Demand-Driven Compositional Symbolic Execution

Anand, Sandeep; Godefroid, Patrice; Tillmann, Nikolai

doi:10.1007/978-3-540-78800-3_28

Cited by 162 publications

(181 citation statements)

References 22 publications

Supporting

Mentioning

180

Contrasting

Unclassified

Order By: Relevance

“…For pmap, FlowTest finished in less than 10 minutes. In contrast, Splat did not finish in one day ( We did not compare our algorithm with combinations of other optimizations such as function summaries [7,1] or RWSets [2], as these techniques are orthogonal and can be combined to give better performance. Limitations.…”

Section: Case Studiesmentioning

confidence: 99%

“…This is particularly cumbersome for programs which manipulate data structures such as arrays. While compositional techniques [7,1] alleviate path explosion, full path coverage remains prob- lematic even for medium-sized applications within a reasonable testing budget, say, one night.…”

Section: Introductionmentioning

confidence: 99%

“…However, path explosion has been a fundamental barrier. Several optimizations have been proposed to prune redundant paths, such as function summarization [7,1] and the pruning of paths that have the same side-effects of some previously explored path through readwrite sets (RWSets) [2]. FlowTest is an optimization orthogonal to both function summarization and RWSets.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Reducing Test Inputs Using Information Partitions

Majumdar

2009

Computer Aided Verification

View full text Add to dashboard Cite

Abstract. Automatic symbolic techniques to generate test inputs, for example, through concolic execution, suffer from path explosion: the number of paths to be symbolically solved for grows exponentially with the number of inputs. In many applications though, the inputs can be partitioned into "non-interfering" blocks such that symbolically solving for each input block while keeping all other blocks fixed to concrete values can find the same set of assertion violations as symbolically solving for the entire input. This can greatly reduce the number of paths to be solved (in the best case, from exponentially many to linearly many in the number of inputs). We present an algorithm that combines test input generation by concolic execution with dynamic computation and maintenance of information flow between inputs. Our algorithm iteratively constructs a partition of the inputs, starting with the finest (all inputs separate) and merging blocks if a dependency is detected between variables in distinct input blocks during test generation. Instead of exploring all paths of the program, our algorithm separately explores paths for each block (while fixing variables in other blocks to random values). In the end, the algorithm outputs an input partition and a set of test inputs such that (a) inputs in different blocks do not have any dependencies between them, and (b) the set of tests provides equivalent coverage with respect to finding assertion violations as full concolic execution. We have implemented our algorithm in the Splat test generation tool. We demonstrate that our reduction is effective by generating tests for four examples in packet processing and operating system code.

show abstract

Section: Case Studiesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Reducing Test Inputs Using Information Partitions

Majumdar

2009

Computer Aided Verification

View full text Add to dashboard Cite

show abstract

“…Another avenue of future work consists of studying more precise refinement techniques based on compositional symbolic execution [1].…”

Section: Discussionmentioning

confidence: 99%

Efficient Testing of Concurrent Programs with Abstraction-Guided Symbolic Execution

Rungta

Mercer

Visser

2009

Model Checking Software

View full text Add to dashboard Cite

Abstract. Exhaustive search techniques such as model checking and symbolic execution are insufficient to detect errors in concurrent programs. In this work we present an abstraction-guided symbolic execution technique that quickly detects errors in concurrent programs that arise from thread schedules and input data values. An abstract system is generated that contains a set of key program locations that are relevant in testing the feasibility of a possible error in the program. We guide a symbolic execution along locations in the abstract system in an effort to generate a corresponding feasible execution trace to the error location. A combination of heuristics are used to automatically rank thread and data non-determinism in order to guide the execution. We demonstrate empirically that abstraction-guided symbolic execution generates feasible execution paths in the actual system to find concurrency errors in a few seconds where exhaustive symbolic execution fails to find the same errors in an hour.

show abstract

“…For completeness, we also introduce the RANDOM strategy that simply requires the execution of all changed statements. 1 To analyze change-testing strategies, including BR, DU, and the strategies presented in the next section, we use the PIE model [19] adapted for changes [15]: a change reveals a difference in the output if and only if the change executes, infects the state (i.e., creates an infection-a difference in the program state), and the infection propagates to the output. In the example of Figure 1, change ch1 is executed always (satisfying the execution condition), the state is infected if a does not equal 0, and the infection propagates to the output if, for example, line 9 is reached such that r equals p (i.e., when c is even), so that line 9 prints -a instead of a.…”

Section: A Coverage-based Strategiesmentioning

confidence: 99%

Applying aggressive propagation-based strategies for testing changes

Santelices

Harrold

2011

2011 Fourth IEEE International Conference on Software Testing, Verification and Validation

View full text Add to dashboard Cite

Abstract-Test-suite augmentation for evolving softwarethe process of augmenting a test suite to adequately test software changes-is necessary for any program that undergoes modifications as part of its development and maintenance cycles. Recently, we presented a new technique for test-suite augmentation based on leveraging the propagation conditions for the effects of changes. Although empirical studies show that this technique can be quite effective for testing changes, the experiments have been limited because of the complexity of the implementation. In this paper, we present a new and more efficient approach for propagation-based testing of changes that can reach much longer propagation-distances and can focus the testing more precisely on those behaviors of changes that can actually affect the output. Using an implementation of this new approach, we performed a study on a set of changes on Java programs for which we compared, to a much larger extent, our propagation-based strategy with other existing techniques for testing changes. The results of the study not only confirm the superior effectiveness of propagation-based strategies over these other techniques for testing changes, but also quantify that superiority and clarify the conditions under which our approach is most effective.

show abstract

Demand-Driven Compositional Symbolic Execution

Cited by 162 publications

References 22 publications

Reducing Test Inputs Using Information Partitions

Reducing Test Inputs Using Information Partitions

Efficient Testing of Concurrent Programs with Abstraction-Guided Symbolic Execution

Applying aggressive propagation-based strategies for testing changes

Contact Info

Product

Resources

About