Abstract
Together with the increment in using software for daily activities, it becomes more important to guarantee the quality of software. In software engineering, two most popular approaches to guarantee software quality are verification and testing. However, both approaches still have many open problems that need to be solved. In verification, the difficulties of writing formal specifications and invariants make it unpopular in practice, especially for complex programs such as heap-based ones. In testing, two popular techniques symbolic execution and concolic execution may generate many invalid test inputs when applying to heap-based programs. In this thesis, we propose several approaches to overcome those problems. The thesis may be divided into two parts. In the first part, we propose an approach which can infer invariants for programs based on machine learning techniques, e.g., classification and active learning. We first show how to use the inferred invariants as assertions and for debugging. The experimental results show that we can generate meaningful invariants and ease the debugging process for programmers. Then we show how to use them to assist heap-based program verification. With our approach, two state-of-the-art verifiers can complete the tasks that they previously cannot. In the second part, we propose a symbolic execution engine and a concolic execution engine for heap-based programs. Our engines are based on separation logic, which can help to guarantee all generated test inputs are valid. The experimental results show that we can generate valid test inputs for nontrivial heap-based programs with high code-coverage.