Generalized Symbolic Execution for Model Checking and Testing

Khurshid, Sarfraz; Păsăreanu, Corina S.; Visser, Willem

doi:10.1007/3-540-36577-x_40

Cited by 374 publications

(385 citation statements)

References 24 publications

(33 reference statements)

Supporting

Mentioning

372

Contrasting

Unclassified

Order By: Relevance

“…Our work on probabilistic software analysis uses the symbolic execution tool Symbolic PathFinder (SPF) [32]. Lazy Initialization SPF uses lazy initialization [25] to handle dynamic input data structures (e.g., lists and trees). The components of the program inputs are initialized on an "as-needed" basis.…”

Section: Background 21 Symbolic Executionmentioning

confidence: 99%

“…SPF can analyze programs with unbounded data structures as inputs, using lazy initialization [25]. The result of symbolic execution is a set of paths, each characterized by a path condition that encodes both numeric and heap constraints.…”

Section: Symbolic Constraintsmentioning

confidence: 99%

“…The heap constraints can have the following forms: Example Consider the Java code in Listing 1.1 [25] that declares a class Node for a linked lists. Fields elem and next represent the node's integer value and a reference to the next node in the list, respectively.…”

Section: Symbolic Constraintsmentioning

confidence: 99%

“…However this becomes quickly intractable for large solution sets. We instead propose an approach based on symbolic execution and lazy initialization [25] to generate and thus count data structures that satisfy mixed heap and numeric constraints; we further use off-the-shelf model counting procedures [2] for the numeric constraints.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Model Counting for Complex Data Structures

Filieri

Frias

PăźSăźReanu

et al. 2015

Model Checking Software

Self Cite

View full text Add to dashboard Cite

We extend recent approaches for calculating the probability of program behaviors, to allow model counting for complex data structures with numeric fields. We use symbolic execution with lazy initialization to compute the input structures leading to the occurrence of a target event, while keeping a symbolic representation of the constraints on the numeric data. Off-the-shelf model counting tools are used to count the solutions for numerical constraints and field bounds encoding data structure invariants are used to reduce the search space. The technique is implemented in the Symbolic PathFinder tool and evaluated on several complex data structures. Results show that the technique is much faster than an enumeration-based method that uses the Korat tool and also highlight the benefits of using the field bounds to speed up the analysis.

show abstract

Section: Background 21 Symbolic Executionmentioning

confidence: 99%

Section: Symbolic Constraintsmentioning

confidence: 99%

Section: Symbolic Constraintsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Model Counting for Complex Data Structures

Filieri

Frias

PăźSăźReanu

et al. 2015

Model Checking Software

Self Cite

View full text Add to dashboard Cite

show abstract

“…For example, Wang and Musser [15] used gdb and Khurshid et al [16] rewrote instrumented source code in order to use a model checker.…”

Section: G Lee Et Almentioning

confidence: 99%

Using symbolic execution to guide test generation

Lee

Morris

Parker

et al. 2005

Softw. Test. Verif. Reliab.

View full text Add to dashboard Cite

SUMMARYAlthough a number of weaknesses of symbolic execution, when used for software testing, have been highlighted in the literature, the recent resurgence of strongly-typed languages has created opportunities for re-examining symbolic execution to determine whether these shortfalls can be overcome. This paper discusses symbolic execution in general and makes two contributions: (a) overcoming one of the key problems, analysing programs with indexed arrays; and (b) describing the incorporation of a symbolic execution module for test case generation into an integrated testing tool. For methods which index arrays, a new approach determines all the possible values of each array index, allowing the generation of equivalence classes for every possible combination of array element aliases. An incremental simplification approach, which converts path expressions to canonical forms in order to identify infeasible paths at the earliest opportunity and thus reduce the analysis time, is also described. Symbolic execution is most effective when included in an integrated test and analysis environment: a component test bench was built with a symbolic execution module integrated into it, providing a toolbox of software component test and code analysis methods aimed at programmers at all levels.

show abstract

Memory models in symbolic execution: key ideas and new thoughts

Borzacchiello

Coppa

D’Elia

et al. 2019

Software Testing Verif & Rel

View full text Add to dashboard Cite

Symbolic execution is a popular program analysis technique that allows seeking for bugs by reasoning over multiple alternative execution states at once. As the number of states to explore may grow exponentially, a symbolic executor may quickly run out of space. For instance, a memory access to a symbolic address may potentially reference the entire address space, leading to a combinatorial explosion of the possible resulting execution states. To cope with this issue, state-of-the-art executors either concretize symbolic addresses that span memory intervals larger than some threshold or rely on advanced capabilities of modern satisfiability modulo theories solvers. Unfortunately, concretization may result in missing interesting execution states, for example, where a bug arises, while offloading the entire problem to constraint solvers can lead to very large query times. In this article, we first contribute to systematizing knowledge about memory models for symbolic execution, discussing how four mainstream symbolic executors deal with symbolic addresses. We then introduce MEMSIGHT, a new approach to symbolic memory that reduces the need for concretization: rather than mapping address instances to data as previous approaches do, our technique maps symbolic address expressions to data, maintaining the possible alternative states resulting from the memory referenced by a symbolic address in a compact, implicit form. Experiments on prominent programs show that MEMSIGHT, which we implemented in both ANGR and KLEE, enables the exploration of states that are unreachable for memory models that perform concretization and provides a performance level comparable with memory models relying on advanced solver theories. MEMORY MODELS IN SYMBOLIC EXECUTION: KEY IDEAS AND NEW THOUGHTS3 of 35 used in the context of state-of-the-art symbolic executors. A crucial design goal for our approach is that it should be general enough not only to support bug detection but also to be valuable in application contexts where users are interested in possible consequences of these bugs, for example, understanding how they can be exploited.Our approach, which we call MEMSIGHT, natively accounts for merging [3,4], a mainstream performance enabler in symbolic executors. We integrated MEMSIGHT into the state-of-the-art symbolic executors ANGR [5] and KLEE [6]: an experimental evaluation shows that MEMSIGHT allows for broader state exploration on prominent benchmarks analysed with ANGR, while it provides valuable run-time speedups when symbolically executing real-world programs under KLEE.A preliminary version [7] of this work appeared in the Proceedings of the 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE 2017), where we introduced the main idea behind MEMSIGHT (Section 3) and presented a preliminary experimental evaluation related to MEMSIGHT when integrated into ANGR (Section 5.2.2). ‡ For our example to be meaningful, we assume that b resides in memory rather than in a CPU register. § In SMT-LIB [9], the theories of...

show abstract

Generalized Symbolic Execution for Model Checking and Testing

Cited by 374 publications

References 24 publications

Model Counting for Complex Data Structures

Model Counting for Complex Data Structures

Using symbolic execution to guide test generation

Memory models in symbolic execution: key ideas and new thoughts

Contact Info

Product

Resources

About