exam1 Flashcards
generate a set of directed acyclic graphs
Korat has the capability of systematically generating
nonisomorphic linked structures
encrypted string testing
fuzzing, strings look like randomly generated strings
API testing
feedback-directed test like Randoop
threaded function testing
Cuzz can introduce sleep calls to emulate different assignments of activity to test for concurrency bugs.
syntactic parser in a compiler testing
normal fuzzing won’t work, since parser would need to be streams of lexical tokens. Randomly generating streams of lexical tokens for use in unit testing would be a workable solution.
dynamic analysis is complete
it generates no false positives (spurious errors). All the errors found by dynamic analysis are actually real errors, therefore, it is complete. However, it is not guaranteed to find all the errors in the program, which is why it is unsound.
dataflow analysis sacrifices completeness
- sounds: report all facts that could occur in actual runs
- incomplete: may report additional facts that can’t occur in actual runs
- dataflow analysis is a static analysis
static analysis is sound, but incomplete. Dynamic analysis is complete, but not sound
True
a sound program
accept the set of programs subsets of the set of safe programs
If A and B are sound analyses, A is at least as precise as B means
whenever B accepts a program, A also accepts that program (aka. B is an subset of A or A>=B)
Statement coverage
every line of a code (statement) is touched
Branch coverage
every “if-statment” as two branches
Path coverage
(visualize the code in a form of a binary tree)
it cares how to get to a certain place in the code. For example, a while loop runs 2 times is different than the while loop that runs 5 times, but they are still possibly the same branch. In many cases, it’s impossible to test all paths
a mutant to be equivalent
if it produces the same output as P on all test cases
the goal of mutation testing
try to find mutants of P which fail tests in the suite
