Directed incremental symbolic execution

Abstract

The last few years have seen a resurgence of interest in the use of symbolic execution -a program analysis technique developed more than three decades ago to analyze program execution paths. Scaling symbolic execution and other path-sensitive analysis techniques to large systems remains challenging despite recent algorithmic and technological advances. An alternative to solving the problem of scalability is to reduce the scope of the analysis. One approach that is widely studied in the context of regression analysis is to analyze the differences between two related program versions. While such an approach is intuitive in theory, finding efficient and precise ways to identify program differences, and characterize their effects on how the program executes has proved challenging in practice.In this paper, we present Directed Incremental Symbolic Execution (DiSE), a novel technique for detecting and characterizing the effects of program changes. The novelty of DiSE is to combine the efficiencies of static analysis techniques to compute program difference information with the precision of symbolic execution to explore program execution paths and generate path conditions affected by the differences. DiSE is a complementary technique to other reduction or bounding techniques developed to improve symbolic execution. Furthermore, DiSE does not require analysis results to be carried forward as the software evolves-only the source code for two related program versions is required. A case-study of our implementation of DiSE illustrates its effectiveness at detecting and characterizing the effects of program changes.

Covrig: a framework for the analysis of code, test, and coverage evolution in real software

“…For example, the research community has invested a lot of effort in designing techniques for improving the testing of software patches, ranging from test suite prioritisation and selection algorithms [11,30,35] to program analysis techniques for test case generation and bug finding [1,2,20,21,27,28,36,40] to methods for surviving errors introduced by patches at runtime [14]. Many of these techniques depend on the existence of a manual test suite, sometimes requiring the availability of a test exercising the patch [24,37], sometimes making assumptions about the stability of program coverage or external behaviour over time [14,29], other times using it as a starting point for exploration [10,16,22,39], and often times employing it as a baseline for comparison [3,6,9,26].…”

A change impact analysis to characterize evolving program behaviors

“…1. The WBS example is taken from [7]; it contains two integer global variables, AltPress and Meter. The CFG shown is for the update method in WBS with three integer variables, PedalPos, BSwitch, and PedalCmd, as input arguments.…”

“…2) Generating an Impact Set: Impact sets for each method are generated using standard program slicing techniques as described in detail in [7]. High-level pseudocode for the dependence analysis used to generate the impact sets is shown in Fig.…”

“…Directed Incremental Symbolic Execution (DiSE) is an intraprocedural change impact analysis for characterizing the impact of software changes on program execution behaviors [7]. DiSE combines the efficiencies of static analysis with the precision of symbolic execution [8], [9].…”

“…In this section, we provide an overview of the DiSE methodology [7] and illustrate, using a small example, how the intraprocedural analysis estimates which behaviors may be impacted by changes to a method. We begin with a brief explanation of symbolic execution.…”