execution unit 12 continues to execute the 07th line. The instruction “value = array [α]” on the 07th line accesses the array. In this case, the index value used for access is a symbol value, and since the elements of the array to be returned differ depending on the symbol value condition, a branch occurs in the execution space. This corresponds to a branch where each edge occurs from the 07th line of the execution space. Labels such as “α == 0” and “α == 1” given to the edges suggest case classification such as when the index value is “0” and “1”, respectively. Here, at the time of execution of the 07th row, six elements (“a1”, “b1”, “a2”, “b1”, “b1”, and “a1”) are stored in the array. Yes.

  The index access detection unit 14 detects that “value = array [α]” on the 07th line is an instruction to access an array using a symbol variable.

  The same element index information generation unit 18 and the same element determination unit 20 generate the same element index information 30 based on this array. 4 and 5 show specific examples of the generated identical element index information 30. FIG.

  The index selection unit 16 generates index selection information 28. In the index selection information 28 before update shown in FIG. 4, the index values “0” and “5” have already been selected, and the index selection unit 16 newly selects the index value “1”. The state output to the execution unit 12 is shown.

  The symbolic execution unit 12 generates a path condition 26 corresponding to the index value “1”. Here, as shown in FIGS. 4 and 5, “α == 1 && α <4” is generated as the path condition 26. The symbolic execution unit 12 outputs a test case whose test input is “idx (α): 1” and whose path condition is “α == 1 && α <4” as one of the test cases 33.

  The index equivalent condition generation unit 22 generates an index equivalent condition 32 in which the restriction derived from the index value (idx) is removed from the generated path condition 26. When the path condition 26 is “α == 1 && α <4”, since “α == 1” is excluded, the index equivalence condition 32 is “α <4”.

  The index equivalence determination unit 24 determines an index value that can satisfy the index equivalence condition 32 based on the same element index information 30. In the case of the above specific example, according to the same element index information 30, the index values having the same element as the index value “1” are “3” and “4”. When the index value is “3”, the index equivalent condition 32 “α <4” is satisfied. On the other hand, when the index value is “4”, the index equivalent condition 32 “α <4” cannot be satisfied. Therefore, the index equivalence determination unit 24 determines that the index value “3” can be satisfied. That is, when the index value is “3”, the path condition 26 is the same as when the index value is “1”. Therefore, it is difficult to check the operation of the program without generating a test case (without performing a test). There is no. Therefore, the index equivalence determination unit 24 changes the index value “3” from unselected to selected, and updates the index selection information 28. Since the index value “3” has been selected, the index selection unit 16 does not select the index value “3”. Therefore, the symbolic execution unit 12 does not generate the path condition 26 corresponding to the index value “3”.

  FIG. 6 shows the test case 33 formed by the test case generation apparatus 10 as described above. As shown in FIG. 5, when the index values are “0” and “5”, the test case generation apparatus 10 can combine the generated test cases into one. Further, as shown in FIG. 5, when the index values are “1” and “3”, the test case generation apparatus 10 can combine the generated test cases into one. Therefore, in the test case generation apparatus 10, as shown in FIG. From 1 to 4, a test case 33 including four test cases is generated.

(Comparative example)
Here, a case where symbolic execution is performed by a conventional test case generation device will be described as a comparative example.

In symbolic execution, each branch related to a symbol variable is searched for and executed when the branch condition is satisfied and when it is not satisfied. That is, it is equivalent to performing a combination of establishment / non-establishment of each branch condition. Since the number of combinations increases geometrically with respect to the number of branch conditions related to the symbol variable, the number of combinations becomes too large for a program with a certain size, so that the computing resources required for symbolic execution are prepared. It will exceed. For example, consider a program in which n independent branches exist as shown in FIG. Since the program shown in FIG. 38 has ²ⁿ paths as a combination of branches, there is a concern that a combination explosion may easily occur.

  As a conventional technique of symbolic execution for a program including access to an array, the following method will be described as a comparative example. In the method of the comparative example, when index access to an array by a symbol variable is encountered during symbolic execution, the path when each element is selected is analyzed for all elements constituting the array. For example, when there are three elements in the array, all execution patterns when 0th, 1st, and 2nd are selected are analyzed.

  A case where the method of the comparative example is applied to the program (see FIG. 2) shown in the embodiment will be described. At the time of executing the 07th line of the instruction, six elements are stored in the array, and in the comparative example, there are six branches from “α == 0” to “α == 5” accordingly. Is generated. The symbolic execution engine analyzes these six branches, and finally searches the execution space shown in FIG. A test case including 1 to 6 test cases is obtained. Here, there are nine execution patterns that have been searched for, but it is clear from the path condition that three of these patterns have undergone a combination of branches that cannot actually pass through, and the corresponding test cases also exclude those patterns. It has become a thing.

  In the test case generation device of the comparative example, six test cases are generated as a result of searching for nine patterns. On the other hand, as described above, the test case generation apparatus 10 of the present embodiment generates a test case 33 including four test cases as a result of searching for six patterns. Thus, in the test case generation device 10 of the present embodiment, the number of patterns to be searched can be reduced, and the efficiency of symbolic execution can be improved. Therefore, in the test case generation device 10 of the present embodiment, it is possible to suppress the occurrence of a combination explosion.

(Example)
Next, the disclosed technique will be described in detail with reference to examples. In addition, since the present Example is for explaining in detail about the same technology as the test case generation device 10 described above, the same configuration and operation as described above in the test case generation device 100 will be described in detail. May be omitted.

  FIG. 7 is a block diagram illustrating a schematic configuration of an example of the test case generation device 100 according to the present embodiment. As illustrated in FIG. 7, the test case generation device 100 includes a symbolic execution unit 112, an index access detection unit 114, and an index selection unit 116. Furthermore, the test case generation apparatus 100 includes an identical element index information generation unit 118, an identical element determination unit 120, an index equivalent condition generation unit 122, and an index equivalence determination unit 124.

  The symbolic execution unit 112 corresponds to the symbolic execution unit 12 (see FIG. 1) of the test case generation apparatus 10 described above. The symbolic execution unit 112 has the same functions as the symbolic execution unit 12, but includes functional units for realizing various functions. The symbolic execution unit 112 of this embodiment includes a program execution unit 140, a path condition calculation unit 142, and a satisfiability determination unit 144.

  The program execution unit 140 has a function of performing symbolic execution on a program 111 that is a symbolic execution target (hereinafter referred to as “target program”). The path condition calculation unit 142 has a function of generating a path condition 126 by calculating a path condition 126 representing a path through which an element (symbol value) corresponding to the index value selected by the index selection unit 116 passes. The satisfiability determination unit 144 has a function of determining whether or not the index value selected by the index selection unit 116 may satisfy the path condition 126. The symbolic execution unit 112 outputs a test case 133 including the path condition 126 and the satisfiability determination result 146.

  The index access detection unit 114 corresponds to the index access detection unit 14 (see FIG. 1) of the test case generation device 10 described above. The index selection unit 116 corresponds to the index selection unit 16 (see FIG. 1) of the test case generation device 10 described above. The same element index information generation unit 118 corresponds to the same element index information generation unit 18 (see FIG. 1) of the test case generation apparatus 10 described above. Moreover, the same element determination part 120 respond | corresponds to the same element determination part 20 (refer FIG. 1) of the test case production | generation apparatus 10 mentioned above. Furthermore, the index equivalent condition generation unit 122 corresponds to the index equivalent condition generation unit 22 (see FIG. 1) of the test case generation apparatus 10 described above. Each of these functional units included in the test case generation device 100 has the same function as each functional unit of the corresponding test case generation device 10.

  The index equivalence determination unit 124 corresponds to the index equivalence determination unit 24 (see FIG. 1) of the test case generation apparatus 10 described above. The index equivalence determination unit 124 has the same function as the index equivalence determination unit 24, but includes a function unit for realizing various functions. The index equivalence determining unit 124 of this embodiment includes a check target index specifying unit 150, a symbol index specifying unit 152, a satisfiability determining unit 154, a result counting unit 156, and an index selection information updating unit 158.

  The check target index specifying unit 150 has a function of specifying an unselected index value corresponding to the same element based on the index selection information 128 and the same element index information 130. The symbol index materialization unit 152 has a function of materializing an index (symbol index) symbolized with respect to the index equivalence condition 132 to obtain a constraint solver. The satisfiability determining unit 154 has a function of determining whether or not all unselected index values can satisfy the constraint solver (index equivalence condition 132). The result totaling unit 156 has a function of totaling the determination results of the satisfiability determining unit 154. Further, the index selection information update unit 158 has a function of updating the index selection information 128 based on the tabulation results tabulated by the result tabulation unit 156.

  Note that the test case generation apparatus 100 and the test case generation apparatus 10 described above can be realized by, for example, a computer 60 shown in FIG. The computer 60 includes a CPU (Central Processing Unit) 62, a memory 64, a nonvolatile storage unit 66, an input / output interface (I / F) 68, and a network I / F 70. The CPU 62, the memory 64, the storage unit 66, the input / output I / F 68, and the network I / F 70 are connected to each other via a bus 71. The input / output I / F 68 is connected to an external input device and output device. The input device is a device having a function for inputting various information for generating a test case, and specific examples include a keyboard and a mouse. The output device is a device having a function of outputting the generated test cases 133, 33 and the like, and specific examples include various display devices such as a display, a printer, and the like.

  The storage unit 66 can be realized by an HDD (Hard Disk Drive), a flash memory, or the like. The storage unit 66 as a storage medium stores a test case generation program 72 for causing the computer 60 to function as the test case generation devices 100 and 10. The CPU 62 reads the test case generation program 72 from the storage unit 66 and expands it in the memory 64, and sequentially executes each process of the test case generation program 72.

  The test case generation program 72 includes a symbolic execution process 74, an index access detection process 76, an index selection process 78, and an identical element index information generation process 80. The test case generation program 72 includes an identical element determination process 82, an index equivalent condition generation process 84, and an index equivalence determination process 86.

  The CPU 62 operates as the symbolic execution units 112 and 12 by executing the symbolic execution process 74. Further, the CPU 62 operates as the index access detection units 114 and 14 by executing the index access detection process 76. Further, the CPU 62 operates as the index selection units 116 and 16 by executing the index selection process 78. Further, the CPU 62 operates as the same element index information generation units 118 and 18 by executing the same element index information generation process 80. The CPU 62 operates as the same element determination units 120 and 20 by executing the same element determination process 82. Further, the CPU 62 operates as the index equivalent condition generation units 122 and 22 by executing the index equivalent condition generation process 84. Further, the CPU 62 operates as the index equivalence judgment units 124 and 24 by executing the index equivalence judgment process 86.

  As a result, the computer 60 that has executed the test case generation program 72 functions as the test case generation apparatuses 100 and 10.

  Note that the test case generation apparatuses 100 and 10 can be realized by, for example, a semiconductor integrated circuit, more specifically, an ASIC (Application Specific Integrated Circuit) or the like.

  Next, a case where the test case 133 of the program (TargetClass.method1) shown in FIG. 9 is generated will be described as an example of the operation of the test case generation apparatus 100 according to the present embodiment. FIG. 9 shows a specific example of the program (TargetClass.method1). FIG. 10 is a flow chart showing the flow of the program shown in FIG. The numbers in the symbols in the flowchart shown in FIG. 10 correspond to the program lines.

  First, the overall flow of the test case generation process executed by the test case generation apparatus 100 will be described. FIG. 11 is a flowchart illustrating an example of a test case generation process executed by the test case generation apparatus 100. The test case generation process illustrated in FIG. 11 is executed when a user or the like is instructed to generate a test case via the input / output I / F 68 or the like.

  In step S100, each functional unit of the test case generation device 100 performs symbolic execution processing, which will be described in detail later, on the program (see FIG. 9) of the symbolic execution target 111. A test case 133 is generated by the symbolic execution process.

  In the present embodiment, as a specific example, the target program is stored in the memory 64 via the input / output I / F 68 or the network I / F 70.

  In the next step S102, the test case generation device 100 outputs the test case 133 generated via the input / output I / F 68 or the like, and then ends this process.

  FIG. 12 shows a test case 133 of the program shown in FIG. 9 that is generated and output by the test case generation apparatus 100 of the present embodiment.

  Next, the symbolic execution process in step S100 of the test case generation process will be described. FIG. 13 is a flowchart illustrating an example of symbolic execution processing (FIG. 11, step S100) executed by the test case generation device 100.

  First, in step S200, the symbolic execution unit 112 performs initialization as processing for starting symbolic execution. The initialization procedure will be described as procedure 1. FIG. 14 is a diagram for explaining the procedure 1 executed by the test case generation apparatus 100 according to the present embodiment.

  In the target program, as a specific example, up to the 06th line, since the symbol variable is not related, the branch of the execution path does not occur. Therefore, the symbolic execution unit 112 executes the target program up to the 06th line.

  In the next step S202, the symbolic execution unit 112 determines whether or not a subsequent instruction exists in the target program. If there is a subsequent instruction, the process proceeds to step S204.

  In step S204, the symbolic execution unit 112 analyzes the instruction of the target program, and in the next step S206, branch selection processing is executed by each functional unit. FIG. 15 is a flowchart illustrating an example of the branch selection process in step S206.

  In step S300, the index access detection unit 114 determines whether or not the array access is based on symbol variables. If it is not a symbol variable, the process proceeds to step S310. If it is a symbol variable, the process proceeds to step S302. The procedure of step S300 will be described as procedure 2. FIG. 16 is a diagram for explaining the procedure 2 executed by the test case generation apparatus 100 according to the present embodiment.

  The symbolic execution unit 112 checks whether or not the instruction “07: value = array [α]” on the 07th line is a symbol value as an operand of the array access instruction. For simplicity, array [α] is described. However, since the memory state of the array is {a1, b1, b2, b1, b1, a1}, exactly {a1 , B1, b2, b1, b1, a1} [α]. More precisely, a1, b1, and b2 should also be reference IDs to the heap, but are simplified as described above for convenience of explanation.

  If the access does not use a symbol variable, the symbolic execution unit 112 proceeds from step S300 to step S310 in order to continue normal symbolic execution. In step S310, it is determined whether or not a branch has occurred. If no branch has occurred, the branch selection process ends. On the other hand, if a branch has occurred, the process proceeds to step S312. In step S312, the symbolic execution unit 12 selects a branch according to the instruction, and then ends the branch selection process.

  On the other hand, if the symbolic execution unit 112 determines that the access uses symbol variables, the process proceeds to step S302.

  In step S302, the test case generation device 100 determines whether there is index information. Specifically, the test case generation device 100 determines whether both the index selection information 128 and the same element index information 130 exist. If at least one of the index selection information 128 and the same element index information 130 does not exist, the process proceeds to step S304. In step S304, the same element index information generation unit 118 generates the same element index information 130. In the next step S306, the index selection unit 16 generates index selection information 128. The procedure of steps S304 and S306 will be described as procedure 3. FIG. 17 is a diagram for explaining the procedure 3 executed by the test case generation apparatus 100 according to the present embodiment.

  The same element index information generation unit 118 generates the same element index information 130 by collecting items that refer to the same object on the heap based on the determination result of the same element determination unit 120. The same element index information generation unit 118 of the present embodiment collects elements in the array that refer to the same object on the heap, assuming that the index values are the same. No. of the same element index information 130. 1 indicates that the 0th and 5th elements of the array have the same elements in terms of content. No. 2 indicates that the first, third, and fourth elements of the array have the same elements. Furthermore, no. 3 represents that the second of the array does not have the same content element.

  Here, determination criteria for determining whether or not the same element determination unit 120 is the same element may be determined in advance and stored in the storage unit 66, the memory 64, or the like. The determination criteria are not limited to the present embodiment, but can be changed according to attributes, objects, and the like, and can be determined based on the viewpoint of testing the target program. For example, when the same element index information generation unit 118 generates the same element index information using the viewpoints of the elements “a” and “b” as the determination criteria, the same element index information 130A illustrated in FIG. 18 is generated.

  Further, the index selection unit 116 generates index selection information 128. Here, since the index selection information 128 has just been generated and no index value has been selected, all the index values of the index selection information 128 are not selected (initialized).

  Subsequent to step S306 or in step S308, which is shifted when it is determined that there is index information in step S302, the index selection unit 116 selects an unselected index value, and then ends the branch selection process. The procedure of step S308 will be described as procedure 4. FIG. 19 is a diagram for explaining the procedure 4 executed by the test case generation device 100 of the present embodiment.

  The index selection unit 116 refers to the index selection information 128, selects one of the unselected index values, and sets the selected index value as selected. FIG. 19 shows a state in which the index selection unit 116 has selected the index value “0”. The index selection unit 116 outputs the selected index value to the symbolic execution unit 112. Note that it is arbitrary which index value the index selection unit 116 selects. The symbolic execution unit 112 creates and executes a branch corresponding to the index value selected by the index selection unit 116.

  When the branch selection process in step S206 is completed in this way, the process proceeds to step S208.

  In step S208, the symbolic execution unit 112 calculates and generates a path condition corresponding to the index value selected by the index selection unit 116. The symbolic execution unit 112 stores, in the memory 64 or the like, a correspondence relationship indicating which branch each constraint (constraint solver) is derived from based on the calculated path condition.

  In the next step S210, the symbolic execution unit 112 determines whether or not the path condition obtained in step S208 can be satisfied. If it cannot be satisfied, the process proceeds to step S218. On the other hand, if it can be satisfied, the process proceeds to step S212. In step S212, after the symbolic execution unit 12 executes the instruction of the target program, the process returns to step S202.

  If there is no subsequent instruction in step S202, the process proceeds to step S214. In step S214, the symbolic execution unit 112 generates a test case. Specifically, the symbolic execution unit 112 generates a test case corresponding to the index value selected by the index selection unit 116.

  In the next step S216, index information update processing is performed. FIG. 20 is a flowchart illustrating an example of the information update process in step S216.

  In step S400, the index equivalent condition generation unit 122 determines whether or not the test case generated in step S214 is a test case related to array access using symbol variables. In this embodiment, the symbolic execution unit 112 acquires an instruction derived from each constraint expression of the path condition based on the correspondence relationship stored in the process of step S208, and the acquired instruction is an array access instruction. It is confirmed whether or not. If the test case is not related to array access, the index information update process is terminated. On the other hand, if the test case involves array access, the process proceeds to step S402.

  In step S402, the index equivalent condition generation unit 122 calculates the index equivalent condition 132. In the present embodiment, the calculated index equivalence condition 132 needs to be held at least until the processing in step S406 below, and is stored in the memory 64 or the like. The procedure of step S402 will be described as procedure 5. FIG. 21 is a diagram for explaining the procedure 5 executed by the test case generation apparatus 100 according to the present embodiment. The index equivalent condition generation unit 122 calculates an index equivalent condition 132 for each path including index selection. Specifically, the index equivalence condition 132 is obtained by removing the restriction derived from the access by the index value from the path condition. In the example shown in FIG. 21, when the index value is “0”, No. In the test case 1, the test input is “idx (α): 0, n (β): 4”, and the path condition is “α == 0 && β> 3”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 0” derived from the index value, the index equivalent condition 132 is “β> 3”. No. In the test case 2, the test input is “idx (α): 0, n (β): 0”, and the path condition is “α == 0 && β <= 3”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 0” derived from the index value, the index equivalent condition 132 is “β <= 3”.

  In the next step S404, the index equivalence determination unit 124 determines whether or not all subsequent states have been searched for the index value selection to be noticed. That is, the index equivalence determination unit 124 determines whether or not the search of all states has been completed for the index value selected by the index selection unit 116 and for which the test case is generated. If the search has not been completed, the index information update process is terminated. On the other hand, if the search has been completed, the process proceeds to step S406.

  In step S406, the index equivalence determination unit 124 acquires an index value in which the same element as the index value that has not been selected and is noticed is stored. In the next step S <b> 408, the index equivalence determining unit 124 selects the acquired index values satisfying the index equivalence condition 132 in the index selection information 128. After the index equivalence determination unit 124 updates the index selection information 128 by the process of step S408, the index information update process ends.

  The procedure of steps S406 and S408 will be described as procedure 6. FIG. 22 is a diagram for explaining the procedure 6 executed by the test case generation apparatus 100 according to the present embodiment. The index equivalence determination unit 124 refers to the same element index information 130 and acquires an index value having the same element as the selected (attention) index value. When the index value “0” is selected (attention) as in the specific example described above, the index equivalence determination unit 124 refers to the same element index information 130 and uses the same “a1” as an element. Obtain “5”. At this time, the index value “5” in the index selection information 128 is not selected.

  Furthermore, the index equivalence determination unit 124 determines whether or not all of the index equivalence conditions 132 calculated in step S402 (procedure 5) can be satisfied when the index value is “5”. Specifically, the index equivalence determination unit 124 adds “α == 5” that is a constraint derived from the index value to the index equivalence condition 132 to generate a constraint solver. Then, the index equivalence determination unit 124 determines whether or not all the generated constraint solvers can be satisfied when the index value is “5”. When the index value is “5”, all constraint solvers are satisfied. This means that the same path is passed for the index value “0” and the index value “5”. Therefore, the test case generation apparatus 100 of the present embodiment does not search for the index value “5” and does not generate a test case. Therefore, the index equivalence determination unit 124 updates the index value “5” with the index value “5” selected in the index selection information 128.

  When the index information update process in step S216 is completed in this way, the process proceeds to step S218.

  In step S218, the symbolic execution unit 112 determines whether there is a backtrack destination. FIG. 23 is a flowchart illustrating an example of the backtrack destination determination process in step S218.

  In step S500, the symbolic execution unit 112 determines whether the target program is in a start state. If it is in the start state, it is determined that there is no backtrack destination, and the backtrack destination determination process is terminated. On the other hand, if it is not in the start state, the process proceeds to step S502.

  In step S502, the symbolic execution unit 112 determines whether or not the array access is based on symbol variables. In the case of array access using symbol variables, the process proceeds to step S504. The procedure of steps S502 and S504 will be described as procedure 7. FIG. 24 is a diagram for explaining the procedure 7 executed by the test case generation device 100 of the present embodiment. FIG. 24 (1) shows the index selection information 128 when the index values “0” and “5” are already selected as in the specific example described above. FIG. 24 (2) shows the index selection information 128 when all index values have been selected as a specific example.

  In the case of array access by symbol variables and there is an unselected index value, that is, in the case of FIG. 24 (1), the backtrack destination determination processing is terminated by determining in step S504 that there is a backtrack destination. On the other hand, in the case of array access using symbol variables and there is no unselected index value, that is, in the case of FIG. 24 (2), the process proceeds to step S506 in order to backtrack to the instruction before the array access.

  In step S506, the symbolic execution unit 112 returns to the previous state, and then returns to step S500. If it is not in the program start state in step S500, and if it is not array access by symbol variables in step S502, the process proceeds to step S508. In step S508, the symbolic execution unit 112 determines whether there is an unselected branch. If all have been selected, the process moves to step S506, and the backtrack destination determination process is repeated. On the other hand, if there is an unselected branch, it is determined that there is a backtrack destination, and this backtrack destination determination processing is terminated.

  When the backtrack destination determination processing in step S218 is completed in this way, if there is no backtrack destination, all test cases (test case 133) of the target program have been generated, and thus this symbolic execution processing ends. On the other hand, if there is a pack track destination, the process proceeds to step S220, where the symbolic execution unit 112 backtracks to the backtrack destination, then proceeds to step S204, and repeats this symbolic execution process.

  In the above, as a specific example, the state where the index values “0” and “5” have been selected has been described. In this specific example, the branch selection process in step S206 is performed again from step S218 through step S220 and step S204. In the branch selection process (see FIG. 15), the result is affirmative in step S300 and further affirmed in step S302, so the process proceeds to step S308. The procedure 4 (second time) that is the process of step S308 in this case will be described. FIG. 25 is a diagram for explaining the procedure 4 (second time) executed by the test case generation device 100 of the present embodiment. With the above processing, a test case is generated for the index value “0”, and the index value “5” that satisfies the path condition 126 is also selected. The index selection unit 116 refers to the index selection information 128, selects an unselected index value “1”, and makes it selected.

  When the index selection unit 116 selects an unselected index value in this way, the symbolic execution unit 112 newly executes a path corresponding to the index value “0” to generate a test case. Therefore, the symbolic execution process (see FIG. 13) is continued, and a test case corresponding to the index value “0” is generated in step S214. Specifically, the symbolic execution unit 112 selects No. 1 among the test cases 133 shown in FIG. 3 test cases are generated. After the test case is generated, the process proceeds to step S216 to perform index information update processing. In the index information update process, the index equivalent condition generation unit 122 generates the index equivalent condition 132 by the above-described procedure 5 (FIG. 20, step S402). FIG. 26 is a diagram for explaining the procedure 5 (second time) executed by the test case generation device 100 of the present embodiment.

  In the example shown in FIG. 26, when the index value is “1”, No. In the test case 3, the test input is “idx (α): 1, n (β): 0”, and the path condition is “α == 1 && α <4”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 1” derived from the index value, the index equivalent condition 132 is “α <4”.

  When the index equivalence condition 132 is generated in this way, the index equivalence determining unit 124 performs the procedure 6 (FIG. 20, steps S406 and S408). FIG. 27 is a diagram for explaining the procedure 6 (second time) executed by the test case generation device 100 of the present embodiment. The index equivalence determination unit 124 refers to the same element index information 130 and acquires an index value having the same element as the selected (attention) index value. Here, since the index value “1” is selected (attention), the index equivalence determination unit 124 refers to the same element index information 130 and acquires an index value having the same “b1” as an element. Specifically, the index values “3” and “4” are acquired. At this time, the index values “3” and “4” in the index selection information 128 are not selected.

  Further, the index equivalence determination unit 124 determines whether or not all of the index equivalence conditions 132 calculated in step S402 (procedure 5 (second time)) can be satisfied when the index values are “3” and “4”. To do. Specifically, when the index value is “3”, the index equivalence determining unit 124 adds “α == 3” that is a constraint derived from the index value to the index equivalence condition 132 to generate a constraint solver. . Then, the index equivalence determination unit 124 determines whether or not all the generated constraint solvers can be satisfied when the index value is “3”. When the index value is “3”, all constraint solvers are satisfied. This means that the same path is passed for the index value “1” and the index value “3”. Therefore, the test case generation device 100 of the present embodiment does not search for the index value “3” and does not generate a test case. For this reason, the index equivalence determining unit 124 updates the index value “3” in the index selection information 128 with the index value “3” selected.

  On the other hand, in the case of the index value “4”, a constraint solver is generated by adding “α == 4”, which is a constraint derived from the index value, to the index equivalence condition 132. Then, the index equivalence determination unit 124 determines whether or not all the generated constraint solvers can be satisfied when the index value is “4”. In the case of the index value “4”, there are cases where it cannot be satisfied. This means that the index value “1” and the index value “4” pass different paths. Therefore, in the index equivalence determination unit 124 of the present embodiment, the index value “4” is left unselected.

  When the index equivalence determining unit 124 updates the index selection information 128 in this way, the symbolic execution unit 112 performs the procedure 7 (FIG. 23, steps S502 and S504). FIG. 28 is a diagram for explaining the procedure 7 (second time) executed by the test case generation device 100 of the present embodiment. As shown in FIG. 28, since there is an unselected index value in the index selection information 128, backtracking is performed as described above, and the procedure returns to step 4. Since the procedures 4 to 7 are repeated in the same way as described above for the migration processing of the specific example, the subsequent processing will be briefly described according to the procedure.

  FIG. 29 is a diagram for explaining the procedure 4 (third time) executed by the test case generation device 100 of the present embodiment. Through the above-described processing, the index values “0”, “1”, “3”, and “5” are selected. The index selection unit 116 refers to the index selection information 128, selects the unselected index value “2”, and makes it selected. The symbolic execution unit 112 newly executes a path corresponding to the index value “2” to generate a test case. The symbolic execution unit 112 corresponds to the index value “2” in the test case 133 shown in FIG. Generate test cases 4 and 5.

  After the test case is generated, the index equivalent condition 132 is generated by the procedure 5 (third time). FIG. 30 is a diagram for explaining the procedure 5 (third time) executed by the test case generation device 100 of the present embodiment.

  In the example shown in FIG. 30, when the index value is “2”, No. In the test case 4, the test input is “idx (α): 2, n (β): 3”, and the path condition is “α == 2 && β> 3”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 2” derived from the index value, the index equivalent condition 132 is “β> 3”. No. In the test case 5, the test input is “idx (α): 2, n (β): 0”, and the path condition is “α == 2 && β <= 3”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 2” derived from the index value, the index equivalent condition 132 is “β <= 3”.

  When the index equivalence condition 132 is generated in this way, the index equivalence determining unit 124 performs the procedure 6 (third time). FIG. 31 is a diagram for explaining the procedure 6 (third time) executed by the test case generation device 100 of the present embodiment. The index equivalence determination unit 124 refers to the same element index information 130 and acquires an index value having the same element as the selected (attention) index value. There is no index value having the same element as the index value “2”. For this reason, the index equivalence determination unit 124 does not acquire an index value and does not perform the above-described processing. Therefore, the index selection information 128 does not change before and after the update.

  Subsequently, the symbolic execution unit 112 performs step 7 (third time). FIG. 32 is a diagram for explaining the procedure 7 (third time) executed by the test case generation device 100 of the present embodiment. As shown in FIG. 31, since the index selection information 128 includes an unselected index value, backtracking is performed as described above, and the procedure returns to step 4.

  FIG. 33 is a diagram for explaining the procedure 4 (fourth) executed by the test case generation device 100 of the present embodiment. As a result of the above processing, the index values “0”, “1”, “2”, “3”, and “5” are selected. The index selection unit 116 refers to the index selection information 128, selects the unselected index value “4”, and makes it selected. The symbolic execution unit 112 newly executes a path corresponding to the index value “4” to generate a test case. The symbolic execution unit 112 corresponds to the index value “4” in the test case 133 shown in FIG. 6 and 7 test cases are generated.

  After the test case is generated, the index equivalent condition 132 is generated by the procedure 5 (fourth time). FIG. 34 is a diagram for explaining the procedure 5 (fourth time) executed by the test case generation device 100 of the present embodiment.

  In the example shown in FIG. 34, when the index value is “4”, No. In the test case 6, the test input is “idx (α): 4, n (β): 5”, and the “path condition is“ α == 4 && α> = 4 && α <β ”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 4” derived from the index value, the index equivalent condition 132 is “α> = 4 && α <β”. No. In the test case 7, the test input is “idx (α): 4, n (β): 0”, and the path condition is “α == 4 && α> = 4 && α> = β”. In this case, since the index equivalent condition 132 is obtained by excluding “α == 4” derived from the index value, the index equivalent condition 132 is “α> = 4 && α> = β”.

  When the index equivalence condition 132 is generated in this way, the index equivalence determining unit 124 performs the procedure 6 (fourth). FIG. 35 is a diagram for explaining the procedure 6 (fourth) executed by the test case generation device 100 of the present embodiment. The index equivalence determination unit 124 refers to the same element index information 130 and acquires an index value having the same element as the selected (attention) index value. There is no unselected index value that has the same element as the index value “4”. For this reason, the index equivalence determination unit 124 does not acquire an index value and does not perform the above-described processing. Therefore, the index selection information 128 does not change before and after the update.

  Subsequently, the symbolic execution unit 112 performs step 7 (fourth time). FIG. 36 is a diagram for explaining the procedure 7 (fourth) executed by the test case generation device 100 of the present embodiment. As shown in FIG. 36, the index selection information 128 has no unselected index value. That is, all the paths corresponding to the array access index values have been searched. Therefore, backtracking is performed before array access.

  Since the generation of the test case 133 is completed by the above-described process, step 100 is completed in the test case generation process. In the test case 133 generated in this way (see FIG. 12), No. Seven test cases 1 to 7 are generated. In the test case generation device 100, when the index value is “5”, the index value is “0”, and when the index value is “3”, the index value is “1”. Therefore, the test case generation device 100 can improve the efficiency of symbolic execution by thinning out searches for these index values. In the test case generation device 100, it is possible to suppress the occurrence of a combination explosion by improving the efficiency of symbolic execution in this way.

  As described above, according to the test case generation device 10 and the test case generation device 100, the index selection units 16 and 116 determine the path condition from the index values of the indexes representing the positions of a plurality of elements constituting the array. Select the index value to be generated. The symbolic execution units 12 and 112 execute the target program symbolically. The symbolic execution units 12 and 112 generate test conditions that satisfy a path condition generated by generating a path condition representing a path through which an element corresponding to the index value selected by the index selection units 16 and 116 passes, and the path condition Is output as a test case.

  The same element index information generation units 18 and 118 are based on the determination results of the same element determination units 20 and 120, and the same element index information 30 that summarizes index values for each same element based on a predetermined determination criterion. 130 is generated. The index equivalence determination units 24 and 124 refer to the same element index information 30 and 130 and select an unselected index value corresponding to the same element as the element that generated the path condition. In addition, the index equivalence determination units 24 and 124 generate index equivalence conditions 32 and 132 excluding restrictions derived from index values from the path condition. In the case of the selected index value, the index equivalence determination units 24 and 124 determine whether or not the index equivalence conditions 32 and 132 can be satisfied. exclude.

  As described above, in the test case generation apparatuses 10 and 100, in the test case generation by symbolic execution, the index value that is the same element as the index value that generated the test case and the same path condition is selected. Thereby, since it is possible to thin out (exclude) the search for the selected index value, it is possible to suppress the occurrence of a path and to improve the efficiency of symbolic execution. Therefore, in the test case generation apparatuses 10 and 100, the time and space calculation amount required for symbolic execution can be suppressed, and the occurrence of a combination explosion can be suppressed.

  Needless to say, the symbolic execution (test case) described in the above embodiments and examples can be applied to a program having a plurality of array accesses on the same path. An outline of the operation of the test case generation apparatus in this case will be described with reference to a specific example shown in FIG. In the specific example shown in FIG. 37, there are array accesses in the 01st line (see FIG. 37, S1) and the 03rd line (see FIG. 37, S2, S3) of the target program. Array access exists. There are two types of indexes, idx1 = α1 and idx2 = α2. In such a case, the index selection information and the same element index information can be provided for each state of the execution space. In the case shown in FIG. 37, the index selection information and the same element index information may be provided for each of the states S1, S2, and S3. Further, the generated path condition (index equivalent condition) includes a conditional expression corresponding to the state S1 and the state S2 or S3. For example, in the case shown in FIG. 37, when “α1 == 0” and “α2 == 0” are selected, the path condition is “α1 == 0 && α1 <4 && α2 == 0 && α2 <2. && α1 <2 ”. Among these, “α2 <2 && α1 <2” is an index equivalent condition of the state S2 when “α2 == 0” is selected. Further, “α1 <4 && α2 == 0 && α2 <2 && α1 <2” is an index equivalent condition of the state S1 when “α2 == 1” is selected. Since the index equivalence condition can also be calculated independently in this way, the symbolic execution (test case) described in the above embodiment and examples can be applied.

  In the above-described embodiment and examples, a program using Java (registered trademark) as a programming language is used as the target program. However, the programming language is not limited to this, and any program may be used.

  In the above description, the test case generation program 72 has been stored (installed) in the storage unit 66 in advance. However, the test case generation program 72 may be provided in a form recorded on a storage medium. . Examples of the storage medium include a CD-ROM (Compact Disc Read Only Memory), a DVD-ROM (Digital Versatile Disk Read Only Memory), and a USB (Universal Serial Bus).

  Regarding the above embodiment, the following additional notes are disclosed.

(Appendix 1)
On the computer,
An index value that is a symbol variable representing the position of each of a plurality of elements constituting the array, and an unselected index value that is not excluded is selected as an object of selection, and an index value is selected from the object of selection,
Generate a path condition that represents the path that the element corresponding to the selected index value passes by executing the target program symbolically, and test data that passes through the path that is generated and the path that the generated path condition represents Output as
Is the index value included in the selection target, and whether the index value corresponding to the same element as the element that generated the path condition can satisfy the index equivalent condition that excludes the constraint derived from the index value from the generated path condition Determining and excluding satisfiable index values from the selection target,
A test case generation program that executes processing including the above.

(Appendix 2)
On the computer,
Detecting whether an instruction in the target program is an access instruction to an element of an array having an index value as a symbol variable;
For each element determined to be the same, generate the same element index information that summarizes the index values,
The test case generation program according to appendix 1, which executes a process including detecting an index value included in the selection target corresponding to the same element as the element that generated the path condition based on the generated same element index information .

(Appendix 3)
On the computer,
When the access instruction is detected, it is determined to be the same based on a predetermined criterion,
For each element that is determined to be the same based on the determination result, the same element index information that summarizes the index values is generated.
The test case generation program according to appendix 2, which executes a process including the above.

(Appendix 4)
On the computer,
The index equivalent condition is generated by removing the constraint derived from the index value from the generated path condition.
The test case generation program according to any one of appendix 1 to appendix 3, which causes a process including the above to be executed.

(Appendix 5)
An index value that is a symbol variable representing each position of a plurality of elements constituting the array, and an unselected index value that is not excluded is selected as a selection target; a selection unit that selects an index value from the selection target;
Generate a path condition representing a path through which an element corresponding to the index value selected by the selection unit passes through symbolic execution of the target program, and pass the path represented by the generated path condition and the generated path condition An execution unit that outputs data as a test case;
An index equivalent condition that is an index value that is included in the selection target and that corresponds to an element that is the same as the element that has generated a path condition in the execution unit, and that excludes a constraint derived from the index value from the generated path condition A determination unit that determines whether or not the index value that can be satisfied is excluded from the selection target;
A test case generation apparatus comprising:

(Appendix 6)
A detection unit that detects whether an instruction to be executed by the execution unit is an instruction to access an element of an array having an index value as a symbol variable;
When the detection unit detects that it is the access command, a generation unit that generates the same element index information that summarizes index values for each element that is determined to be the same based on a predetermined determination criterion;
The determination unit detects an index value included in the selection target corresponding to the same element as the element for which a path condition is generated by the execution unit, based on the same element index information.
The test case generation device according to attachment 5.

(Appendix 7)
When the access instruction is detected, the same element determination unit that determines the same based on a predetermined determination criterion is provided,
The generation unit generates the same element index information that summarizes the index values for each element determined to be the same based on the determination result of the same element determination unit.
The test case generation device according to attachment 6.

(Appendix 8)
An equivalent condition generation unit that generates the index equivalent condition by removing the constraint derived from the index value from the generated path condition,
The test case generation device according to any one of appendix 5 to appendix 7.

(Appendix 9)
On the computer,
An index value that is a symbol variable representing the position of each of a plurality of elements constituting the array, and an unselected index value that is not excluded is selected as an object of selection, and an index value is selected from the object of selection,
Generate a path condition that represents the path that the element corresponding to the selected index value passes by executing the target program symbolically, and test data that passes through the path that is generated and the path that the generated path condition represents Output as
Is the index value included in the selection target, and whether the index value corresponding to the same element as the element that generated the path condition can satisfy the index equivalent condition that excludes the constraint derived from the index value from the generated path condition Determining and excluding satisfiable index values from the selection target,
A test case generation method for executing a process including the above.

(Appendix 10)
On the computer,
Detecting whether an instruction in the target program is an access instruction to an element of an array having an index value as a symbol variable;
For each element determined to be the same, generate the same element index information that summarizes the index values,
The test case generation method according to appendix 9, wherein a process including detecting an index value included in the selection target corresponding to the same element as the element that generated the path condition is executed based on the generated same element index information .

(Appendix 11)
On the computer,
When the access instruction is detected, it is determined to be the same based on a predetermined criterion,
For each element that is determined to be the same based on the determination result, the same element index information that summarizes the index values is generated.
The test case generation method according to attachment 10, wherein the process including the above is executed.

(Appendix 12)
On the computer,
The index equivalent condition is generated by removing the constraint derived from the index value from the generated path condition.
12. The test case generation method according to any one of appendix 9 to appendix 11, wherein the process including the above is executed.

10, 100 Test case generation device 12, 112 Symbolic execution unit 14, 114 Index access detection unit 16, 116 Index selection unit 18, 118 Same element index information generation unit 20, 120 Same element determination unit 22, 122 Index equivalent condition generation unit 24, 124 Index equivalence determination unit 62 CPU
64 Memory 66 Storage Unit 72 Test Case Generation Program 74 Symbolic Execution Process 76 Index Access Detection Process 78 Index Selection Process 80 Same Element Index Information Generation Process 82 Same Element Determination Process 84 Index Equivalent Condition Generation Process 86 Index Equivalence Determination Process

Claims (7)

On the computer,
An index value that is a symbol variable representing the position of each of a plurality of elements constituting the array, and an unselected index value that is not excluded is selected as an object of selection, and an index value is selected from the object of selection,
By performing symbolic execution of the target program, a path condition representing a path branching according to an element corresponding to the selected index value is generated, and the generated path condition and test data passing through the path represented by the generated path condition are Output as a test case,
Is the index value included in the selection target, and whether the index value corresponding to the same element as the element that generated the path condition can satisfy the index equivalent condition that excludes the constraint derived from the index value from the generated path condition Determining and excluding satisfiable index values from the selection target,
A test case generation program that executes processing including the above. On the computer,
Detecting whether an instruction in the target program is an access instruction to an element of an array having an index value as a symbol variable;
For each element determined to be the same, generate the same element index information that summarizes the index values,
The test case generation according to claim 1, wherein a process including detecting an index value included in the selection target corresponding to the same element as the element that generated the path condition is executed based on the generated same element index information. program. On the computer,
When the access instruction is detected, it is determined to be the same based on a predetermined criterion,
For each element that is determined to be the same based on the determination result, the same element index information that summarizes the index values is generated.
The test case generation program according to claim 2, wherein processing including the above is executed. On the computer,
The index equivalent condition is generated by removing the constraint derived from the index value from the generated path condition.
The test case generation program according to any one of claims 1 to 3, wherein a process including the above is executed. An index value that is a symbol variable representing each position of a plurality of elements constituting the array, and an unselected index value that is not excluded is selected as a selection target; a selection unit that selects an index value from the selection target;
By executing the target program symbolically, a path condition representing a path that branches according to the element corresponding to the index value selected by the selection unit is generated, and the generated path condition and the path represented by the generated path condition are passed. An execution unit that outputs test data to be tested as a test case;
An index equivalent condition that is an index value that is included in the selection target and that corresponds to an element that is the same as the element that has generated a path condition in the execution unit, and that excludes a constraint derived from the index value from the generated path condition A determination unit that determines whether or not the index value that can be satisfied is excluded from the selection target;
A test case generation apparatus comprising: A detection unit that detects whether an instruction to be executed by the execution unit is an instruction to access an element of an array having an index value as a symbol variable;
When the detection unit detects that it is the access command, a generation unit that generates the same element index information that summarizes index values for each element that is determined to be the same based on a predetermined determination criterion;
The determination unit detects an index value included in the selection target corresponding to the same element as the element for which a path condition is generated by the execution unit, based on the same element index information.
The test case generation device according to claim 5. On the computer,
An index value that is a symbol variable representing the position of each of a plurality of elements constituting the array, and an unselected index value that is not excluded is selected as an object of selection, and an index value is selected from the object of selection,
By performing symbolic execution of the target program, a path condition representing a path branching according to an element corresponding to the selected index value is generated, and the generated path condition and test data passing through the path represented by the generated path condition are Output as a test case,
Is the index value included in the selection target, and whether the index value corresponding to the same element as the element that generated the path condition can satisfy the index equivalent condition that excludes the constraint derived from the index value from the generated path condition Determining and excluding satisfiable index values from the selection target,
A test case generation method for executing a process including the above.

Images