Mutation testing: practical aspects and cost analysis



Similar documents
A framework and a web implementation for combinatorial testing

Semantic Mutation Testing Tool in Python

Gerunds, Participles, and Infinitives

Automatic generation of fully-executable code from the Domain tier of UML diagrams

Comparing the effectiveness of automated test generation tools EVOSUITE and Tpalus

Object-Oriented Testing Capabilities and Performance Evaluation of the C# Mutation System

MuJava : An Automated Class Mutation System

Towards an automated testing framework to manage variability using the UML Testing Profile

Improving Mutation Testing Process of Python Programs

RFID Tool & MRO Tracking...

TO C O N VERT O R N O T T O C O N VERT... T H AT IS THE QUESTION

Introduction to Software Testing Chapter 8.1 Building Testing Tools Instrumentation. Chapter 8 Outline

Test Case Design Techniques

An Empirical Study on the Scalability of Selective Mutation Testing

Judy a mutation testing tool for Java

Test case design techniques II: Blackbox testing CISS

SQLMutation: A tool to generate mutants of SQL database queries

Test case design techniques I: Whitebox testing CISS

Random vs. Structure-Based Testing of Answer-Set Programs: An Experimental Comparison

Description of Class Mutation Mutation Operators for Java

Object-Oriented Testing Capabilities and Performance Evaluation of the C# Mutation System

Performance Workload Design

Tool & MRO Management Technology...

General Introduction

Assertions Are Strongly Correlated with Test Suite Effectiveness

Test case design techniques I: Whitebox testing CISS

Towards a Sufficient Set of Mutation Operators for. Structured Query Language (SQL)

How To Test A Web Based Application Automatically

Jonathan Worthington Scarborough Linux User Group

Experimental Comparison of Concolic and Random Testing for Java Card Applets

Language Processing Systems

This white paper was written by Csilla Zsigri, The 451 Group, based on the work done by the SmartLM Consortium in business modeling.

Testing Metrics. Introduction

There are 2 approaches to starting a session: the mutation scope can contain a whole codebase or in a single chosen method.

Compiling Object Oriented Languages. What is an Object-Oriented Programming Language? Implementation: Dynamic Binding

MapReduce. MapReduce and SQL Injections. CS 3200 Final Lecture. Introduction. MapReduce. Programming Model. Example

Comparison of Unit-Level Automated Test Generation Tools

Problems and Measures Regarding Waste 1 Management and 3R Era of public health improvement Situation subsequent to the Meiji Restoration

Towards a Framework for Generating Tests to Satisfy Complex Code Coverage in Java Pathfinder

Search-based Data-flow Test Generation

Scaling Up Automated Test Generation: Automatically Generating Maintainable Regression Unit Tests for Programs

Introduction to Automated Testing

Performance Based Evaluation of New Software Testing Using Artificial Neural Network

Big Data Analytics with MapReduce VL Implementierung von Datenbanksystemen 05-Feb-13

Using a Multi-Agent Architecture to Manage Knowledge in the Software Maintenance Process

Scenario: Optimization of Conference Schedule.

Test Driven Development

Assessment for Master s Degree Program Fall Spring 2011 Computer Science Dept. Texas A&M University - Commerce

Systems Engineering and Integration for the NSG (SEIN) SharePoint Developer

Metamorphic Testing and DSL for Test Cases & Checker Generators

Coverage Criteria for Search Based Automatic Unit Testing of Java Programs

ExSched: Solving Constraint Satisfaction Problems with the Spreadsheet Paradigm

HOTPATH VM. An Effective JIT Compiler for Resource-constrained Devices

AutoTest: A Tool for Automatic Test Case Generation in Spreadsheets

Convergence of Translation Memory and Statistical Machine Translation

Module 10. Coding and Testing. Version 2 CSE IIT, Kharagpur

Generating Test Suites with Augmented Dynamic Symbolic Execution

Prediction of Business Process Model Quality based on Structural Metrics

Process Models and Metrics

Advanced compiler construction. General course information. Teacher & assistant. Course goals. Evaluation. Grading scheme. Michel Schinz

Fachbereich Informatik und Elektrotechnik SunSPOT. Ubiquitous Computing. Ubiquitous Computing, Helmut Dispert

Cryptography and Network Security. Prof. D. Mukhopadhyay. Department of Computer Science and Engineering. Indian Institute of Technology, Kharagpur

Computing Concepts with Java Essentials

Fault Analysis in Software with the Data Interaction of Classes

Fourth generation techniques (4GT)

Formal Software Testing. Terri Grenda, CSTE IV&V Testing Solutions, LLC

In Spain, 56,030 titles were published in 2014, that is, 0.7% less than in the previous year

CS 451 Software Engineering Winter 2009

Applying Mutation Testing to Web Applications

DATA OBFUSCATION. What is data obfuscation?

Improving the Performance of a Computer-Controlled Player in a Maze Chase Game using Evolutionary Programming on a Finite-State Machine

Empirically Identifying the Best Genetic Algorithm for Covering Array Generation

A greedy algorithm for the DNA sequencing by hybridization with positive and negative errors and information about repetitions

Model based testing tools. Olli Pekka Puolitaival

Formal Methods for Software Development

SQL INJECTION MONITORING SECURITY VULNERABILITIES IN WEB APPLICATIONS

A Brief Study of the Nurse Scheduling Problem (NSP)

Java Generation from UML Models specified with Alf Annotations

Mutation testing of ASP.NET MVC

Software Quality Engineering: Testing, Quality Assurance, and Quantifiable Improvement

How to make the computer understand? Lecture 15: Putting it all together. Example (Output assembly code) Example (input program) Anatomy of a Computer

Transcription:

Mutation testing: practical aspects and cost analysis Macario Polo and Mario Piattini Alarcos Group Department of Information Systems and Technologies University of Castilla-La Mancha (Spain) Macario.Polo@uclm.es 1

Contents What is mutation testing? Mutation operators Steps of mutation testing Cost reduction Conclusions 2

What is mutation testing? The goal of testing is to find faults on the System Under Test (SUT) Thus, a test suite is more or less effective depending on its ability to find faults on the SUT 3

A possible SUT To be, or not to be: that is de question: Whether 'tis novler in the mind to sufer The slings and arrows of outrageus fortune, Or to take arms against a sea of troubles, And by opposing end them? To die: to sleep; No more; and by a slept to say the end The heart-ache ache and the thousand natural socks That flesh is heir to, 'tis a consummation Deboutly to be wish'd. To die, to sleep; (Hamlet, by William Shakespeare) 4

What is mutation testing? If I need to select an English reviewer, maybe I would select that of you who more faults have found Mutation works in this way: A set of mutants are generated from a given SUT A test suite is executed against the original SUT and its mutants The adequacy of the suite is measured in terms of the mutation score 6

What is mutation testing? The mutation score measures the ability of the test suite to find faults on the SUT where: K MS( P, T ) = ( M E) P: program under test T: test suite K: number of mutants killed M: number of mutants E: number of functionally-equivalent mutants 7

What is mutation testing? Mutants maybe killed or alive A mutant m is killed when it shows a different behavior that P, for one or more t P: t T / f ( mt, ) f ( P, t) Otherwise, the mutant is alive f ( mt, ) = f ( P, t) t T 8

What is mutation testing? Each mutant is a copy of the program under test, usually with a small syntactic change, which is interpreted as a fault Mutants with n faults are call n-order mutants 9

What is mutation testing? Each mutant is a copy of the program under test, usually with a small syntactic change, which is interpreted as a fault it was a SUT with seeded faults To To To To be, be, be, be, or or or or not not not not to to to to be: be: be: be: that that that that is is is is the the the the question: question: question: question: Whether Whether Whether Whether 'tis 'tis 'tis 'tis nobler nobler nobler nobler in in in in the the the the mind mind mind mind to to to to suffer suffer suffer suffer The The The The slings slings slings slings and and and and arrows arrows arrows arrows of of of of outrageous outrageous outrageous outrageous fortune, fortune, fortune, fortune, Or Or Or Or to to to to take take take take arms arms arms arms against against against against a a a a sea sea sea sea of of of of troubles, troubles, troubles, troubles, And And And And by by by by opposing opposing opposing opposing end end end end them? them? them? them? To To To To die: die: die: die: to to to to sleep; sleep; sleep; sleep; No No No No more; more; more; more; and and and and by by by by a a a a sleep sleep sleep sleep to to to to say say say say we we we we end end end end The The The The heart heart-ache heart ache ache ache and and and and the the the the thousand thousand thousand thousand natural natural natural natural shocks shocks shocks shocks That That That That flesh flesh flesh flesh is is is is heir heir heir heir to, to, to, to, 'tis 'tis 'tis 'tis a a a a consummation consummation consummation consummation Devoutly Devoutly Devoutly Devoutly to to to to be be be be wish'd wish'd. wish'd. To To To To die, die, die, die, to to to to sleep; sleep; sleep; sleep; Mutants with n faults are call n-order mutants 5 It s a 7th-order mutant 10

A program and four mutants Version Code Test data (a,b) P (original) Mutant 1 Mutant 2 int sum(int a, int b) { return a + b; } int sum(int a, int b) { return a - b; } int sum(int a, int b) { return a * b; } P M1 M2 (1, 1) 2 0 1 (0, 0) 0 0 0 (-1, 0) -1-1 0 (-1, -1) -2 0 1 Mutant 3 int sum(int a, int b) { return a / b; } M3 1 Error Error 1 Mutant 4 int sum(int a, int b) { return a + b++; } M4 2 0-1 -2 11

What is mutation testing? Faults are introduced ( seeded ) by mutation operators, and try to imitate actual programmer errors Mutation relies on the Coupling effect : a test suite that detects all simple faults in a program is so sensitive that it also detects more complex faults 12

Some mutation operators Operator ABS ACR AOR CRP ROR RSR SDL UOI Description Substitution of a variable x by abs(x) Substitution of a variable array reference by a constant Arithmetic operator replacement (a+b by a-b) Substitution of a constant value Relational operator replacement (A and B by A or B) Return statement substitution (return 5 by return 0) Removal of a sentence Unary operator insertion (instead of x, write x) 13

Steps of mutation testing Mutation testing has three main steps: 1. Mutant generation 2. Mutant execution 3. Result analysis 14

Mutant generation Almost each executable instruction of the original program can be mutated with several mutation operators Therefore, the number of mutants generated for a normal program may be huge The cost of compilation of all mutants may be also significant 15

Mutant generation Offutt et al. (1996): 10 programs from 10 to 48 executable sentences produce from 183 to 3010 mutants Mresa and Botaci (1999): 11 programs with 43,7 LOC produce 3211 mutants One of our experiments: mean of 76,7 LOC produce a mean of 150 mutants 16

Mutant generation Java version of Myers (1979) triangle-type problem: 61 LOC, 262 mutants A widely-used mutation tool is MuJava (Ma, Offutt and Kwon, 2005) 17

Mutant generation: the MuJava tool Mutants (and operators) Number of mutants per operator Fault introduced Number of mutants Modified sentence 18

Mutant generation: the MuJava tool In general, a parser is required to generate mutants: a+b is translated into a-b, a*b, a/b Then, these program versions are compiled MuJava uses Mutant Schemata Generation With some operators, it substitutes (at bytecode level) a+b by a OPERATOR b Then, all the program versions are directly generated with no need of compiling 19

Mutant execution In this case, the problem is the huge number of test cases that must be executed: each case is executed against the original program and the mutants. For testing a simple BankingAccount class, with 96 mutants and 300 test cases, 96*300=28,800 executions are required (with at least 28.800 accesses to the database, etc.) 20

Mutant execution All the outputs must be compared to detect which mutants are killed: In the BankingAccount example, the outputs of the 300 test cases with the original and the 96 mutants Actually, killed mutants can be removed for further comparisons 21

Mutant execution: MuJava Class under test Test suite Mutants Results area 22

Mutant execution: testooj testooj is a relatively user-friendly research tool developed in the University of Castilla- La Mancha Generates test cases in several formats and according to several generation strategies Executes test cases against versions and gives some additional results 23

Test suite Mutant execution: testooj Class under test Mutants Test cases Killing matrix 24

The killing matrix 25

Result analysis The major difficulties appear with the detection of functionally equivalent mutants 26

Result analysis A functionally equivalent mutant is a mutant which never will be killed Actually, the fault introduced is not a fault, but a code de-optimization 27

Result analysis Mutation operators have different proneness for producing equivalent mutants 28

Result analysis The example is an occurrence of the AOIS operator 29

Result analysis Detection of equivalent mutants is usually manual Grüen, Schuler and Zeller (2009) report that some equivalent mutants require up to 15 minutes to be detected Offutt and Pan (1997) demonstrated that is possible to automatically detect almost 50% of functionally equivalent mutants if the program under test is annotated with constraints 30

Result analysis Once more, the selection of the best mutation operators is essential (this is selective mutation): Replacement of numerical constants Negate jump conditions Replacement of arithmetic operators Omission of method calls (instead of x=foo(), write x=0.0) 31

Result analysis Other strategies rely on weak mutation: Strong mutation has three conditions: Reachability (the instruction must be reached) Necessity (once the sentences has been reached, the test case must cause an erroneous state on the mutant) Sufficiency (the erroneous state must be propagated to the output) Instead of observing the output of each test case, the idea of weak mutation is to detect changes in intermediate states (reachability+necessity) 32

Cost reduction Summarizing, in mutant generation: Selective mutation (use of the best operators) Mutant Schemata Generation/Mutation at bytecode level In mutant execution: Reduction of the test suite N-order mutation In result analysis: To take advantage of the previous techniques 33

Reduction of the test suite The optimal test-suite reduction problem: Given: Test Suite T, a set of test-case requirements r1, r2,..., rn, that must be satisfied to provide the desired test coverage of the program. Problem: Find T T such that T satisfies all ri and ( T T, T satisfies all r T T ) It is NP-hard (no solution in polynomial time): solutions approached with greedy algorithms 34

Reduction of the test suite Example: 6 test cases, 7 mutants 35

Reduction of the test suite The greedy approach selects the test case killing more mutants T tc2 tc3 tc4 36

Reduction of the test suite in testooj Reduced suite 37

N-order mutation The idea is to have mutants with more than one fault 38

N-order mutation Thus: The number of mutants is closed to half the size of the original suite Each equivalent mutant will be probably combined with a non-equivalent mutant, what implies a reduction of the number of equivalent mutants 39

N-order mutation However, there exists the possibility of having a test case that only finds one of the two faults injected 40

N-order mutation Algorithms for mutants combination LastToFirst DifferentOperators RandomMix 41

LastToFirst First with the last, second with the penultime, etc. AOIS_1-ROR_6, AOIS_10-ROR_4, etc. It gets a half of the original mutant set 42

DifferentOperators Combines mutants obtained with different operators Mutants proceeding from the least frequent operator are used more than once 43

RandomMix Makes a pure random combination 44

Results with benchmark programs 45

Results with benchmark programs 46

Results with industrial software 47

Cost-risk analysis 48

Cost-risk analysis 49

Conclusions Mutation is an excellent testing technique From the point of view of research, it is mature From the industry point of view, userfriendly tools are required Mutation is also applied at other levels: black-box, components, web services, models 50

Mutation testing: practical aspects and cost analysis Macario Polo and Mario Piattini Alarcos Group Department of Information Systems and Technologies University of Castilla-La Mancha (Spain) Macario.Polo@uclm.es 51