Delta Execution for Efficient State-Space Exploration of Object-Oriented Programs

Abstract

State-space exploration is the essence of model checking and an increasingly popular approach for automating test generation. A key issue in exploration of object-oriented programs is handling the program state, in particular the heap. Previous research has focused on standard program execution that operates on one state/heap. We present Delta Execution, a technique that simultaneously operates on several states/heaps. Delta execution exploits the fact that many execution paths in state-space exploration partially overlap and speeds up the exploration by sharing the common parts across the executions and separately executing only the "deltas" where the executions differ. The heart of Delta Execution is an efficient representation and manipulation of sets of states/heaps.We have implemented Delta Execution in two model checkers: JPF and BOX. JPF is a popular general-purpose model checker for Java programs, and BOX is a specialized model checker that we have developed for efficient exploration of sequential Java programs. We have evaluated Delta Execution for (bounded) exhaustive exploration of ten basic subject programs without errors. The experimental results show that on average Delta Execution improves the exploration time 10.97x (over an order of magnitude) in JPF and 2.07x in BOX, while taking on average 1.51x less memory in JPF and roughly the same amount of memory in BOX. We have also evaluated Delta Execution for one larger case study with errors, where the exploration time improved up to 1.43x. Additionally, the experimental results for abstract matching, a recently proposed non-exhaustive exploration in JPF, of four subject programs show that on average Delta Execution improves the exploration time 3.37x.

Shadow symbolic execution for better testing of evolving software

“…As in other instances when different software variants or versions are run together [7,11,12,19,25], shadow symbolic execution can substantially increase memory consumption. As a result, it is important to maximise sharing between the symbolic states, and in particular the symbolic stores, of the two versions.…”

“…Running multiple versions in parallel has been employed in several other contexts, including online validation [19,25], model checking [7], product line testing [12], and software updating [11]. While some of the mechanisms developed in these contexts will likely prove useful here, longitudinal symbolic execution introduces specific challenges and opportunities in terms of path exploration, state sharing and constraint solving.…”

State extensions for java pathfinder

“…To increase the applicability and performance of JPF, we have developed several extensions for the JPF state representation and operations [3][4][5]. This paper summarizes four extensions, which we call Untracked State, Undo Backtracking, Delta Execution [4], and Mixed Execution [5].…”

“…This paper summarizes four extensions, which we call Untracked State, Undo Backtracking, Delta Execution [4], and Mixed Execution [5]. They affect the state operations in JPF: Untracked State and Undo Backtracking affect backtracking, Mixed Execution affects execution, and Delta Execution affects all three key operations.…”

“…While Untracked State and Undo Backtracking were explored previously, most notably for the SPIN model checker, our implementations address dynamic aspects of Java in the context of JPF. We originally proposed Delta Execution [4] and Mixed Execution [5], and detailed descriptions are available in d'Amorim's PhD thesis [3]. We point out that our code for Untracked State has been recently included in the JPF codebase [1], and our code for Undo Backtracking is being considered for inclusion by the JPF core team.…”