CORAL: Solving Complex Constraints for Symbolic PathFinder

Souza, Matheus; Borges, Mateus; d’Amorim, Marcelo; Păsăreanu, Corina S.

doi:10.1007/978-3-642-20398-5_26

Cited by 48 publications

(45 citation statements)

References 13 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We evaluated our approach on the following Java artifacts: BankAccount, Rational, RationalRecursion, WBS, ASW, TCAS, Apollo, SwapNode, HeapOp, and LinkedList. All of these artifacts were used before for evaluating symbolic execution [2], [14], [18], [20], [21], [24], [25]. These subjects contain rich programming constructs, such as complex non-linear constraints, recursion, heap-manipulating methods, etc.…”

Section: Implementation and Evaluationmentioning

confidence: 99%

See 1 more Smart Citation

Compositional Symbolic Execution with Memoized Replay

Qiu

Yang

Păsăreanu

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

View full text Add to dashboard Cite

Abstract-Symbolic execution is a powerful, systematic analysis that has received much visibility in the last decade. Scalability however remains a major challenge for symbolic execution. Compositional analysis is a well-known general purpose methodology for increasing scalability. This paper introduces a new approach for compositional symbolic execution. Our key insight is that we can summarize each analyzed method as a memoization tree that captures the crucial elements of symbolic execution, and leverage these memoization trees to efficiently replay the symbolic execution of the corresponding methods with respect to their calling contexts. Memoization trees offer a natural way to compose in the presence of heap operations, which cannot be dealt with by previous work that uses logical formulas as summaries for compositional symbolic execution. Our approach also enables efficient target oriented symbolic execution for error detection or program coverage. Initial experimental evaluation based on a prototype implementation in Symbolic PathFinder shows that our approach can be up to an order of magnitude faster than traditional non-compositional symbolic execution.

show abstract

Section: Implementation and Evaluationmentioning

confidence: 99%

“…that are difficult to handle with symbolic execution. The largest of these artifacts is Apollo with 2.6 KLOC in 54 classes [21]. The program contains complex non-linear floating-point constraints and it is quite challenging to analyze.…”

Section: Implementation and Evaluationmentioning

confidence: 99%

Compositional Symbolic Execution with Memoized Replay

Qiu

Yang

Păsăreanu

et al. 2015

2015 IEEE/ACM 37th IEEE International Conference on Software Engineering

View full text Add to dashboard Cite

show abstract

“…in Spf) has been previously combined with interval solving and meta-heuristic search strategies to enhance numerical constraint solving. Although these strategies can solve constraints over complex mathematical functions, they reason about floating-point types in an inexact manner [9].…”

Section: Related Workmentioning

confidence: 99%

Symbolic Execution for Checking the Accuracy of Floating-Point Programs

Ramachandran

Păsăreanu

Wahl

2015

SIGSOFT Softw. Eng. Notes

View full text Add to dashboard Cite

Programs with floating-point calculations tend to give rise to hard-to-predict behavior. Such uncertainty cannot be ignored: floating-point errors can have catastrophic consequences, as it happened with the Patriot missile accident in 1991. The likelihood of such incidents can be decreased by using automated technology to reliably analyze numerical code. We present a symbolic execution approach to checking the accuracy of numerical programs, investigating how much a floating-point computation deviates from the "ideal" computation on real values. Our method is implemented in the Symbolic PathFinder tool and leverages and extends the floating-point decision procedure Realizer to check symbolic path constraints and to perform the accuracy checks. We further illustrate the possibility of using our tools to enhance abstract interpretation-based analyses to obtain tighter bounds on the numerical error introduced by floating-point computations. Initial experiments show the promise of our approach.

show abstract

“…It defines neighborhood relationships between models in Table 5: Benchmark Precisions Used in Shadow Value Execution a search space, and searches for the optimal model by iteratively evaluating selected models and their neighbors. PSO is used in a randomized constraint solver called CORAL [38] that is capable of finding floating-point models for given floating-point constraints. It keeps track of a group of models with their evaluation results, finds the next group to explore based on the current group, and reports the optimal among all explored models.…”

Section: Other Guided Random Search Strategiesmentioning

confidence: 99%

Efficient search for inputs causing high floating-point errors

Chiang

Gopalakrishnan

Rakamarić

et al. 2014

Proceedings of the 19th ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming

View full text Add to dashboard Cite

Tools for floating-point error estimation are fundamental to program understanding and optimization. In this paper, we focus on tools for determining the input settings to a floating point routine that maximizes its result error. Such tools can help support activities such as precision allocation, performance optimization, and auto-tuning. We benchmark current abstraction-based precision analysis methods, and show that they often do not work at scale, or generate highly pessimistic error estimates, often caused by non-linear operators or complex input constraints that define the set of legal inputs. We show that while concrete-testing-based error estimation methods based on maintaining shadow values at higher precision can search out higher error-inducing inputs, suitable heuristic search guidance is key to finding higher errors. We develop a heuristic search algorithm called Binary Guided Random Testing (BGRT). In 45 of the 48 total benchmarks, including many real-world routines, BGRT returns higher guaranteed errors. We also evaluate BGRT against two other heuristic search methods called ILS and PSO, obtaining better results.

show abstract

CORAL: Solving Complex Constraints for Symbolic PathFinder

Cited by 48 publications

References 13 publications

Compositional Symbolic Execution with Memoized Replay

Compositional Symbolic Execution with Memoized Replay

Symbolic Execution for Checking the Accuracy of Floating-Point Programs

Efficient search for inputs causing high floating-point errors

Contact Info

Product

Resources

About