Using Test Ranges to Improve Symbolic Execution

Parallel Program Analysis via Range Splitting

“…Selective combinations [6,40,45,51,72,83,92] consider certain features of a task to choose the best approach for that task. Nesting approaches [3,4,25,26,30,32,49,82,84] use one or more approaches as components in a main approach. Interleaved approaches [1,2,5,10,42,50,55,58,62,68,75,78,90,97] alternate between different approaches that may or may not exchange information.…”

“…To realize parallel test-case generation, Korat [76] considers different input ranges in distinct parallel instances. Parallel symbolic execution approaches [82,86,87,88,89,94] and ranged model checking [48] split execution paths, thereby often partitioning the execution tree. The set of paths are characterized by input constraints [89], path prefixes [87,88], or ranges [82,86,94,48] and are either created statically from an initial shallow symbolic execution [87,88,89] or tests [82,86,94] or dynamically based on the already explored symbolic execution tree [27,34,82,86,98].…”

“…Parallel symbolic execution approaches [82,86,87,88,89,94] and ranged model checking [48] split execution paths, thereby often partitioning the execution tree. The set of paths are characterized by input constraints [89], path prefixes [87,88], or ranges [82,86,94,48] and are either created statically from an initial shallow symbolic execution [87,88,89] or tests [82,86,94] or dynamically based on the already explored symbolic execution tree [27,34,82,86,98]. While we reuse the idea of splitting the program paths into ranges [82,86,94,48], we generalize the idea of ranged symbolic execution [82,86,94] to arbitrary analyses and in particular allow to combine different analyses.…”

Running symbolic execution forever

“…The main weakness of using seeding for memoization is that a large number of seeds would need to be stored, making the approach impractical for large execution trees. Instead of generating test cases for every execution state, SynergiSE [21] exploits the implicit ordering of tests and uses bordering tests to describe unexplored or feasible subtrees. While this representation can significantly reduce space requirements compared to keeping one seed per leaf node, it relies on a fixed search order and doesn't provide the global view of a full execution tree.…”