Abstracting path conditions

Strejček, Jan; Trtík, Marek

doi:10.1145/2338965.2336772

Cited by 23 publications

(31 citation statements)

References 39 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…They use forward heuristic search when BSE cannot reason about particular parts of the code. Forward heuristic search [19], [20], [4], [17], [21] is another part of the story of directed symbolic execution besides BSE.…”

Section: Related Workmentioning

confidence: 99%

Compositional Symbolic Execution Using Fine-Grained Summaries

Lin

Miller

Søndergaard

2015

2015 24th Australasian Software Engineering Conference

View full text Add to dashboard Cite

Compositional symbolic execution has been proposed as a way to increase the efficiency of symbolic execution. Essentially, when a function is symbolically executed, a summary of the path that was executed is stored. This summary records the precondition and postcondition of the path, and on subsequent calls that satisfy that precondition, the corresponding postcondition can be returned instead of executing the function again. However, using functions as the unit of summarisation leaves the symbolic execution tool at the mercy of a program designer, essentially resulting in an arbitrary summarisation strategy. In this paper, we explore the use of fine-grained summaries, in which blocks within functions are summarised. We propose three types of summarisation and demonstrate how to generate these. At such a fine-grained level, symbolic execution of a path effectively becomes the concatenation of the summaries along that path. Using a prototype symbolic execution tool, we perform a preliminary experimental evaluation of our summary approaches, demonstrating that they can improve the speed of symbolic execution by reducing the number of calls sent to the underlying constraint solver.

show abstract

Section: Related Workmentioning

confidence: 99%

Compositional Symbolic Execution Using Fine-Grained Summaries

Lin

Miller

Søndergaard

2015

2015 24th Australasian Software Engineering Conference

View full text Add to dashboard Cite

show abstract

“…The results of the classification show the distribution of FILs and IDLs, and provide us insights on how to automatically identify IDLs and FILs for further analysis. Moreover, nested loops may cause loss of precision for loop-invariant techniques or summarization techniques [42], and pose more challenges in the scale of path explorations. Thus, we also identify the nested loops among the studied loops.…”

Section: A Subjects and Study Setupmentioning

confidence: 99%

“…We then apply Pex (reflecting search-guiding heuristics) and Pex with bounded iteration (referred to as Pex-bounded) to explore the identified IDLCs. Our study focuses on only IDLCs since IDLs that do not compromise coverage of subsequent branches can be easily handled by bounded iteration and search-guiding heuristics, while symbolic execution faces challenges to reason about the side effects of IDLCs [20], [40], [42]. Pex by default uses the mixed search strategy that combines different search strategies: depth-first search, random search, and fitness search [54], making Pex a representative tool for searchguiding heuristics.…”

Section: A Subjects and Study Setupmentioning

confidence: 99%

“…These constraints are added to path conditions for steering further path explorations, addressing the issue of unrolling the loop without achieving higher coverage. More recent research [42] extends the summarization of iteration counts by using symbolic variables to represent different paths taken inside the loop, enabling summarization of the relationship between program variables and the branches inside the loop. These techniques require detection of induction variables whose values are modified by a constant value or constant times for each loop iteration.…”

Section: Related Workmentioning

confidence: 99%

“…For example, a recent study [37] shows that DSE may keep unfolding an IDL without achieving coverage of any new branches. Recent research has tried to address this challenge by using bounded iteration to constrain loop unrolling [19], using search-guiding heuristics to guide path exploration [11], [48], [54], or using loop summarization to summarize loops based on inferred loop invariants [20], [40], [42] (referred to as loop summarization).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Characteristic studies of loop problems for structural test generation via symbolic execution

Xiao

Xie

et al. 2013

2013 28th IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

Dynamic Symbolic Execution (DSE) is a state-ofthe-art test-generation approach that systematically explores program paths to generate high-covering tests. In DSE, the presence of loops (especially unbound loops) can cause an enormous or even infinite number of paths to be explored. There exist techniques (such as bounded iteration, heuristics, and summarization) that assist DSE in addressing loop problems. However, there exists no literature-survey or empirical work that shows the pervasiveness of loop problems or identifies challenges faced by these techniques on real-world open-source applications.To fill this gap, we provide characteristic studies to guide future research on addressing loop problems for DSE. Our proposed study methodology starts with conducting a literature-survey study to investigate how technical problems such as loop problems compromise automated software-engineering tasks such as test generation, and which existing techniques are proposed to deal with such technical problems. Then the study methodology continues with conducting an empirical study of applying the existing techniques on real-world software applications sampled based on the literature-survey results and major open-source project hostings. This empirical study investigates the pervasiveness of the technical problems and how well existing techniques can address such problems among real-world software applications. Based on such study methodology, our two-phase characteristic studies identify that bounded iteration and heuristics are effective in addressing loop problems when used properly. Our studies further identify challenges faced by these techniques and provide guidelines for effectively addressing these challenges.

show abstract

A Calculus for Modular Loop Acceleration

Frohn

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Loop acceleration can be used to prove safety, reachability, runtime bounds, and (non-)termination of programs operating on integers. To this end, a variety of acceleration techniques has been proposed. However, all of them are monolithic: Either they accelerate a loop successfully or they fail completely. In contrast, we present a calculus that allows for combining acceleration techniques in a modular way and we show how to integrate many existing acceleration techniques into our calculus. Moreover, we propose two novel acceleration techniques that can be incorporated into our calculus seamlessly. An empirical evaluation demonstrates the applicability of our approach.⋆ This work has been funded by DFG grant 389792660 as part of TRR 248 (see https://perspicuous-computing.science).

show abstract

Abstracting path conditions

Cited by 23 publications

References 39 publications

Compositional Symbolic Execution Using Fine-Grained Summaries

Compositional Symbolic Execution Using Fine-Grained Summaries

Characteristic studies of loop problems for structural test generation via symbolic execution

A Calculus for Modular Loop Acceleration

Contact Info

Product

Resources

About