On-the-fly generation of k-path tests for C functions

We propose a novel method, called PathCrawler, for the automatic generation of structural tests satisfying the all-paths criterion or its k-path variant. The source code is instrumented so as to recover the symbolic execution path each time that the program under test is executed. This code is first executed using inputs arbitrarily selected from the input domain. The resulting symbolic path is transformed into a path predicate by projection of the conditions onto the input variables. The next test is obtained by using constraint logic programming to find new input values outside the domain of the path which is already covered. The instrumented code is then executed on this test and so on, until all feasible paths have been covered. Our method combines static and dynamic analysis in a way that avoids the disadvantages of both. It is currently being implemented for the C language.