Many security and software testing applications require checking whether certain properties of a program hold for any possible usage scenario. For instance, a tool for identifying software vulnerabilities may need to rule out the existence of any backdoor to bypass a program's authentication. One approach would be to test the program using different, possibly random inputs. As the backdoor may only be hit for very specific program workloads, automated exploration of the space of possible inputs is of the essence. Symbolic execution provides an elegant solution to the problem, by systematically exploring many possible execution paths at the same time without necessarily requiring concrete inputs. Rather than taking on fully specified input values, the technique abstractly represents them as symbols, resorting to constraint solvers to construct actual instances that would cause property violations. Symbolic execution has been incubated in dozens of tools developed over the last four decades, leading to major practical breakthroughs in a number of prominent software reliability applications. The goal of this survey is to provide an overview of the main ideas, challenges, and solutions developed in the area, distilling them for a broad audience.If you are considering citing this survey, we would appreciate if you could use the following BibTeX entry: http://goo.gl/Hf5Fvc 0:2 R. Baldoni et al.

No abstract

We study novel combinatorial properties of graphs that allow us to devise a completely new approach to dynamic all pairs shortest paths problems. Our approach yields a fully dynamic algorithm for general directed graphs with non-negative real-valued edge weights that supports any sequence of operations in Õ(n2)1 amortized time per update and unit worst-case time per distance query, where n is the number of vertices. We can also report shortest paths in optimal worst-case time. These bounds improve substantially over previous results and solve a long-standing open problem. Our algorithm is deterministic and uses simple data structures

Abstract. We consider the problem of preprocessing an edge-weighted directed graph G to answer queries that ask for the length and first hop of a shortest path from any given vertex x to any given vertex y avoiding any given vertex or edge. As a natural application, this problem models routing in networks subject to node or link failures. We describe a deterministic oracle with constant query time for this problem that uses O(n 2 log n) space, where n is the number of vertices in G. The construction time for our oracle is O(mn 2 + n 3 log n). However, if one is willing to settle for Θ(n 2.5 ) space, we can improve the preprocessing time to O(mn 1.5 + n 2.5 log n) while maintaining the constant query time. Our algorithms can find the shortest path avoiding a failed node or link in time proportional to the length of the path.

We present the results of an extensive computational study on dynamic algorithms for all pairs shortest path problems. We describe our implementations of the recent dynamic algorithms of King and of Demetrescu and Italiano, and compare them to the dynamic algorithm of Ramalingam and Reps and to static algorithms on random, real-world and hard instances. Our experimental data suggest that some of the dynamic algorithms and their algorithmic techniques can be really of practical value in many situations.

In this paper we introduce a generalframework for casting fully dynamic transitive closure into the problem of reevaluating polynomials over matrices. With this technique, we improve the best known bounds forfully dynamic transitive closure. In particular; we devise a deterministic algorithm for general directed graphs that achieves O(n2) amortized time for updates, while preserving unit worstcase cost for queries. In case of deletions only, our algorithm pelforms updates faster in O(n) amortized time.Our matrix-based approach yields an algorithm for directed acyclic graphs which breaks through the O(n2) barrier on the single-operation complexity of fully dynamic transitive closure. We can answer queries in O(n') time andpelform updates in O(nw(l*'il)-' + nl+") time, for any E E [0,1], where w(1, E , 1) is the exponent of the multiplication of an n x n' matrix by an n' x n matrix. The current best bounds on w(1, E , 1) imply an O(n0.575) query time and an O(n1.575) update time. Our subquadratic algorithm is randomized, and has one-side errol: G = (V, E) under an intermixed sequence of the following operations:Insert(z, y): insert an edge from z to y in G;Delete(z, y): delete the edge from 2 to y in G;Query(z, y): report yes if there is a path from z to y Throughout the paper, we denote by m and by n the number of edges and vertices in G, respectively.Research on dynamic transitive closure spans over two decades. Before describing the results known, we list the bounds obtainable with simple-minded methods. If we do nothing during each update, then we have to explore the whole graph in order to answer reachability queries: this gives O(n2) time per query and 0(1) time per update in the worst case. On the other extreme, we could recompute the transitive closure from scratch after each update; as this task can be accomplished via matrix multiplication [ 1, 141, this approach yields 0 (1) time per query and O(nw) time per update in the worst case, where w is the best known exponent for matrix multiplication (currently w < 2.736 [2]). Previous Work. For the incremental version of the problem, the first algorithm was proposed by Ibaraki and Katoh [7] in 1983: its running time was O(n3) over any sequence of insertions. This bound was later improved to O(n) amortized time per insertion by Italiano [8] and also by La Poutre and van Leeuwen [ 131. Yellin [ 151 gave an O(m*h,,,) algorithm for m edge insertions, where m* is the number of edges in the final transitive closure and h, , , is the maximum out-degree of the final graph. All these algorithms maintain explicitly the transitive closure, and so their query time is O( 1). The first decremental algorithm was again given by Ibaraki and Katoh [7], with a running time of O ( n 2 ) per in G, and no otherwise.381 0-7695-0850-2/00 $10.00 0 2000 IEEE Recursively call Reset*(AD, D * ) to update P ,where A D is the sub-matrix of A X corresponding to D . UpdateQ = A + BP2C through Reset operations for any variables A, B , P , and C being changed, and recursively call Reset*(AQ, &*...

In this article we present a building block technique and a toolkit towards automatic discovery of workload-dependent performance bottlenecks. From one or more runs of a program, our profiler automatically measures how the performance of individual routines scales as a function of the input size, yielding clues to their growth rate. The output of the profiler is, for each executed routine of the program, a set of tuples that aggregate performance costs by input size. The collected profiles can be used to produce performance plots and derive trend functions by statistical curve fitting techniques. A key feature of our method is the ability to automatically measure the size of the input given to a generic code fragment: to this aim, we propose an effective metric for estimating the input size of a routine and show how to compute it efficiently. We discuss several examples, showing that our approach can reveal asymptotic bottlenecks that other profilers may fail to detect and can provide useful characterizations of the workload and behavior of individual routines in the context of mainstream applications, yielding several code optimizations as well as algorithmic improvements. To prove the feasibility of our techniques, we implemented a Valgrind tool called aprof and performed an extensive experimental evaluation on the SPEC CPU2006 benchmarks. Our experiments show that aprof delivers comparable performance to other prominent Valgrind tools, and can generate informative plots even from single runs on typical workloads for most algorithmically-critical routines

Data stream processing has recently received increasing attention as a computational paradigm for dealing with massive data sets. Surprisingly, no algorithm with both sublinear space and passes is known for natural graph problems in classical read-only streaming. Motivated by technological factors of modern storage systems, some authors have recently started to investigate the computational power of less restrictive models where writing streams is allowed. In this paper, we show that the use of intermediate temporary streams is powerful enough to provide effective spacepasses tradeoffs for natural graph problems. In particular, for any space restriction of s bits, we show that single-source shortest paths in directed graphs with small positive integer edge weights can be solved in O((n log 3/2 n)/ √ s) passes. The result can be generalized to deal with multiple sources within the same bounds. This is the first known streaming algorithm for shortest paths in directed graphs. For undirected connectivity, we devise an O((n log n)/s) passes algorithm. Both problems require Ω(n/s) passes under the restrictions we consider. We also show that the model where intermediate temporary streams are allowed can be strictly more powerful than classical streaming for some problems, while maintaining all of its hardness for others.