Filters








58,259 Hits in 3.6 sec

Efficient state merging in symbolic execution

Volodymyr Kuznetsov, Johannes Kinder, Stefan Bucur, George Candea
2012 Proceedings of the 33rd ACM SIGPLAN conference on Programming Language Design and Implementation - PLDI '12  
We present a way to automatically choose when and how to merge states such that the performance of symbolic execution is significantly increased.  ...  Second, we present dynamic state merging, a technique for merging states that interacts favorably with search strategies in automated test case generation and bug finding tools.  ...  Furthermore, state merging conflicts with important optimizations in symbolic execution: search-based symbolic execution engines, like the ones used in test case generators and bug finding tools, employ  ... 
doi:10.1145/2254064.2254088 dblp:conf/pldi/KuznetsovKBC12 fatcat:5q2g5ytf3veh5iysv6sooslyyq

Efficient state merging in symbolic execution

Volodymyr Kuznetsov, Johannes Kinder, Stefan Bucur, George Candea
2012 SIGPLAN notices  
We present a way to automatically choose when and how to merge states such that the performance of symbolic execution is significantly increased.  ...  Second, we present dynamic state merging, a technique for merging states that interacts favorably with search strategies in automated test case generation and bug finding tools.  ...  Furthermore, state merging conflicts with important optimizations in symbolic execution: search-based symbolic execution engines, like the ones used in test case generators and bug finding tools, employ  ... 
doi:10.1145/2345156.2254088 fatcat:vznqckjxizexjhavp2zvwindrm

MultiSE: multi-path symbolic execution using value summaries

Koushik Sen, George Necula, Liang Gong, Wontae Choi
2015 Proceedings of the 2015 10th Joint Meeting on Foundations of Software Engineering - ESEC/FSE 2015  
In this paper, we propose MultiSE, a new technique for merging states incrementally during symbolic execution, without using auxiliary variables.  ...  faster than traditional dynamic symbolic execution and, 3) MultiSE saves a substantial number of state merges compared to conventional state-merging techniques.  ...  In this paper we propose MultiSE, a new symbolic execution framework that achieves state merging without using auxiliary variables.  ... 
doi:10.1145/2786805.2786830 dblp:conf/sigsoft/SenNGC15 fatcat:pqs6av3karemfdgyv6iomuwb5q

Rethinking pointer reasoning in symbolic execution

Emilio Coppa, Daniele Cono D'Elia, Camil Demetrescu
2017 2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE)  
Unfortunately, this could result in missing interesting execution states, e.g., where a bug arises.  ...  Symbolic execution is a popular program analysis technique that allows seeking for bugs by reasoning over multiple alternative execution states at once.  ...  between the states to be merged.  ... 
doi:10.1109/ase.2017.8115671 dblp:conf/kbse/CoppaDD17 fatcat:3rxu43pypvfblf47jhkem55vyq

A lightweight symbolic virtual machine for solver-aided host languages

Emina Torlak, Rastislav Bodik
2014 SIGPLAN notices  
This lightweight compilation employs a novel symbolic execution technique with two key properties: it produces compact encodings, and it enables concrete evaluation to strip away host constructs that are  ...  They ease the construction of programs by using satisfiability solvers to automate tasks such as verification, debugging, synthesis, and non-deterministic execution.  ...  The research presented here was supported in part by awards from the Department of Energy (DOE DE-SC0005136 and DOE FOA-0000619) and the National Science Foundation (NSF CCF-0916351, NSF CCF-1139138, and  ... 
doi:10.1145/2666356.2594340 fatcat:du7xc3dttvhc3bhebst32w4ewi

A lightweight symbolic virtual machine for solver-aided host languages

Emina Torlak, Rastislav Bodik
2013 Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation - PLDI '14  
This lightweight compilation employs a novel symbolic execution technique with two key properties: it produces compact encodings, and it enables concrete evaluation to strip away host constructs that are  ...  They ease the construction of programs by using satisfiability solvers to automate tasks such as verification, debugging, synthesis, and non-deterministic execution.  ...  The research presented here was supported in part by awards from the Department of Energy (DOE DE-SC0005136 and DOE FOA-0000619) and the National Science Foundation (NSF CCF-0916351, NSF CCF-1139138, and  ... 
doi:10.1145/2594291.2594340 dblp:conf/pldi/TorlakB14 fatcat:5r6setxj5rf4be3jrgm3vjdnba

Memoized symbolic execution

Guowei Yang, Corina S. Păsăreanu, Sarfraz Khurshid
2012 Proceedings of the 2012 International Symposium on Software Testing and Analysis - ISSTA 2012  
This paper introduces memoized symbolic execution (Memoise), a new approach for more efficient application of forward symbolic execution, which is a well-studied technique for systematic exploration of  ...  Experiments using our prototype implementation of Memoise show the benefits it holds in various standard scenarios of using symbolic execution, e.g., with iterative deepening of exploration depth, to perform  ...  Memoized Analysis Memoized symbolic execution enables efficient re-execution based on the results cached in the trie structure.  ... 
doi:10.1145/2338965.2336771 dblp:conf/issta/YangPK12 fatcat:ijx2rnl7gzfdja7fc6mbpk6h4u

Efficient symbolic execution for software testing

Johannes Kinder
2014 2014 Formal Methods in Computer-Aided Design (FMCAD)  
Symbolic Execution • Do not merge two candidate states if they differ in hot variables • Avoids creating ite expressions Static Dynamic Merging not Beneficial void main(int argc, char **argv  ...  (BMC) else then 87 Symbolic Execution vs.  ... 
doi:10.1109/fmcad.2014.6987585 dblp:conf/fmcad/Kinder14 fatcat:5c7r5jajbfgszkgtz3m7qmenri

Delta Execution for Efficient State-Space Exploration of Object-Oriented Programs

M. d'Amorim, S. Lauterburg, D. Marinov
2008 IEEE Transactions on Software Engineering  
We have implemented Delta Execution in JPF, a popular generalpurpose model checker for Java programs, and in BOX, a specialized model checker that we have developed for efficient exploration of sequential  ...  It exploits the fact that many execution paths in state-space exploration partially overlap and speeds up the exploration by sharing the common parts across the executions and separately executing only  ...  We also thank Ryan Lefever, William Sanders, Joe Tucek, Yuanyuan Zhou, and Craig Zilles-our collaborators on the larger Delta Execution project [47] -for their comments on this work.  ... 
doi:10.1109/tse.2008.37 fatcat:lz7c2zf24nfqxj3c2ryp462drm

Delta execution for efficient state-space exploration of object-oriented programs

Marcelo d'Amorim, Steven Lauterburg, Darko Marinov
2007 Proceedings of the 2007 international symposium on Software testing and analysis - ISSTA '07  
We have implemented Delta Execution in JPF, a popular generalpurpose model checker for Java programs, and in BOX, a specialized model checker that we have developed for efficient exploration of sequential  ...  It exploits the fact that many execution paths in state-space exploration partially overlap and speeds up the exploration by sharing the common parts across the executions and separately executing only  ...  We also thank Ryan Lefever, William Sanders, Joe Tucek, Yuanyuan Zhou, and Craig Zilles-our collaborators on the larger Delta Execution project [47] -for their comments on this work.  ... 
doi:10.1145/1273463.1273472 dblp:conf/issta/dAmorimLM07 fatcat:ernfjykzvfdbxdd3rw266to5z4

Parallelizing user-defined aggregations using symbolic execution

Veselin Raychev, Madanlal Musuvathi, Todd Mytkowicz
2015 Proceedings of the 25th Symposium on Operating Systems Principles - SOSP '15  
These data types (i) encode specialized decision procedures for efficient symbolic execution and (ii) generate compact symbolic expressions for efficient network transfers.  ...  SYMPLE parallelizes these UDAs by breaking dependences using symbolic execution, where unresolved dependences are treated as symbolic values and the SYMPLE runtime partially evaluates the resulting symbolic  ...  Efficient symbolic execution This section describes how SYMPLE implements efficient symbolic execution and the design decisions that let us handle the challenges described in the previous section.  ... 
doi:10.1145/2815400.2815418 dblp:conf/sosp/RaychevMM15 fatcat:imldlqbetzdxzcdintyobcck4m

A Survey of Symbolic Execution Techniques [article]

Roberto Baldoni, Emilio Coppa, Daniele Cono D'Elia, Camil Demetrescu, Irene Finocchi
2018 arXiv   pre-print
Symbolic execution has been incubated in dozens of tools developed over the last four decades, leading to major practical breakthroughs in a number of prominent software reliability applications.  ...  Symbolic execution provides an elegant solution to the problem, by systematically exploring many possible execution paths at the same time without necessarily requiring concrete inputs.  ...  In order to reduce the number of active states, the symbolic engine can perform state merging.  ... 
arXiv:1610.00502v3 fatcat:zez6xtyiuna6rgv7ola3nzxmty

Automated Software Test Generation: Some Challenges, Solutions, and Recent Advances [chapter]

George Candea, Patrice Godefroid
2019 Lecture Notes in Computer Science  
The past decade has seen a resurgence in research interest for this problem, bringing about significant progress.  ...  In this article, we provide an overview of automated test generation for software, and then discuss recent developments that have had significant impact on real-life software.  ...  In contrast, in the context of symbolic execution for test generation, as a matter of principle, a merged state must precisely represent the information from all execution paths subsumed by that state  ... 
doi:10.1007/978-3-319-91908-9_24 fatcat:5udblyuumbcgndtoglrytm5c6m

A Survey of Symbolic Execution Techniques

Roberto Baldoni, Emilio Coppa, Daniele Cono D'elia, Camil Demetrescu, Irene Finocchi
2018 ACM Computing Surveys  
Symbolic execution has been incubated in dozens of tools developed over the last four decades, leading to major practical breakthroughs in a number of prominent software reliability applications.  ...  Symbolic execution provides an elegant solution to the problem, by systematically exploring many possible execution paths at the same time without necessarily requiring concrete inputs.  ...  In order to reduce the number of active states, the symbolic engine can perform state merging.  ... 
doi:10.1145/3182657 fatcat:h6kadibzkvevxa3lgzdtdokq74

Efficient symbolic simulation of low level software

Tamarah Arons, Elad Elster, Shlomit Ozer, Jonathan Shalev, Eli Singerman
2008 Proceedings of the conference on Design, automation and test in Europe - DATE '08  
In this paper we elaborate methods for the efficient symbolic simulation of embedded software; some methods are new, others are improvements of existing methods.  ...  Using these techniques we have been able to symbolically execute real life microcode of thousands of lines, allowing formal methods to become an integral part of microcode validation in Intel Corporation  ...  Introduction Symbolic execution, which has been successfully used in the formal verification of hardware [4] , is now also being applied to software of various levels [6] .  ... 
doi:10.1145/1403375.1403577 fatcat:3lmm7xavyfdkzkmvhbdzqs2mja
« Previous Showing results 1 — 15 out of 58,259 results