We introduce SEMu , a Dynamic Symbolic Execution technique that generates test inputs capable of killing stubborn mutants (killable mutants that remain undetected after a reasonable amount of testing). SEMu aims at mutant propagation (triggering erroneous states to the program output) by incrementally searching for divergent program behaviors between the original and the mutant versions. We model the mutant killing problem as a symbolic execution search within a specific area in the programs’ symbolic tree. In this framework, the search area is defined and controlled by parameters that allow scalable and cost-effective mutant killing. We integrate SEMu in KLEE and experimented with Coreutils (a benchmark frequently used in symbolic execution studies). Our results show that our modeling plays an important role in mutant killing. Perhaps more importantly, our results also show that, within a two-hour time limit, SEMu kills 37% of the stubborn mutants, where KLEE kills none and where the mutant infection strategy (strategy suggested by previous research) kills 17%.

中文翻译：

---

用象征性处决杀死顽固的变种人

我们介绍SEMu，一种动态符号执行技术，可生成能够杀死顽固突变体（经过合理数量的测试后仍未被发现的可杀死突变体）的测试输入。SEMu旨在通过增量搜索原始版本和突变版本之间的不同程序行为来实现突变传播（触发程序输出的错误状态）。我们将突变体杀死问题建模为程序符号树中特定区域内的符号执行搜索。在此框架中，搜索区域由允许可扩展且具有成本效益的突变体杀死的参数定义和控制。我们整合SEMu在 KLEE 中并尝试了 Coreutils（符号执行研究中经常使用的基准）。我们的结果表明，我们的模型在突变体杀伤中起着重要作用。也许更重要的是，我们的结果还表明，在两个小时的时间限制内，SEMu杀死 37% 的顽固突变体，其中 KLEE 没有杀死任何突变体，突变感染策略（先前研究建议的策略）杀死 17%。