Abstract Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. The major advantage of DSE is its path-by-path exploration of the program execution space. However, this often leads to the path explosion problem. To address this issue, a method of abstraction learning has been used. The key step here is the computation of an interpolant to represent the learned abstraction. In Test-Comp 2024, we use two different approaches of interpolant generation viz., Deletion Interpolation and Weakest Precondition Interpolation. The former is our more stable and mature system and briefly discussed in [8]. In this paper, we present the latter approach which is the heart of TracerX. In general, the Weakest Precondition (WP) is the ideal (most general) interpolant. However, WP is intractable to compute and is exponentially disjunctive. A major challenge is to obtain a conjunctive approximation of the WP. Therefore, we generate an approximation of the WP.

Fault Localization (FL) is the key activity while debugging a program. Any improvement to this activity leads reduction in total software development cost. Spectrum-based fault localization (SBFL) techniques are considered to be the most prominent for FL because of their scalability and efficiency. However, these techniques suffer from the problem of ties, focus only on the binary coverage (0/1) information of program elements, and have a huge scope for improvement in their effectiveness. Also, the test suites available for FL have a biased number of pass and failed test cases. In order to solve these issues, we proposed a novel fault localization technique in this paper. Our proposed technique uses statement frequency information and considers individual test case contributions to assign different suspiciousness scores to the statements and generates an effective ranked list of test cases by balancing the test cases. Experimental results show that the proposed method performs on average 42.48% better than other contemporary FL methods such as $\mathrm{D}^{\ast}$, Tarantula, Ochiai, Ample, Barinel, BPNN, RBFNN, and Crosstab.

Fuzzing is a popular and highly effective technique for software testing especially vulnerability detection. Fuzzing includes the random mutation of well-formed program inputs using dynamic program analysis. Though fuzzing is an active area of research, less systematic efforts have been investigated to understand as well as to generate powerful input seeds for a fuzzer. Reactive systems are used in different applications such as web services, decision support systems, and logical controllers. These systems are quite complex and bigger, hence the validation process becomes tedious. In this work, we propose a static seed generator that helps to accelerate the performance of existing fuzzers. In this paper, we validate the reactive systems using our approach by detecting vulnerability. To evaluate the performance of our developed seeder, we experimented with 100 Rigorous Ex-amination of Reactive Systems (RERS) C-programs. Experimental results show that our approach SSG-AFL is superior as compared to the AFL with random seeds. SSG-AFL shows 59.75% winning programs after running all four phases as compared to Random-AFL.

Fault localization (FL) is the most arduous and timeconsuming task during software debugging. It is delineated in the literature that different FL methods show superior results under distinct scenarios. There is no single technique available that always outperforms all other existing FL techniques for each type of fault. It has also been reported that different learning techniques can be combined using an ensemble classifier to generate better predictive performance that was impossible to be obtained with any of the constituent learning algorithms separately. This has motivated us to use an ensemble classifier for effective fault localization. We focus on three different families of fault localization techniques, viz., neural-network-based(NNBFL), mutation-based(MBFL), and spectrum-based(SBFL), to achieve this. In total, we have considered eleven representative techniques from these three families of FL methods. The proposed underlying model is intuitive and simple as it is based only on the test execution results and statement coverage data. Our proposed Ensemble classifier Based FL (EBFL) method classifies the statements into two different sets viz., Non-Suspicious and Suspicious. It helps to reduce the search space significantly. Our experimental analysis shows that our proposed EBFL technique requires, on average, 58% of less code examination compared to the other contemporary fault localization techniques, viz., Tarantula, DStar, CNN, DNN etc.

MC/DC coverage prescribes a set of MC/DC sequences. Such a sequence is defined by a specification of the truth values of certain atomic boolean expressions which appear in predicates (i.e. boolean combinations of atomic boolean expressions) in the program. An execution trace satisfies the sequence if it realizes the atomic boolean conditions in accordance with the truth value specification of the sequence. An MC/DC sequence is feasible if there is one such execution trace. The overall goal for an MC/DC test generator is, for each sequence: if feasible, to generate a test input realizing the sequence; otherwise, to prove that the sequence is infeasible.

Fault localization techniques aim to localize faulty statements using the information gathered from both passed and failed test cases. We present a mutation-based fault localization technique called MuSim. MuSim identifies the faulty statement based on its computed proximity to different mutants. We study the performance of MuSim by using four different similarity metrics. To satisfactorily measure the effectiveness of our proposed approach, we present a new evaluation metric called Mut_Score. Based on this metric, on an average, MuSim is 33.21% more effective than existing fault localization techniques such as DStar, Tarantula, Crosstab, Ochiai.

In this article, we propose a hierarchical fault localization technique using a deep neural network (DNN). First, we prioritize the functions of a program based on their suspiciousness score. Subsequently, the fault is localized to specific statements within the top k suspected functions, where the value of k is determined heuristically. We use two function-level features to train a DNN for fault localization at the function level. Subsequently, the invocation information of the statements of the top-k functions is used to train another neural network to localize the faulty statement. We also report an extension to our approach for localizing multiple faults. This involves partitioning the failed test cases into clusters such that they target different faults. Our empirical evaluation indicates that our proposed approach requires examining 30.05 to 50.74% less code on an average, as compared to related fault localization techniques.

Fault localization (FL) is a time consuming and tedious task during program debugging. Most of the existing FL methods use statement coverage information to prioritize the statements based upon a computed suspiciousness score. We use predicate level execution trace to train a multilayer perceptron neural network model for effective fault localization. After prioritizing the fault at predicate level, we search the statements bounded by the predicates. Also, dynamic slicing is used to reduce the search space. We have experimentally studied the performance of our approach over Siemens suite and Space program and found that it is performing on an average 39.12% more effectively than DStar, a state-of-the-art bug localization technique.

An unduly large number of test cases are required for effective testing of programmes containing complex decision statements. In this context, modified condition/decision coverage (MC/DC) testing has been acknowledged to provide effective testing using a test suite whose size is linear in the number of the clauses present in a predicate. MC/DC testing is well‐accepted and is mandated by several testing standards. T‐way testing is another prominent testing technique that helps to limit the combinatorial explosion of black‐box test cases. Its application to white‐box testing promises to provide effective testing with a comparatively small number of test cases. The authors empirically investigate the effectiveness of MC/DC testing vis‐à‐vis white‐box pairwise, 3‐way and 4‐way testing.

Modified Condition / Decision Coverage (MC/DC) is the second strongest coverage criterion in white-box testing.According to DO178C/RTCA criterion it is mandatory to achieve Level A certification for MC/DC.Concolic testing is the combination of Concrete and Symbolic execution.It is a systematic technique that performs symbolic execution but uses randomlygenerated test inputs to initialize the search and to allow the tool to execute programs when symbolic execution fails.In this paper, we extend concolic testing by computing MC/DC using the automatically generated test cases.On the other hand Feedback-Directed Random Test Generation builds inputs incrementally by randomly selecting a method call to apply and find arguments from among previously-constructed inputs.As soon as the input is built, it is executed and checked against a set of contracts and filters.In our proposed work, we combine feedback-directed test cases generation with concolic testing to form Java-Hybrid Concolic Testing (Java-HCT).Java-HCT generates more number of test cases since it combines the features of both Feedback-Directed Random Test and Concolic Testing.Hence, through Java-HCT, we achieve high MC/DC.Combinations of approaches represent different tradeoffs of completeness and scalability.We develop Java-HCT using RANDOOP, jCUTE, and COPECA.Combination of RANDOOP and jCUTE creates more test cases.COPECA is used to measure MC/DC% using the generated test cases.Experimental study shows that Java-HCT produces better MC/DC% than individual testing techniques(feedback-directed random testing and concolic testing).We have improved MC/DC by ×1.62 and by ×1.26 for feedback-directed random testing and concolic testing respectively.

The temperature of a block (a region in the chip) depends on both heat generation (caused by power consumption) and heat dissipation among neighbors. Power aware test solutions targeting low power consumption during testing, may not produce an acceptable thermal aware solution. In this paper, a hardware based solution using an AND-OR block between the decompressor and each scan chain, has been utilized to deactivate some scan chains during loading to reduce peak temperature during testing. The proposed schemes require negligible hardware overhead and do not require any special patterns. Experimental results of our proposed approach on ISCAS'89 and ITC'99 benchmark circuits show a good reduction in peak temperature.

Temperature during testing has become an important issue to be considered with the continuous improvement of VLSI technology. As increase in temperature during testing causes permanent or temporal damage of the chip, reduction in peak temperature of the chip becomes necessary. Also to bring uniformity in temperature distribution across the chip the thermal variance needs to be reduced. Temperature of a block depends on both heat generation caused by power consumption and heat dissipation among neighboring blocks in the circuit under test (CUT). Heat generation can be reduced by reducing transitions among test vectors. However, heat dissipation depends on thermal gradient. To reduce the peak temperature and thermal variance, the don't care bits present in test vectors can be filled in such a way that the transitions of a block and also of its neighbors get reduced. In this paper we have proposed a don't care filling technique which fills the don't care bits in the test vectors in a way such that peak temperature and thermal variance as well as the peak power and average power get reduced. Experimental results of our proposed approach on ISCAS'89 benchmark circuits show an enriched reduction in peak temperature and thermal variance as well as in peak power and average power with nominal CPU time.