Using Dynamic Symbolic Execution to Generate Inputs in Search-Based GUI Testing Kevin Salvesen * , Juan P. Galeotti * , Florian Gross * , Gordon Fraser † and Andreas Zeller * * Computer Science, Saarland University, Germany † Dep. of Computer Science, University of Sheffield, UK Abstract—Search-based testing has been successfully applied to generate complex sequences of events for graphical user interfaces (GUIs), but typically relies on simple heuristics or random values for data widgets like text boxes. This may greatly reduce the effectiveness of test generation for applications which expect specific input values to be entered in their GUI by users. Generating such specific input values is one of the virtues of dynamic symbolic execution (DSE), but DSE is less suitable to generate sequences of events. Therefore, this paper describes a hybrid approach that uses search-based testing to generate sequences of events, and DSE to build input data for text boxes. This is achieved by replacing standard widgets in a system under test with symbolic ones, allowing us to execute GUIs symbolically. In this paper, we demonstrate an extension of the search-based GUI testing tool EXSYST, which uses DSE to successfully increase the obtained code coverage on two case study applications. I. I NTRODUCTION The most common system-level interface of software ap- plications is their graphical user interface (GUI) [1]. It is estimated that 45% to 60% of all software code is used for implementing GUIs and that 50% of total development time is spent on GUIs [2]. Compared to other types of code, GUI- based software has a reputation of being particularly hard to test [3]. Testing GUI-based software manually is labour intensive, as even small applications can have GUIs with many screens and widgets [4]. To support GUI testing, automation is desired [5]. The simplest automated GUI testing approaches are random [6] or script-based testing [7], but more advanced techniques relying on model-based testing [8] or search-based testing [9] have been proposed. Most of these tools focus entirely on generating complex sequences of GUI events that try to cover an application’s GUI as much as possible, and ignore the problem of generating input values for data widgets like text boxes. While using random input values (as most tools do) can still lead to high coverage on some applications, on those that expect specific input for their data widgets the achieved coverage is usually much lower. For example, consider the WorkoutGenerator application, shown in Figure 1, which generates a workout plan for a user depending on attributes like age, size, and sex. Even a state of the art GUI testing tool like EXSYST [9] fails to cover large parts of its code. Listing I, showing an excerpt of Work- outGenerator’s code, reveals why: There are branches using seemingly simple logical conditions — but these conditions depend on the values users enter for their age, height, and Fig. 1. WorkoutGenerator, a simple application that generates a workout plan for a person depending on parameters like age, size, and sex. Since most of the branches in this program depend on values that come from data widgets, EXSYST fails at covering a great number of them. 1 // age is taken from a text box 2 if (gender.equals("Male")) { 3 if (experience.equals("Beginner")) { 4 if (age >= 0 && age <= 20) { 5 cardioCoefficient = cardioCoefficient * 0.5; 6 } 7 if (age > 20 && age <= 30) { 8 cardioCoefficient = cardioCoefficient * 1.2; 9 } 10 if (age > 30 && age <= 45) { 11 cardioCoefficient = cardioCoefficient * 2.0; 12 } 13 if (age > 45) { 14 cardioCoefficient = cardioCoefficient * 1.5; 15 } 16 } 17 / * ... * / 18 } Fig. 2. While covering the first two branches is not difficult for EXSYST because the number of items in drop-down lists is fairly limited, the four other branches (at lines 3, 6, 9, 12) expect very specific values in a text box. Using its standard approach, EXSYST is not able to build the test data that would cover these branches. With our DSE extension, EXSYST can not only recognize that the code expects numeric input, but is also able to generate the specific values required to cover each branch. weight in text boxes. Using random strings (which may not even be numeric) for these text boxes thus means that most of the application’s behaviour is never tested. To solve this issue, we extend the search-based automated GUI test generator EXSYST, such that it applies dynamic