“…Specifically, in addition to finding a single feasible solution of the outer branch through constraint solvers, we also target at obtaining the bounded ranges of the related input variables for the target path constraint. We describe such bounded ranges by linearizing the path constraint as a polyhedron, denoted as the "polyhedral path abstraction", for guiding both the mutation and the constraint 1 i n t main ( ) { 2 u n s i g n e d v , w, x , y , z = i n p u t ( ) ; • The polyhedral path abstraction of a path constraint enables us to convert the problem of mutating the seeds into the problem of sampling over a polyhedron, which has been well studied and has many efficient solutions [10], [11], [12], [13], [14], [15]. In this work, we adopt a state-of-the-art technique, the Dikin walk algorithm [15], which can achieve the polynomial time complexity, to efficiently generate a large number of inputs while still respecting the target path constraints.…”