Type-Dependence Analysis and Program Transformation for Symbolic Execution

Abstract

Abstract. Symbolic execution can be problematic when applied to real applications. This paper addresses two of these problems: (1) the constraints generated during symbolic execution may be of a type not handled by the underlying decision procedure, and (2) some parts of the application may be unsuitable for symbolic execution (e.g., third-party libraries). The paper presents type-dependence analysis, which performs a context-and field-sensitive interprocedural static analysis to identify program entities that may store symbolic values at run-time. This information is used to identify the above two problematic cases and assist the user in addressing them. The paper also presents a technique to transform real applications for efficient symbolic execution. Instead of transforming the entire application, which can be inefficient and infeasible (mostly for pragmatic reasons), our technique leverages the results of type-dependence analysis to transform only parts of the program that may interact with symbolic values. Finally, the paper discusses the implementation of our analysis and transformation technique in a tool, stinger, and an empirical evaluation performed on two real applications. The results of the evaluation show the effectiveness of our approach.

Context-Sensitive Relevancy Analysis for Efficient Symbolic Execution

“…The approach in [21] is closely related to this work. However, the focus of that paper is precise instrumentation through static analysis whereas the focus of this work is on performance enhancements through the static analysis phase.…”

“…However, the focus of that paper is precise instrumentation through static analysis whereas the focus of this work is on performance enhancements through the static analysis phase. Approaches adopted in [21] and this work consider two streams of performing context-sensitive program analysis, i.e., context-cloning vs. context-stacking. The analysis in [21] borrows ideas and algorithms from points-to analysis, e.g., the match of field read and write operations are formalized as a CFL (Context Free Language)-reachability problem.…”

“…Approaches adopted in [21] and this work consider two streams of performing context-sensitive program analysis, i.e., context-cloning vs. context-stacking. The analysis in [21] borrows ideas and algorithms from points-to analysis, e.g., the match of field read and write operations are formalized as a CFL (Context Free Language)-reachability problem. Their approach to context-sensitivity is based on context-cloning following [14] and the k-CFA approach to handle procedural calls, whereas our analysis based on pushdown system complemented with the refined modelling on globals can reach a higher precision due to the absence of restriction on recursions and call depth.…”

“…Their approach to context-sensitivity is based on context-cloning following [14] and the k-CFA approach to handle procedural calls, whereas our analysis based on pushdown system complemented with the refined modelling on globals can reach a higher precision due to the absence of restriction on recursions and call depth. Note that we cannot compare our work with [21] as neither the tool described in that work or the versions of the example programs used there are in the public domain. No performance statistics are mentioned in that paper.…”

A survey of new trends in symbolic execution for software testing and analysis

“…A specialized type-dependence analysis [2] can be used to minimize the instrumentation effort, by determining which parts of the code depend on the inputs and therefore needs to be instrumented, the rest of the code remaining unchanged. We describe some details of the instrumentation in Sect.…”