High-Level Abstractions for Simplifying Extended String Constraints in SMT

Abstract

Satisfiability Modulo Theories (SMT) solvers with support for the theory of strings have recently emerged as powerful tools for reasoning about string-manipulating programs. However, due to the complex semantics of extended string functions, it is challenging to develop scalable solvers for the string constraints produced by program analysis tools. We identify several classes of simplification techniques that are critical for the efficient processing of string constraints in SMT solvers. These techniques can reduce the size and complexity of input constraints by reasoning about arithmetic entailment, multisets, and string containment relationships over input terms. We provide experimental evidence that implementing them results in significant improvements over the performance of state-of-the-art SMT solvers for extended string constraints.

A Novel Approach to String Constraint Solving

“…The authors claimed that CVC4 was the first solver able to reason about a language of mixed constraints including strings together with integers, reals, arrays, and algebraic datatypes. This work has been revised and extended in the following years to handle extended string functions frequently occurring in security and verification applications such as contains, indexOf and replace [112,113].…”

Even Faster Conflicts and Lazier Reductions for String Solvers

“…We have implemented the strategy from Sect. 6 by extending cvc5, a CDCL(T )based state-of-the-art SMT solver that implements context-dependent simplifications [29], aggressive rewriting [27], and efficient reductions [28]. To evaluate our extension, we measure its performance on the 69,907 SMT-LIB benchmarks [9] that include the theory of strings 4 and on a set of 74 benchmarks which we have obtained from an industrial partner but are not allowed to make public.…”

“…Reynolds et al [29] describe an approach for lazily performing reductions after simplifying extended functions based on other constraints in the current context. In later work, Reynolds et al [27] propose the use of aggressive rewriting to eliminate or simplify extended string constraints before performing reductions. In this work, we propose techniques that can be combined with that earlier work to perform reductions even more lazily.…”

“…If t is a numeral n, it is mapped to the interval [n, n]. If t is a length term of the form |s|, then we compute an interval [ |s| , u |s| ] where |s| (resp., u |s| ) is a sound under-approximation (resp., over-approximation) of the length of s. We use the procedure described by Reynolds et al [27] to compute these approximations. We use it because it is available, well-tested, and designed to be fast, but any sound approximation could be used.…”

“…The former trivially has bounds [0, 0]. For the latter, we use the methods from [27] to infer lower and upper bounds for |s|. Note that every string has a lower length bound of 0.…”