弥合单元测试生成和系统测试生成之间的差距
Bridging the Gap between Unit Test Generation and System Test Generation
摘要：
常见的测试生成器分为两类。在单元级别生成测试输入是快速的，但是当使用系统上下文中不会出现的输入调用函数时，可能会导致错误警报。如果在系统级生成的输入导致故障，这是一个真正的警报，因为输入也可能来自用户或第三方;但系统测试要慢得多。在本文中，我们引入了测试生成桥的概念，它将系统测试的准确性与单元测试的速度联系起来。测试生成桥允许将任意系统测试生成器与任意单元测试生成器组合。它通过从系统（测试）执行中分割参数化的单元测试来实现。这些单元测试在从系统测试记录的上下文中运行，但是单独的参数留给单元测试生成器系统地探索。这允许符号测试生成器（如KLEE）在记录的系统上下文中对单个函数进行操作。如果测试发生器检测到故障，我们将故障诱导参数提升回系统输入;如果故障可以在系统级重现，则将其报告为真报警。我们的BASILISK原型可以从复杂系统中提取和测试单元，例如Web/Python/SQLite/C堆栈;在其评估中，它实现了比最先进的系统测试生成器更高的覆盖率。
英文摘要：
Common test generators fall into two categories. Generating test inputs at the unit level is fast, but can lead to false alarms when a function is called with inputs that would not occur in a system context. If a generated input at the system level causes a failure, this is a true alarm, as the input could also have come from the user or a third party; but system testing is much slower. In this paper, we introduce the concept of a test generation bridge, which joins the accuracy of system testing with the speed of unit testing. A Test Generation Bridge allows to combine an arbitrary system test generator with an arbitrary unit test generator. It does so by carving parameterized unit tests from system (test) executions. These unit tests run in a context recorded from the system test, but individual parameters are left free for the unit test generator to systematically explore. This allows symbolic test generators such as KLEE to operate on individual functions in the recorded system context. If the test generator detects a failure, we lift the failure-inducing parameter back to the system input; if the failure can be reproduced at the system level, it is reported as a true alarm. Our BASILISK prototype can extract and test units out of complex systems such as a Web/Python/SQLite/C stack; in its evaluation, it achieves a higher coverage than a state-of-the-art system test generator.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
