Learning Test Input Constraints from Branch Conditions

Precise input specifications are the holy grail of blackbox test generation. In order to test programs that process structured inputs effectively, inputs should match the expected input format. Otherwise, they are likely to be rejected during initial input validation, and fail to reach the main application logic. While the structure and constraints of widely used data formats such as XML are known, the input constraints imposed by application logic are vast, unstructured, and encoded in branch conditions. Hence, they are rarely specified manually, leaving large parts of the program unexplored by blackbox techniques. We propose to address this issue by dynamically externalizing local constraints and exposing them to system-level test generators. These could combine such constraints with an existing input specification in order to find global solutions. This could provide a means to explore application logic systematically.