一句话：提出 COMBAT，一种面向 Simulink 编译器的差分测试方法，通过可控僵尸块变异扩展变体空间并生成多样变体。
针对 Simulink 编译器测试因源码庞大、缺少完整形式语言规范而困难，且现有自动测试方法存在变体空间有限与变异多样性不足的问题，本文提出差分测试方法 COMBAT。COMBAT 含 EMI 变异与多样变体生成两部分：在种子 CPS 模型任意位置插入 If/While 等断言块，将插入点分为真假分支，并把经过插入点的数据送入真分支以保持等价，从而把假分支体作为新变体空间；再用 Markov chain Monte Carlo 优化采样种子模型，生成复杂的长序列块变异。实验表明 COMBAT 显著优于现有方法，五个月内为 Simulink R2021b 报告 16 个有效缺陷，其中 11 个被 MathWorks Support 确认为新缺陷。
As a popular Cyber-Physical System (CPS) development tool chain, MathWorks Simulink is widely used to prototype CPS models in safety-critical applications, e.g., aerospace and healthcare. It is crucial to ensure the correctness and reliability of Simulink compiler (i.e., the compiler module of Simulink) in practice since all CPS models depend on compilation. However, Simulink compiler testing is challenging due to millions of lines of source code and the lack of the complete formal language specification. Although several methods have been proposed to automatically test Simulink compiler, there still remains two challenges to be tackled, namely the limited variant space and the insufficient mutation diversity. To address these challenges, we propose COMBAT, a new differential testing method for Simulink compiler testing. COMBAT includes an EMI (Equivalence Modulo Input) mutation component and a diverse variant generation component. The EMI mutation component inserts assertion statements (e.g., If /While blocks) at arbitrary points of the seed CPS model. These statements break each insertion point into true and false branches. Then, COMBAT feeds all the data passed through the insertion point into the true branch to preserve the equivalence of CPS variants. In such a way, the body of the false branch could be viewed as a new variant space, thus addressing the first challenge. The diverse variant generation component uses Markov chain Monte Carlo optimization to sample the seed CPS model and generate complex mutations of long sequences of blocks in the variant space, thus addressing the second challenge. Experiments demonstrate that COMBAT significantly outperforms the state-of-the-art approaches in Simulink compiler testing. Within five months, COMBAT has reported 16 valid bugs for Simulink R2021b, of which 11 bugs have been confirmed as new bugs by MathWorks Support.
DOI 原文 ·
@inproceedings{paperbot6995,
title = {Detecting Simulink compiler bugs via controllable zombie blocks mutation},
author = {Shikai Guo and He Jiang and Zhihao Xu and Xiaochen Li and Zhilei Ren and Zhide Zhou and Rong Chen},
booktitle = {FSE},
year = {2022},
doi = {10.1145/3540250.3549159}
}