  Dataflow coverage, one of the white-box testing criteria, focuses on the
relations between variable definitions and their uses.Several empirical studies
have proved data-flow testing is more effective than control-flow testing.
However, data-flow testing still cannot find its adoption in practice, due to
the lack of effective tool support. To this end, we propose a guided symbolic
execution approach to efficiently search for program paths to satisfy data-flow
coverage criteria. We implemented this approach on KLEE and evaluated with 30
program subjects which are constructed by the subjects used in previous
data-flow testing literature, SIR, SV-COMP benchmarks. Moreover, we are
planning to integrate the data-flow testing technique into the new proposed
symbolic execution engine, SmartUnit, which is a cloud-based unit testing
service for industrial software, supporting coverage-based testing. It has
successfully helped several well-known corporations and institutions in China
to adopt coverage-based testing in practice, totally tested more than one
million lines of real code from industry.
