Generating input data structures for automated program testing

Automatic test data generation usually concerns identifying input values that cause a selected path to execute. If a given path involves pointers, then input values may be represented in terms of 2-dimensional dynamic data structures such as lists or trees. When testing is conducted for programs in the presence of pointers, it is very important to identify a shape of the input data structure describing how many nodes are required and how nodes are connected each other. The approach presented in this paper makes use of the points-to information for each statement in the selected path that will be used to represent the shape of an input data structure. It also converts each statement into static single assignment (SSA) form without pointer dereferences. This allows the approach to consider each statement in the selected path as a constraint involving equality or inequality to make use of current constraint solving systems without significant effort. The SSA form serves as a system of constraints to be solved to yield input values for non-pointer types. An empirical evaluation shows that shape generation can be achieved in linear time in terms of the number of pointer dereference operations.