Regression test generation aims at generating a test suite that can detect behavioral differences between the original and the new ver sions of a program. Regression test generation can be automated by using Dynamic Symbolic Execution (DSE), a state-of-the-art test generation technique, to generate a test suite achieving high struc tural coverage. DSE explores paths in the program to achieve high structural coverage but exploration of all these paths can often be expensive. However, if our aim is to detect behavioral differences between two versions of a program, we do not need to explore all these paths in the program since not all these paths are relevant for detecting behavioral differences. In this paper, we propose an approach on guided path exploration that avoids exploring irrel evant paths in terms of detecting behavioral differences. Hence, behavioral differences are more likely to be detected earlier in path exploration. In addition, our approach leverages the existing test suite (if available) for the original version to efficiently execute the changed regions of the program and infect program state. Experi mental results on 72 versions (in total) of four programs show that our approach requires about 53% fewer runs (i.e., explored paths) on average to cause the execution of a changed region and 44% fewer to cause program-state differences after its execution than exploration without using our approach. In addition, our approach requires 71% fewer runs to cover all the changed regions by exploiting an existing test suite than exploration without using the test suite.

We conducted experiments on four programs and their 72 versions (in total) collected from three different sources. In our experiments, we try to address the following research questions:
RQ1. How much fewer DSE runs does Pex require to execute the changed regions between the two versions of a program with the assistance of eXpress?
RQ2. How much fewer DSE runs does Pex require to infect the program states with the assistance of eXpress?
RQ3. How much more tests does Pex, with the assistance of eXpress, generate that execute changed regions between the two versions of a program?
RQ4. How much more tests does Pex, with the assistance of eXpress, generate that infect the program states?
RQ5. How much fewer DSE runs does Pex require to cover the changed regions when the program exploation is seeded with the existing test suite?

SUBJECTS USED

1. Replace: 32 versions
2. Siena : 17 versions
3. Silverlight String-To-PathGeometry Converter (STPG): 2 versions
4. Structorian : 21 versions

EXPERIMENTAL SETUP

For replace and siena, we conduct regression test generation between the original version and each version v2 synthesized from the available faults in the SIR. We use eXpress and the default search strategy in Pex to conduct regression test generation. In addition to the versions synthesized by seeding faults, we also conduct regression test generation between each successive versions of siena (versions 1.8 through 1.15) available in SIR, using eXpress and the default search strategy in Pex. For STPG and structorian, we conduct regression test generation between two successive pairs of versions that we collected.

To address RQ1, we compare the number of runs of DSE required by the default search strategy in Pex (in short as Pex) with the number of runs required by Pex enhanced with eXpress (in short as Pex+eXpress) to execute a changed region. To address RQ2, we compare the number of runs required by Pex with the number of runs required by Pex+eXpress to infect the program states. To address RQ3, we compare the number of tests that cover a changed region generated by Pex with the number of such tests generated by Pex+eXpress. If more tests are generated that cover a changed region, it is easier for developers (or testers) to debug the program under test (if the changes are faulty) and gives more confidence to developers that the changes they made do not introduce any unintended side effects. To address RQ4, we compare the number of tests that infect the program state after the execution of changed region generated by Pex with the number of such tests generated by Pex+eXpress. To address RQ5, we compare the number of DSE runs required by Pex (and Pex+eXpress) to cover all the blocks in all the changed regions with and without seeding the program exploration (with the existing test suite). Our experimental results for the four subjects are shown below.

Experimental Results for Replace and STPG

Experimental Results for Siena

Experimental Results for Structorian

E-Pex: The total number of DSE runs required Pex for satisfying E (i.e., execution of a changed region)
E-eXpress: The total number of DSE runs required by Pex+eXpress for satisfying E.
Ne-Pex: The total number of tests that execute a changed region, generated by Pex
Ne-eXpres: The total number of tests that execute a changed region, generated by eXpress
I-Pex: The total number of DSE runs required by Pex for satisfying I (i.e., Program State Infection)
I-eXpress: The total number of DSE runs required by Pex+eXpress for satisfying I.
N-Pex: The total number of tests generated by Pex that infect the program state.
Ne-eXpress: The total number of tests generated by Pex+eXpress, that infect the program state.