Compositional Symbolic Execution with Memoized Replay

Abstract

Abstract-Symbolic execution is a powerful, systematic analysis that has received much visibility in the last decade. Scalability however remains a major challenge for symbolic execution. Compositional analysis is a well-known general purpose methodology for increasing scalability. This paper introduces a new approach for compositional symbolic execution. Our key insight is that we can summarize each analyzed method as a memoization tree that captures the crucial elements of symbolic execution, and leverage these memoization trees to efficiently replay the symbolic execution of the corresponding methods with respect to their calling contexts. Memoization trees offer a natural way to compose in the presence of heap operations, which cannot be dealt with by previous work that uses logical formulas as summaries for compositional symbolic execution. Our approach also enables efficient target oriented symbolic execution for error detection or program coverage. Initial experimental evaluation based on a prototype implementation in Symbolic PathFinder shows that our approach can be up to an order of magnitude faster than traditional non-compositional symbolic execution.

Platinum: Reusing Constraint Solutions in Bounded Analysis of Relational Logic

“…The technique most closely related to ours is Green [62]; this technique has been the subject of several more recent papers [6,7,29,47,49,50,65], that improve on its algorithm. As noted in Section 1, Green and its offshoots also rely on back-end con-straint solving engines.…”

“…PLATINUM further improves analysis efficiency by omitting redundant constraints from a specification before translating them into propositional formulas to be solved by expensive constraint solvers, thereby greatly reducing the required computational effort. Although techniques for storing the results of satisfiability checking and reusing them later have been considered in the context of symbolic execution [6,7,29,49,62], these techniques cannot be directly applied to Alloy due to the specifics of its core logic, which consolidates the quantifiers of first-order logic with the operators of the relational calculus [28]. (Section 5 provides details.…”

Running symbolic execution forever

“…As discussed in the introduction, our work extends the excellent idea of memoized symbolic execution [26] to make it possible to detect divergences, store long-running paths without having to bring the entire execution tree back into memory and overcoming the restriction of using the same search heuristic in the record and replay runs. All these contributions make it possible for MoKlee to scale from the type of short runs on which memoized symbolic execution was previously evaluated (on the order of minutes, with small memoized trees) [22,26] to very long runs (of hours and even days, with trees of millions of nodes).…”

Non-Semantics-Preserving Transformations for Higher-Coverage Test Generation Using Symbolic Execution

“…A number of more recent techniques, e.g, SMART [35], SMASH [36], CompoSE [37], and others [38,39] further developed the idea and showed its usefulness in scaling symbolic execution.…”